PR5.1: Trait-first gating (initial): dot-path traits in hook; remove inbound/provider name checks in Inbound, Diagnostics; trait-gate settings and scripts; TunnelSettings sinch detection by traits

Author: Faxbot Agent

api/admin_ui/src/components/Diagnostics.tsx

@@ -571,16 +571,17 @@ function Diagnostics({ client, onNavigate, docsBase }: DiagnosticsProps) {
 
     const { checks } = diagnostics;
 
-    if (active?.outbound === 'phaxio') {
-      const phaxio = checks.phaxio || {};
+    // Provider‑specific guidance based on available diagnostics keys
+    if ((checks as any).phaxio) {
+      const phaxio = (checks as any).phaxio || {};
       if (!phaxio.api_key_set) suggestions.push({ type: 'error', text: 'Set PHAXIO_API_KEY in .env' });
       if (!phaxio.api_secret_set) suggestions.push({ type: 'error', text: 'Set PHAXIO_API_SECRET in .env' });
       if (!phaxio.callback_url_set) suggestions.push({ type: 'warning', text: 'Set PHAXIO_STATUS_CALLBACK_URL (or PHAXIO_CALLBACK_URL)' });
       if (phaxio.public_url_https === false) suggestions.push({ type: 'warning', text: 'Use HTTPS for PUBLIC_API_URL' });
     }
-    
-    if (active?.outbound === 'sip') {
-      const sip = checks.sip || {};
+
+    if ((checks as any).sip) {
+      const sip = (checks as any).sip || {};
       if (sip.ami_password_not_default === false) suggestions.push({ type: 'error', text: 'Change ASTERISK_AMI_PASSWORD from default "changeme"' });
       if (sip.ami_reachable === false) suggestions.push({ type: 'error', text: 'Verify Asterisk AMI host/port/credentials and network reachability' });
     }

api/admin_ui/src/components/Inbound.tsx

@@ -419,7 +419,7 @@ function Inbound({ client, docsBase }: InboundProps) {
             </Box>
           )}
 
-          {callbacks && active?.inbound === 'sip' && (
+          {callbacks && hasTrait('inbound','requires_ami') && (
             <Box>
               <Typography variant="subtitle2" fontWeight={600} sx={{ mb: 1 }}>
                 Asterisk Inbound Configuration
@@ -619,24 +619,9 @@ same => n,System(curl -s -X POST -H "Content-Type: application/json" -H "X-Inter
                     <Typography variant="body2" sx={{ mb: 1 }}>
                       Most failures are due to webhook configuration or auth. Use the links below for your active inbound provider.
                     </Typography>
-                    {active?.inbound === 'sinch' && (
-                      <Stack direction="row" spacing={1} flexWrap="wrap">
-                        <Button size="small" variant="outlined" href={anchors['sinch-inbound-webhook'] || thirdParty['sinch-inbound-webhook']} target="_blank" rel="noreferrer">Sinch: Inbound webhook</Button>
-                        <Button size="small" variant="outlined" href={anchors['sinch-inbound-basic-auth'] || thirdParty['sinch-inbound-basic-auth']} target="_blank" rel="noreferrer">Sinch: Callback auth</Button>
-                      </Stack>
-                    )}
-                    {active?.inbound === 'phaxio' && (
-                      <Stack direction="row" spacing={1} flexWrap="wrap">
-                        <Button size="small" variant="outlined" href={anchors['phaxio-inbound-setup']} target="_blank" rel="noreferrer">Phaxio: Inbound setup</Button>
-                        <Button size="small" variant="outlined" href={anchors['phaxio-webhook-hmac'] || thirdParty['phaxio-webhook-hmac']} target="_blank" rel="noreferrer">Phaxio: Verify HMAC</Button>
-                      </Stack>
-                    )}
-                    {active?.inbound === 'sip' && (
-                      <Stack direction="row" spacing={1} flexWrap="wrap">
-                        <Button size="small" variant="outlined" href={anchors['sip-ami-setup'] || thirdParty['sip-ami-setup']} target="_blank" rel="noreferrer">Asterisk: AMI setup</Button>
-                        <Button size="small" variant="outlined" href={anchors['sip-ami-security'] || thirdParty['sip-ami-security']} target="_blank" rel="noreferrer">AMI security</Button>
-                      </Stack>
-                    )}
+                    <Stack direction="row" spacing={1} flexWrap="wrap">
+                      <Button size="small" variant="outlined" href={anchors['inbound-overview']} target="_blank" rel="noreferrer">Inbound docs</Button>
+                    </Stack>
                   </Alert>
                 </Box>
               )}

api/admin_ui/src/components/ScriptsTests.tsx

@@ -142,7 +142,7 @@ const ConsoleBox: React.FC<{ lines: string[]; loading?: boolean; title?: string
 };
 
 const ScriptsTests: React.FC<Props> = ({ client, docsBase }) => {
-  const { active } = useTraits();
+  const { active, registry } = useTraits();
   const [error, setError] = useState<string>('');
   const [busyAuth, setBusyAuth] = useState<boolean>(false);
   const [busyInbound, setBusyInbound] = useState<boolean>(false);
@@ -508,7 +508,7 @@ const ScriptsTests: React.FC<Props> = ({ client, docsBase }) => {
         )}
 
