fix(inboxes): block disabled widget config and inbound calls

app/controllers/api/v1/widget/configs_controller.rb

@@ -1,4 +1,5 @@
 class Api::V1::Widget::ConfigsController < Api::V1::Widget::BaseController
+  before_action :ensure_inbox_active
   before_action :set_global_config
 
   def create

enterprise/app/controllers/twilio/voice_controller.rb

@@ -90,10 +90,10 @@ class Twilio::VoiceController < ApplicationController
     from_number.start_with?('client:')
   end
 
-  # A fresh contact-initiated leg on an inbox with inbound calls turned off.
+  # A fresh contact-initiated leg on an inbox that cannot receive calls.
   # Reject it so no conference, conversation, or Call row is created.
   def reject_inbound?
-    twilio_direction == 'inbound' && !agent_leg?(twilio_from) && !inbox.channel.inbound_calls_enabled?
+    twilio_direction == 'inbound' && !agent_leg?(twilio_from) && (!inbox.active? || !inbox.channel.inbound_calls_enabled?)
   end
 
   def reject_twiml

spec/controllers/api/v1/widget/configs_controller_spec.rb

@@ -31,6 +31,18 @@ RSpec.describe '/api/v1/widget/config', type: :request do
         response_data = response.parsed_body
         expect(response_data.keys).to include(*response_keys)
       end
+
+      it 'does not initialize config or create a contact when the inbox is disabled' do
+        web_widget.inbox.update!(active: false)
+
+        expect do
+          post '/api/v1/widget/config',
+               params: params,
+               as: :json
+        end.not_to change(Contact, :count)
+
+        expect(response).to have_http_status(:forbidden)
+      end
     end
 
     context 'with correct website token and valid X-Auth-Token' do
@@ -48,6 +60,17 @@ RSpec.describe '/api/v1/widget/config', type: :request do
         expect(response_data['contact']['pubsub_token']).to eq(contact_inbox.pubsub_token)
       end
 
+      it 'does not initialize config when the inbox is disabled' do
+        web_widget.inbox.update!(active: false)
+
+        post '/api/v1/widget/config',
+             params: params,
+             headers: { 'X-Auth-Token' => token },
+             as: :json
+
+        expect(response).to have_http_status(:forbidden)
+      end
+
       it 'returns 401 if account is suspended' do
         account.update!(status: :suspended)
 

spec/enterprise/controllers/twilio/voice_controller_spec.rb

@@ -129,6 +129,23 @@ RSpec.describe 'Twilio::VoiceController', type: :request do
       expect(response).to have_http_status(:ok)
       expect(response.body).to include('<Reject')
     end
+
+    it 'rejects the inbound contact leg without building a call when the inbox is disabled' do
+      inbox.update!(active: false)
+      expect(Voice::InboundCallBuilder).not_to receive(:perform!)
+
+      expect do
+        post "/twilio/voice/call/#{digits}", params: {
+          'CallSid' => call_sid,
+          'From' => from_number,
+          'To' => to_number,
+          'Direction' => 'inbound'
+        }
+      end.not_to change(Call, :count)
+
+      expect(response).to have_http_status(:ok)
+      expect(response.body).to include('<Reject')
+    end
   end
 
   describe 'POST /twilio/voice/status/:phone' do