Promote develop to release (uat): seek hold overlay (#252), refund fixes (#253), credential cleanup (#251)

AGENTS.md

@@ -16,6 +16,16 @@ the API boots on `PORT` and answers `GET /health`, and the Next.js web app
 builds. Production runs on Railway (services `api` and `web`); deploys are
 **human-only**.
 
+## Noctusoft platforms
+
+This product does not sign up for OpenAI, Twilio, or SendGrid. It calls two Noctusoft platforms. The product id is the only difference.
+
+- **LLM Relay** — OpenAI-compatible API at `https://ai.noctusoft.com/v1` on litellm-vm (Azure `20.46.250.159`, Tailscale `100.112.233.46`). Virtual key. No provider SDK. Not noctusoft-relay on `ns`.
+- **Mail** — `POST /email/send` or SendGrid drop-in `POST /v3/mail/send` on `api.sendgrid.noctusoft.com`, with the product key and `X-App-Env` (`dev` captures in smtp4dev, `uat` tags and sends, anything else is real delivery).
+- **Text** — `POST /sms/send` or Twilio drop-in on `api.twilio.noctusoft.com`.
+- **One store** — the product's billing alias on noctusoft-relay. Square item codes are `NOCTU-{PRODUCT}-…`. The Square category is `Noctusoft — {brand}`.
+- **Marketplace** — Connect Hub, the FieldView shape: `POST /connect/{productKey}/recipients/{seller}/charge`. The seller is the merchant. The fee lives on that product's `connect_apps` row.
+
 ## Layout
 
 pnpm workspace (`pnpm-workspace.yaml`: `packages/*`, `apps/*`).

apps/api/.env.example

@@ -1,5 +1,11 @@
 # Noctusoft store marketplace (see noctusoft-relay docs/api/store/README.md)
 NOCTUSOFT_API_KEY=nsins_dk_your_deploy_key_here
+
+# SMS relay inbound webhook HMAC (relay signs POST bodies to /api/webhooks/twilio*)
+RELAY_INBOUND_SECRET=whsec_your_relay_inbound_secret_here
+
+# Optional override (default https://api.twilio.noctusoft.com)
+# NOCTUSOFT_SMS_RELAY_BASE_URL=https://api.twilio.noctusoft.com
 NOCTUSOFT_STORE_BASE_URL=https://api.store.noctusoft.com
 NOCTUSOFT_PRODUCT_KEY=fieldview
 

apps/api/__tests__/integration/health.test.ts

@@ -14,5 +14,12 @@ describe('Health Endpoint', () => {
     expect(response.body.checks).toBeDefined();
     expect(response.body.checks.database).toBeDefined();
     expect(response.body.checks.redis).toBeDefined();
+
+    expect(typeof response.body.ok).toBe('boolean');
+    expect(response.body.service).toBe('fieldview-api');
+    expect(typeof response.body.commit).toBe('string');
+    expect(typeof response.body.env).toBe('string');
+    expect(typeof response.body.utc).toBe('string');
+    expect(response.body.ok).toBe(response.body.status === 'healthy');
   });
 });

apps/api/__tests__/integration/public.checkout.test.ts

@@ -91,14 +91,14 @@ describe('Public Checkout Routes', () => {
         .post('/api/public/games/game-1/checkout')
         .send({
           viewerEmail: 'test@example.com',
-          viewerPhone: '+1234567890',
+          viewerPhone: '+12025550100',
         })
         .expect(200);
 
       expect(mockPaymentService.createCheckout).toHaveBeenCalledWith(
         'game-1',
         'test@example.com',
-        '+1234567890',
+        '+12025550100',
         undefined,
         undefined,
         expect.any(CouponService)

apps/api/__tests__/integration/public.subscriptions.test.ts

@@ -15,6 +15,7 @@ vi.mock('@/lib/prisma', () => ({
   prisma: {
     viewerIdentity: {
       findUnique: vi.fn(),
+      findFirst: vi.fn().mockResolvedValue(null),
       create: vi.fn(),
       update: vi.fn(),
     },
@@ -25,6 +26,12 @@ vi.mock('@/lib/prisma', () => ({
       updateMany: vi.fn(),
       findUnique: vi.fn(),
     },
+    smsConsent: {
+      upsert: vi.fn().mockResolvedValue({ id: 'consent-1' }),
+      findUnique: vi.fn(),
+      create: vi.fn(),
+      update: vi.fn(),
+    },
   },
 }));
 