         {/* Backend-specific helpers */}
-        {active?.outbound === 'sip' && (
+        {hasTrait('outbound','requires_ami') && (
           <Grid item xs={12} lg={6}>
             <ResponsiveFormSection
               title="SIP/Asterisk: Inbound Secret"
@@ -553,10 +553,11 @@ const ScriptsTests: React.FC<Props> = ({ client, docsBase }) => {
           </Grid>
         )}
 
-        {active?.outbound === 'phaxio' && (
+        {/* Show callback URL section when outbound supports status callbacks */}
+        {Boolean(registry && active?.outbound && registry[active.outbound]?.traits?.status_callback) && (
           <Grid item xs={12} lg={6}>
             <ResponsiveFormSection
-              title="Phaxio: Set Callback URL"
+              title="Status Callback URL"
               subtitle="Configure webhook endpoint for status updates"
               icon={<SettingsIcon />}
             >
@@ -580,7 +581,7 @@ const ScriptsTests: React.FC<Props> = ({ client, docsBase }) => {
                 </Stack>
                 <Alert severity="warning" sx={{ borderRadius: 2 }}>
                   <Typography variant="caption">
-                    Ensure this is HTTPS and publicly reachable. Configure webhook verification if your provider supports signatures (Phaxio). For Sinch inbound, use Basic auth.
+                    Ensure this is HTTPS and publicly reachable. Configure verification according to the active providers traits.
                   </Typography>
                 </Alert>
               </Stack>
@@ -591,9 +592,7 @@ const ScriptsTests: React.FC<Props> = ({ client, docsBase }) => {
         {/* Inbound Callbacks Info + Local Parser Tester */}
         <Grid item xs={12}>
           <ResponsiveFormSection
-            title={active?.inbound === 'phaxio' ? 'Phaxio Inbound Callback' : 
-                   active?.inbound === 'sinch' ? 'Sinch Inbound Callback' : 
-                   active?.inbound === 'sip' ? 'Asterisk Inbound (internal)' : 'Inbound Callback'}
+            title="Inbound Callback"
             subtitle="View current callback configuration"
             icon={<InfoIcon />}
           >

api/admin_ui/src/components/Settings.tsx

@@ -56,7 +56,7 @@ function Settings({ client }: SettingsProps) {
   const [importingEnv, setImportingEnv] = useState<boolean>(false);
   const [importResult, setImportResult] = useState<{discovered:number; prefixes:string[]} | null>(null);
   const [lastGeneratedSecret, setLastGeneratedSecret] = useState<string>('');
-  const { hasTrait, active } = useTraits();
+  const { hasTrait, active, traitValue, registry } = useTraits();
   const handleForm = (field: string, value: any) => setForm((prev: any) => ({ ...prev, [field]: value }));
   const isSmall = useMediaQuery('(max-width:900px)');
   const ctlStyle: React.CSSProperties = { background: 'transparent', color: 'inherit', borderColor: '#444', padding: '6px', borderRadius: 6, width: isSmall ? '100%' : 'auto', maxWidth: isSmall ? '100%' : undefined };
@@ -179,11 +179,14 @@ function Settings({ client }: SettingsProps) {
 
       // Provider-specific settings (traits-aware)
       const activeOutbound = active?.outbound;
-      if (activeOutbound === 'phaxio') {
+      const methods = (traitValue('outbound', 'auth.methods') || []) as string[];
+      // Providers with basic-only auth (e.g., Phaxio-like)
+      if (Array.isArray(methods) && methods.includes('basic') && !methods.includes('oauth2')) {
         if (form.phaxio_api_key) p.phaxio_api_key = form.phaxio_api_key;
         if (form.phaxio_api_secret) p.phaxio_api_secret = form.phaxio_api_secret;
       }
-      if (activeOutbound === 'sinch') {
+      // Providers supporting OAuth2 (e.g., Sinch-like)
+      if (Array.isArray(methods) && methods.includes('oauth2')) {
         if (form.sinch_project_id) p.sinch_project_id = form.sinch_project_id;
         if (form.sinch_api_key) p.sinch_api_key = form.sinch_api_key;
         if (form.sinch_api_secret) p.sinch_api_secret = form.sinch_api_secret;
@@ -485,7 +488,7 @@ function Settings({ client }: SettingsProps) {
           </ResponsiveSettingSection>
 
           {/* Backend-Specific Configuration */}
-          {active?.outbound === 'phaxio' && (
+          {(() => { const m = (traitValue('outbound','auth.methods') || []) as string[]; return Array.isArray(m) && m.includes('basic') && !m.includes('oauth2'); })() && (
                   <>
                   <Box id="settings-phaxio" />
                   <ResponsiveSettingSection
@@ -540,7 +543,7 @@ function Settings({ client }: SettingsProps) {
                   </>
                 )}
 
