Repository navigation
feat(sms): public /sms opt-in page with the same consent checkbox as checkout - #243
Merged
Merged
Conversation
…checkout Twilio's toll-free verification needs a public page where a reviewer can see the SMS opt-in. FieldView's opt-in only appears inside flows (score alerts, subscribe, checkout) on game pages, and no public game page is live, so the number could not be verified. - web /sms explains the program (what is sent, frequency, rates, STOP/HELP, support email, no sharing of numbers or opt-in data) and has a working opt-in form: mobile number plus the product's unchecked SmsOptInCheckbox. - api POST /api/public/sms/opt-in records consent through SmsComplianceService.recordViewerConsent (E.164, source web:/sms, IP, user agent). It refuses without the box checked and never sends a text. A hidden honeypot field drops bots. - The public legal footer links "Text messages" to /sms. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Twilio's toll-free verification for FieldView's number (+1 877 343-5308) needs a public page where the reviewer can see the SMS opt-in. FieldView's opt-in only appears inside flows on game pages (score alerts, subscribe, checkout), and no public game page is live, so the number couldn't be submitted.
Change
/sms. Explains the program: messages start with "FieldView.Live:", frequency varies, rates may apply, STOP/HELP, support email, and mobile numbers and opt-in data aren't shared or sold. It has a working opt-in form: a mobile number plus the product's own uncheckedSmsOptInCheckbox.POST /api/public/sms/opt-in. Records consent throughSmsComplianceService.recordViewerConsent(E.164 number, sourceweb:/sms, IP, user agent). It refuses unless the box is checked and never sends a text. A hidden honeypot field drops bots./sms.Tests
apps/api/src/routes/__tests__/public.sms-opt-in.test.ts: records E.164 consent with source, IP and user agent; refuses without the box (a phone alone isn't consent); refuses a bad or missing phone; drops the honeypot.apps/web/components/__tests__/SmsOptInPageForm.test.tsx: the box starts unchecked with the full disclosure; nothing is sent until it's checked; a checked submission posts and confirms.Locally:
type-checkpasses.test:unitpasses: API 609, web 903.pnpm lintexits 1, but it does on unmodifieddeveloptoo (about 1,238 existing errors). This PR adds none:server.tshas the same 33 before and after, and the new files are clean.🤖 Generated with Claude Code