@@ -37,9 +44,17 @@ vi.mock('@/services/NotificationService', () => ({
   })),
 }));
 
-// Mock ViewerIdentityRepository
+// Mock ViewerIdentityRepository (used by SMS consent recording)
 vi.mock('@/repositories/implementations/ViewerIdentityRepository', () => ({
-  ViewerIdentityRepository: vi.fn(),
+  ViewerIdentityRepository: vi.fn().mockImplementation(() => ({
+    getByPhone: vi.fn().mockResolvedValue(null),
+    getById: vi.fn(),
+    getByEmail: vi.fn(),
+    getByEmailVerified: vi.fn(),
+    create: vi.fn(),
+    update: vi.fn(),
+    markEmailVerified: vi.fn(),
+  })),
 }));
 
 describe('Public Subscriptions Routes', () => {
@@ -83,7 +98,8 @@ describe('Public Subscriptions Routes', () => {
         .post('/api/public/subscriptions')
         .send({
           email: 'viewer@example.com',
-          phoneE164: '+1234567890',
+          phoneE164: '+12025550100',
+          smsOptIn: true,
           organizationId: '00000000-0000-0000-0000-000000000001', // Valid UUID format
           preference: 'both',
         })
@@ -119,7 +135,8 @@ describe('Public Subscriptions Routes', () => {
         .post('/api/public/subscriptions')
         .send({
           email: 'viewer@example.com',
-          phoneE164: '1234567890', // Missing +
+          phoneE164: 'not-a-phone',
+          smsOptIn: true,
           organizationId: 'org-1',
           preference: 'sms',
         })

apps/api/__tests__/integration/webhooks.twilio.middleware-order.test.ts

@@ -0,0 +1,64 @@
+import crypto from 'crypto';
+
+import request from 'supertest';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import { SMS_INBOUND_WEBHOOK_URL } from '@fieldview/data-model';
+
+import app from '@/server';
+import * as twilioWebhookRoute from '@/routes/webhooks.twilio';
+import { SmsService } from '@/services/SmsService';
+
+function signBody(secret: string, url: string, body: string): string {
+  return crypto.createHmac('sha256', secret).update(url + body).digest('base64');
+}
+
+vi.mock('@/lib/prisma', () => ({
+  prisma: {
+    sMSMessage: { create: vi.fn(), updateMany: vi.fn() },
+    smsConsent: { findUnique: vi.fn(), upsert: vi.fn(), create: vi.fn(), update: vi.fn() },
+    viewerIdentity: {
+      findFirst: vi.fn().mockResolvedValue(null),
+      create: vi.fn(),
+      update: vi.fn(),
+    },
+    game: { findFirst: vi.fn().mockResolvedValue(null) },
+  },
+}));
+
+describe('Twilio webhook middleware order (full app)', () => {
+  const secret = 'relay-test-secret';
+
+  beforeEach(() => {
+    vi.stubEnv('RELAY_INBOUND_SECRET', secret);
+    twilioWebhookRoute.setSmsService({
+      handleStop: vi.fn(),
+      handleStart: vi.fn(),
+      handleHelp: vi.fn(),
+      handleYes: vi.fn(),
+      findByKeyword: vi.fn(),
+      sendPaymentLink: vi.fn(),
+      logSmsMessage: vi.fn(),
+      recordKeywordConsent: vi.fn(),
+      getHelpTwimlBody: vi.fn(),
+    } as unknown as SmsService);
+  });
+
+  afterEach(() => {
+    vi.unstubAllEnvs();
+  });
+
+  it('rejects re-encoded inbound body before route handler runs', async () => {
+    const signedBody = 'From=%2B15551234567&Body=STOP';
+    const sig = signBody(secret, SMS_INBOUND_WEBHOOK_URL, signedBody);
+    const reencodedBody = 'From=+15551234567&Body=STOP';
+
+    const res = await request(app)
+      .post('/api/webhooks/twilio')
+      .set('Content-Type', 'application/x-www-form-urlencoded')
+      .set('x-relay-signature', sig)
+      .send(reencodedBody);
+
+    expect(res.status).toBe(401);
+  });
+});