Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

task(recovery-phone): Support twilio api key #18500

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
Open

task(recovery-phone): Support twilio api key #18500

wants to merge 3 commits into from

Conversation

dschom
Copy link
Contributor

@dschom dschom commented Mar 3, 2025

Because

  • We want to use twilio API keys
  • We don't want to use the twilio Auth Token

This pull request

  • Switches over to using api keys
  • Adds method for signing webhook urls, so we can validate webhook calls originated from us.
  • Adds ability to configure webhook url, keys for signing, and api keys.
  • Still supports authToken so it's backwards compatible
  • Creates custom mechanism for validating webhook calls, since the authToken is used by twilio to validate the signed payload.
  • Removes the twilio-signature auth strategy and moves validation inline due to hapi limitations accessing the payload in the authorization.
  • Adds lots of comments and some doc about how to manually test this with ngrok.

Issue that this pull request solves

Closes: FXA-11191

Checklist

Put an x in the boxes that apply

  • My commit is GPG signed.
  • If applicable, I have modified or added tests which pass locally.
  • I have added necessary documentation (if appropriate).
  • I have verified that my changes render correctly in RTL (if appropriate).

Screenshots (Optional)

Please attach the screenshots of the changes made in case of change in user interface.

Other information (Optional)

See comments about readme for manual testing with ngrok. It'd be nice if the reviewer, validated this works for them as well.

@dschom dschom requested a review from a team as a code owner March 3, 2025 21:48
@dschom dschom force-pushed the FXA-11191 branch 4 times, most recently from 8103881 to 37ea146 Compare March 6, 2025 01:54
dschom added 3 commits March 6, 2025 13:49
Because:
- Integration tests would often fail locally.
- Connection pool was getting exhausted
- Connection pool was not getting terminated

This Commit:
- Exposes connection pool
- Makes sure it's terminated when destroy is called on the Kysely db instance.
- Adds a couple missing places where destroy wasn't called on the db instance.
Because:
- We want to use twilio API keys
- We don't want to use the twilio Auth Token

This Commit:
- Switches over to using api keys
- Adds method for signing webhook urls, so we can validate webhook calls originated from us.
- Adds ability to configure webhook url, keys for signing, and api keys.
- Still supports authToken so it's backwards compatible
- Creates custom mechanism for validating webhook calls, since the authToken is used by twilio to validate the signed payload.
- Removes the twilio-signature auth strategy and moves validation inline due to hapi limitations accessing the payload in the authorization.
- Adds lots of comments and some doc about how to manually test this with ngrok.
- Updates functional tests so they work with api keys
- Updates functional tests so they can work for smoke tests as well as ci pipeline tests.
- Updates functional tests so that twilio client can be configured independently of auth servers twilio client.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant