Feat/passwordless verify service

packages/user/package.json

@@ -30,6 +30,7 @@
   },
   "dependencies": {
     "humps": "2.0.1",
+    "twilio": "6.0.0",
     "validator": "13.15.35"
   },
   "devDependencies": {

packages/user/src/supertokens/recipes/config/passwordless/consumeCode.ts

@@ -0,0 +1,123 @@
+import type { FastifyInstance, FastifyRequest } from "fastify";
+import type { RecipeInterface } from "supertokens-node/recipe/passwordless/types";
+
+import { CustomError } from "@prefabs.tech/fastify-error-handler";
+import { formatDate } from "@prefabs.tech/fastify-slonik";
+import { User, UserCreateInput } from "src/types";
+import { deleteUser, getRequestFromUserContext } from "supertokens-node";
+import UserRoles from "supertokens-node/recipe/userroles";
+
+import { ROLE_USER } from "../../../../constants";
+import getUserService from "../../../../lib/getUserService";
+import areRolesExist from "../../../utils/areRolesExist";
+
+const consumeCode = (
+  originalImplementation: RecipeInterface,
+  fastify: FastifyInstance,
+): RecipeInterface["consumeCode"] => {
+  return async (input) => {
+    const roles = (input.userContext.roles || [
+      fastify.config.user.role || ROLE_USER,
+    ]) as string[];
+
+    if (!(await areRolesExist(roles))) {
+      throw new CustomError(
+        `At least one role from ${roles.join(", ")} does not exist.`,
+        "SIGNUP_FAILED_ERROR",
+      );
+    }
+
+    const originalResponse = await originalImplementation.consumeCode(input);
+
+    if (originalResponse.status !== "OK") {
+      return originalResponse;
+    }
+
+    const request = getRequestFromUserContext(input.userContext)?.original as
+      | FastifyRequest
+      | undefined;
+
+    const userService = getUserService(
+      request?.config || fastify.config,
+      request?.slonik || fastify.slonik,
+      request?.dbSchema,
+    );
+
+    const phoneNumber = originalResponse.user.phoneNumber;
+
+    const emailDomain =
+      fastify.config.user.passwordLessConfig?.fallbackEmailDomain ||
+      fastify.config.appName.toLowerCase().replaceAll(/\s+/g, "") + ".com";
+
+    const email = phoneNumber
+      ? `${phoneNumber}@${emailDomain}`
+      : originalResponse.user.email;
+
+    if (!email || !phoneNumber) {
+      await deleteUser(originalResponse.user.id);
+
+      throw new Error("Passwordless user missing phone number or email");
+    }
+
+    let user: null | undefined | User;
+
+    if (originalResponse.createdNewUser) {
+      try {
+        user = await userService.create({
+          email,
+          id: originalResponse.user.id,
+          phoneNumber,
+        } as UserCreateInput);
+
+        if (!user) {
+          throw new Error("User not found");
+        }
+      } catch (error) {
+        await deleteUser(originalResponse.user.id);
+
+        throw error;
+      }
+
+      user.roles = roles;
+
+      originalResponse.user = {
+        ...originalResponse.user,
+        ...user,
+      };
+
+      for (const role of roles) {
+        const rolesResponse = await UserRoles.addRoleToUser(
+          originalResponse.user.id,
+          role,
+        );
+
+        if (rolesResponse.status !== "OK") {
+          fastify.log.error(rolesResponse.status);
+        }
+      }
+    } else {
+      await userService
+        .update(originalResponse.user.id, {
+          lastLoginAt: formatDate(new Date(Date.now())),
+        })
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        .catch((error: any) => {
+          fastify.log.error(
+            `Unable to update lastLoginAt for userId ${originalResponse.user.id}`,
+          );
+          fastify.log.error(error);
+        });
+    }
+
+    return {
+      ...originalResponse,
+      user: {
+        ...originalResponse.user,
+        email,
+        phoneNumber,
+      },
+    };
+  };
+};
+
+export default consumeCode;

