feat: call ordinary phones from qrypt.chat, 10 free minutes a day (0.14.0) (#335)

Anthony: "rebuild so it works like skype used to" (after Suparelay), and "let
people make ten minutes of phone calls a day for free".

/phone (Navbar "Phone"): a dialer for US and Canadian numbers on Telnyx.
- The browser's line is a per-user Telnyx telephony credential on a credential
  connection with NO outbound voice profile: a WebRTC token cannot dial the phone
  network. POST /api/phone/call checks the number and the allowance, rings that
  line through a Call Control app, and on call.answered transfers it to the number
  with time_limit_secs = the allowance, so Telnyx itself ends the call.
- call.answered / call.hangup on the phone leg (signed Ed25519 webhooks at
  /api/phone/webhook, raw 32-byte or PEM key) bill answer -> hang-up seconds.
- 10 free minutes a day (UTC) for signed-in accounts, none for anonymous ones,
  operators (PHONE_OPERATOR_IDS) an hour a call. 911/N11, 900/976 and fictional
  555-01XX numbers are refused; one live call per person.
- Caller ID is forced to PHONE_CALLER_ID by the connection's ANI override. The
  outbound profile allows US/CA only with a $10/day spend cap.
- The page says plainly that calls to phones are not end-to-end encrypted.

Tables phone_lines and phone_calls (service role only), migration applied on dev2.
Tested against the real phone network before building: browser rang, server
transferred to NIST's time line (+1 303-499-7111), audio transcribed as "At the
tone, 12 hours, 43 minutes, coordinated universal time", and Telnyx ended the
call at the time limit (hangup_cause time_limit).

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: ralyodio

bun.lock

@@ -1,7 +1,7 @@
 {
   "name": "qryptchat-web",
   "private": true,
-  "version": "0.13.4",
+  "version": "0.14.0",
   "type": "module",
   "bin": {
     "qc": "./bin/qc.js",
@@ -71,6 +71,7 @@
     "@simplewebauthn/server": "^14.0.3",
     "@supabase/ssr": "^0.7.0",
     "@supabase/supabase-js": "^2.56.0",
+    "@telnyx/webrtc": "2.28.0",
     "blessed": "^0.1.81",
     "dilithium-crystals": "^1.0.6",
     "dotenv": "^17.2.2",

package.json

@@ -0,0 +1,26 @@
+import { NextResponse } from 'next/server';
+import { withAuth } from '@/lib/api/middleware/auth.js';
+import { RateLimiter, applyRateLimitForKey } from '@/lib/server/rate-limiter.js';
+import { startCall } from '@/lib/server/phone.js';
+import { phoneContext, phoneError, phoneUser } from '@/lib/server/phone-route.js';
+
+const perMinute = new RateLimiter({ maxRequests: 10, windowMs: 60 * 1000 });
+const perDay = new RateLimiter({ maxRequests: 200, windowMs: 24 * 60 * 60 * 1000 });
+
+/**
+ * POST /api/phone/call { to }: call a US or Canadian phone. Rings this user's
+ * browser line first; the number is dialled once the browser answers.
+ */
+export const POST = withAuth(async ({ request, locals }) => {
+	const limited = applyRateLimitForKey(perMinute, locals.user.id) || applyRateLimitForKey(perDay, locals.user.id);
+	if (limited) return limited;
+	try {
+		const body = await request.json().catch(() => ({}));
+		const ctx = phoneContext();
+		const user = await phoneUser(ctx.db, locals.user.id);
+		const result = await startCall({ ...ctx, user, to: body?.to });
+		return NextResponse.json(result, { headers: { 'Cache-Control': 'no-store' } });
+	} catch (error) {
+		return phoneError(error, 'call');
+	}
+});

src/app/api/phone/call/route.js

@@ -0,0 +1,16 @@
+import { NextResponse } from 'next/server';
+import { withAuth } from '@/lib/api/middleware/auth.js';
+import { hangupCall } from '@/lib/server/phone.js';
+import { phoneContext, phoneError, phoneUser } from '@/lib/server/phone-route.js';
+
+/** POST /api/phone/hangup { callId }: end this user's call on both legs. */
+export const POST = withAuth(async ({ request, locals }) => {
+	try {
+		const body = await request.json().catch(() => ({}));
+		const ctx = phoneContext();
+		const user = await phoneUser(ctx.db, locals.user.id);
+		return NextResponse.json(await hangupCall({ ...ctx, user, callId: String(body?.callId || '') }));
+	} catch (error) {
+		return phoneError(error, 'hangup');
+	}
+});