-                {active?.outbound === 'sinch' && (
+                {(() => { const m = (traitValue('outbound','auth.methods') || []) as string[]; return Array.isArray(m) && m.includes('oauth2'); })() && (
                   <>
                   <Box id="settings-sinch" />
                   <ResponsiveSettingSection
@@ -688,7 +691,7 @@ function Settings({ client }: SettingsProps) {
                   </ResponsiveSettingSection>
                 )}
 
-                {active?.outbound === 'sip' && (
+                {hasTrait('outbound','requires_ami') && (
                   <>
                   <Box id="settings-sip" />
                   <ResponsiveSettingSection
@@ -847,7 +850,7 @@ function Settings({ client }: SettingsProps) {
               showCurrentValue={true}
             />
 
-            {effectiveInbound === 'sip' && (
+            {hasTrait('inbound','requires_ami') && (
               <Box sx={{ mt: 2 }}>
                 <ResponsiveSettingItem
                   icon={<SecurityIcon />}
@@ -908,7 +911,7 @@ function Settings({ client }: SettingsProps) {
               </Box>
             )}
 
-            {effectiveInbound === 'phaxio' && (
+            {traitValue('inbound','webhook.verification') === 'hmac_sha256' && (
               <ResponsiveSettingItem
                 icon={settings.inbound?.phaxio?.verify_signature ? <CheckCircleIcon color="success" /> : <WarningIcon color="warning" />}
                 label="Verify Phaxio Inbound Signature"
@@ -925,7 +928,7 @@ function Settings({ client }: SettingsProps) {
               />
             )}
 
-            {effectiveInbound === 'sinch' && (
+            {traitValue('inbound','webhook.verification') === 'basic_auth' && (
               <Box sx={{ mt: 2 }}>
                 <ResponsiveSettingItem
                   icon={settings.inbound?.sinch?.basic_auth_configured ? <CheckCircleIcon color="success" /> : <WarningIcon color="warning" />}

api/admin_ui/src/components/TunnelSettings.tsx

@@ -3,6 +3,7 @@ import { Alert, Box, Button, Chip, Dialog, DialogActions, DialogContent, DialogT
 import { Link as LinkIcon, Security, VpnKey, VpnLock } from '@mui/icons-material';
 import AdminAPIClient from '../api/client';
 import type { TunnelStatus } from '../api/types';
+import { useTraits } from '../hooks/useTraits';
 import { ResponsiveFormSection, ResponsiveSelect, ResponsiveTextField, ResponsiveFileUpload } from './common/ResponsiveFormFields';
 import { SmoothLoader, InlineLoader } from './common/SmoothLoader';
 
@@ -76,14 +77,15 @@ export default function TunnelSettings({ client, docsBase, hipaaMode }: Props) {
     (async () => {
       try {
         const s = await client.getSettings();
-        const inbound = (s?.hybrid?.inbound_backend || s?.backend?.type || '').toLowerCase();
-        setIsSinchActive(inbound === 'sinch');
+        // Trait-gated detection: consider Sinch-like when OAuth2 is available for the active inbound provider
+        const methods = (traitValue('inbound', 'auth.methods') || []) as string[];
+        setIsSinchActive(Array.isArray(methods) && methods.includes('oauth2'));
         setInboundEnabled(Boolean(s?.inbound?.enabled));
       } catch {
         // no-op
       }
     })();
-  }, [client]);
+  }, [client, traitValue]);
 
   // Auto-register Sinch webhook when tunnel URL changes (non-HIPAA only)
   useEffect(() => {
@@ -463,3 +465,4 @@ export default function TunnelSettings({ client, docsBase, hipaaMode }: Props) {
     </Box>
   );
 }
+  const { traitValue } = useTraits();

api/admin_ui/src/hooks/useTraits.ts

@@ -97,28 +97,31 @@ export function useTraits(): TraitsHook {
     load();
   }, [fetchProviders]);
 
+  // Dot-path getter
+  const dotGet = (obj: any, path: string) => {
+    try {
+      return path.split('.').reduce((acc: any, k: string) => (acc && acc[k] !== undefined ? acc[k] : undefined), obj);
+    } catch {
+      return undefined;
+    }
+  };
+
   const hasTrait = useCallback((direction: 'outbound' | 'inbound', key: string): boolean => {
     if (!providers?.active || !providers?.registry) return false;
-    
     const activeProvider = providers.active[direction];
     if (!activeProvider) return false;
-    
     const providerInfo = providers.registry[activeProvider];
     if (!providerInfo?.traits) return false;
-    
-    return key in providerInfo.traits;
+    return dotGet(providerInfo.traits, key) !== undefined;
   }, [providers]);
 
   const traitValue = useCallback((direction: 'outbound' | 'inbound', key: string): any => {
     if (!providers?.active || !providers?.registry) return undefined;
-    
     const activeProvider = providers.active[direction];
     if (!activeProvider) return undefined;
-    
     const providerInfo = providers.registry[activeProvider];
     if (!providerInfo?.traits) return undefined;
-    
-    return providerInfo.traits[key];
+    return dotGet(providerInfo.traits, key);
   }, [providers]);
 
   const getWebhookUrl = useCallback((direction: 'inbound' | 'outbound'): string | null => {