packages/user/src/supertokens/recipes/config/passwordless/consumeCodePost.ts

@@ -0,0 +1,136 @@
+import type { FastifyInstance } from "fastify";
+import type { APIInterface } from "supertokens-node/recipe/passwordless/types";
+
+import Passwordless from "supertokens-node/recipe/passwordless";
+import twilio from "twilio";
+
+import { ROLE_USER } from "../../../../constants";
+
+export const TWILIO_VERIFY_PLACEHOLDER_CODE = "000000";
+
+const enrichResult = (
+  result: Awaited<ReturnType<NonNullable<APIInterface["consumeCodePOST"]>>>,
+  phoneNumber: string,
+  fallbackEmailDomain: string,
+) => {
+  if (result.status !== "OK") {
+    return result;
+  }
+
+  return {
+    ...result,
+    user: {
+      ...result.user,
+      email: result.user.email ?? `${phoneNumber}@${fallbackEmailDomain}`,
+    },
+  };
+};
+
+const consumeCodePOST = (
+  originalImplementation: APIInterface,
+  fastify: FastifyInstance,
+): APIInterface["consumeCodePOST"] => {
+  return async (input) => {
+    input.userContext.roles = input.userContext.roles || [
+      fastify.config.user.role || ROLE_USER,
+    ];
+
+    if (originalImplementation.consumeCodePOST === undefined) {
+      throw new Error("Should never come here");
+    }
+
+    // Only handle user input code flows, not magic link flows
+    if (!("userInputCode" in input) || input.userInputCode === undefined) {
+      return originalImplementation.consumeCodePOST(input);
+    }
+
+    const { config } = fastify;
+
+    if (!config.user.passwordLessConfig) {
+      throw new Error("Passwordless recipe config is missing");
+    }
+
+    const isDevelopment = config.user.passwordLessConfig.enableDevMode;
+
+    // Look up the device to retrieve the associated phone number
+    const deviceContext = await Passwordless.listCodesByPreAuthSessionId({
+      preAuthSessionId: input.preAuthSessionId,
+    });
+
+    if (!deviceContext || !deviceContext.phoneNumber) {
+      return { status: "RESTART_FLOW_ERROR" };
+    }
+
+    const { phoneNumber } = deviceContext;
+    const bypassNumbers = config.user.passwordLessConfig.bypassSmsFor ?? [];
+
+    const fallbackEmailDomain =
+      config.user.passwordLessConfig.fallbackEmailDomain ?? "";
+
+    // In dev mode or for bypassed numbers, skip Twilio Verify and let
+    // SuperTokens verify the code directly (uses devModeOtp)
+    if (isDevelopment || bypassNumbers.includes(phoneNumber)) {
+      return enrichResult(
+        await originalImplementation.consumeCodePOST(input),
+        phoneNumber,
+        fallbackEmailDomain,
+      );
+    }
+
+    const verifyServiceSid =
+      config.user.passwordLessConfig?.twilio?.verifyServiceSid;
+
+    if (!verifyServiceSid) {
+      fastify.log.error("TWILIO_VERIFY_SERVICE_SID is not configured");
+      return { status: "RESTART_FLOW_ERROR" };
+    }
+
+    const twilioConfig = config.user.passwordLessConfig.twilio;
+
+    if (!twilioConfig) {
+      fastify.log.error("Twilio config is missing for passwordless recipe");
+      return { status: "RESTART_FLOW_ERROR" };
+    }
+
+    if (!twilioConfig.accountSid || !twilioConfig.authToken) {
+      fastify.log.error(
+        "TWILIO_ACCOUNT_SID and TWILIO_AUTH_TOKEN are required for passwordless verification",
+      );
+      return { status: "RESTART_FLOW_ERROR" };
+    }
+
+    const twilioClient = twilio(
+      twilioConfig.accountSid,
+      twilioConfig.authToken,
+    );
+
+    try {
+      const check = await twilioClient.verify.v2
+        .services(verifyServiceSid)
+        .verificationChecks.create({
+          code: input.userInputCode,
+          to: phoneNumber,
+        });
+
+      return check.status === "approved"
+        ? enrichResult(
+            await originalImplementation.consumeCodePOST({
+              ...input,
+              userInputCode: TWILIO_VERIFY_PLACEHOLDER_CODE,
+            }),
+            phoneNumber,
+            fallbackEmailDomain,
+          )
+        : {
+            failedCodeInputAttemptCount: 1,
+            maximumCodeInputAttempts: 5,
+            status: "INCORRECT_USER_INPUT_CODE_ERROR",
+          };
+    } catch (error) {
+      fastify.log.error(error, "Twilio Verify verification check failed");
+      return { status: "RESTART_FLOW_ERROR" };
+    }
+  };
+};
+
+export default consumeCodePOST;