src/app/api/phone/hangup/route.js

@@ -0,0 +1,23 @@
+import { NextResponse } from 'next/server';
+import { withAuth } from '@/lib/api/middleware/auth.js';
+import { accountState } from '@/lib/server/phone.js';
+import { phoneContext, phoneError, phoneUser } from '@/lib/server/phone-route.js';
+import { CENTS_PER_MINUTE, FREE_SECONDS_PER_DAY } from '@/lib/phone/rules.js';
+
+export const dynamic = 'force-dynamic';
+
+/** GET /api/phone: today's free minutes, recent calls, caller ID. */
+export const GET = withAuth(async ({ locals }) => {
+	try {
+		const { db, store, config } = phoneContext();
+		const user = await phoneUser(db, locals.user.id);
+		const account = await accountState({ store, user });
+		const calls = (await store.recentCalls(user.id)) || [];
+		return NextResponse.json(
+			{ ...account, freeSecondsPerDay: FREE_SECONDS_PER_DAY, centsPerMinute: CENTS_PER_MINUTE, callerId: config.callerId, calls },
+			{ headers: { 'Cache-Control': 'no-store' } }
+		);
+	} catch (error) {
+		return phoneError(error, 'status');
+	}
+});

src/app/api/phone/route.js

@@ -0,0 +1,24 @@
+import { NextResponse } from 'next/server';
+import { withAuth } from '@/lib/api/middleware/auth.js';
+import { RateLimiter, applyRateLimitForKey } from '@/lib/server/rate-limiter.js';
+import { loginToken } from '@/lib/server/phone.js';
+import { phoneContext, phoneError, phoneUser } from '@/lib/server/phone-route.js';
+
+const limiter = new RateLimiter({ maxRequests: 20, windowMs: 60 * 1000 });
+
+/**
+ * POST /api/phone/token: a short-lived login for the browser's phone line
+ * (Telnyx WebRTC). The line can only receive calls; the server places them.
+ */
+export const POST = withAuth(async ({ locals }) => {
+	const limited = applyRateLimitForKey(limiter, locals.user.id);
+	if (limited) return limited;
+	try {
+		const ctx = phoneContext();
+		const user = await phoneUser(ctx.db, locals.user.id);
+		const { token } = await loginToken({ ...ctx, user });
+		return NextResponse.json({ token }, { headers: { 'Cache-Control': 'no-store' } });
+	} catch (error) {
+		return phoneError(error, 'token');
+	}
+});

src/app/api/phone/token/route.js

@@ -0,0 +1,35 @@
+import { NextResponse } from 'next/server';
+import { handleEvent } from '@/lib/server/phone.js';
+import { phoneContext } from '@/lib/server/phone-route.js';
+import { telnyxConfig, verifyWebhook } from '@/lib/server/telnyx-voice.js';
+
+export const dynamic = 'force-dynamic';
+
+/**
+ * POST /api/phone/webhook: Telnyx Call Control events for qrypt.chat calls
+ * (answered, hangup, ...). Signed with Ed25519; anything unsigned is refused.
+ */
+export async function POST(request) {
+	const body = await request.text();
+	const ok = verifyWebhook({
+		body,
+		signature: request.headers.get('telnyx-signature-ed25519'),
+		timestamp: request.headers.get('telnyx-timestamp'),
+		publicKey: telnyxConfig().publicKey,
+	});
+	if (!ok) return NextResponse.json({ error: 'Bad signature' }, { status: 401 });
+	let event;
+	try {
+		event = JSON.parse(body)?.data;
+	} catch {
+		return NextResponse.json({ error: 'Bad JSON' }, { status: 400 });
+	}
+	try {
+		const result = await handleEvent({ ...phoneContext(), event });
+		return NextResponse.json({ ok: true, ...result });
+	} catch (error) {
+		console.error('[phone/webhook]', event?.event_type, error?.message);
+		// 500 makes Telnyx retry, which handleEvent tolerates.
+		return NextResponse.json({ error: 'failed' }, { status: 500 });
+	}
+}