KYC: Access mobile

Sprint: 3

Outcome:

User should enter his number, after the validation app sends a sms with an otp code, the user must enter the code to prove to us that he has access to the entered number.

Endpoints:

POST {$domain}/api/v2/barong/resource/mobiles

POST {$domain}/api/v2/barong/resource/mobiles/send_code

POST {$domain}/api/v2/barong/resource/mobiles/verify

File destination:

{$Dalan_Path}/app/api/v2/resource/phones.rb

Commits:

bd7f980596 695b0b56e2 6dd40a9c42 e04a58b012 36167eda10 2089690fe0 90cbc48649 17a5bce849 63722fe22a 63977c330d bff2746686 75490dcb22 f13ee3f4d5 2c05522f77 46c053b435 551e7cdba2 77d7b9a9b3 2da71b1097

What did we implement:

First of all we added a new service for our sms&call third party service(kavenegar).it needs its own initializer for private keys.in this service we also handle caching data(for storing keys and codes with expiration time) and creating OTP code by vault.

We created a new api for phones with our rules. after verification every number, app create a new label(access_phone) if there were not that label. note:

if user wants to enter new number:

1.if user has pending number --> legacy number will be update with new number

2.If user has verified access label --> new number must get access label to create in db and legacy one replaced

3.If user has verified ownership label --> new number must get both labels to create in db and legacy one replaced

sequenceDiagram
    title: access phone
    User->>Ranj: enter phone number with +98
    Ranj-->>Dalan: post /mobiles params
    Dalan->>Ranj: 400, message: 'Required params are empty'
    Dalan->>Ranj: 401, message: 'Invalid bearer token'
    Dalan->>Ranj: 404, message: 'Record is not found'
    Dalan->>Ranj: 422, message: 'Validation errors'
    Dalan->>Ranj: 422, message: 'code_doesnt_expired'(there is an active process for addding new mobile)
    Dalan->>Ranj: 200, message: 'New phone was added'
    note left of Dalan: if there is a pending number it will be replaced with new one
    Dalan->>KaveNegar: send sms to User in case of success
    KaveNegar->>User: SMS with code
    Ranj->>User: show result
    note right of User: if didnt catch sms 
    
    User->>Ranj: resend code
    Ranj->>Dalan: Post mobiles/send_code params
        Dalan->>Ranj: 400, message: 'Required params are empty'
    Dalan->>Ranj: 401, message: 'Invalid bearer token'
    Dalan->>Ranj: 404, message: 'Record is not found', 'phone.doesnt_exist'
    Dalan->>Ranj: 422, message: 'Validation errors'
    Dalan->>Ranj: 422, message: 'code_doesnt_expired' (expiration time doesnt finish)
    Dalan->>KaveNegar: send sms to User in case of success
    KaveNegar->>User: SMS with code
    Ranj->>User: show result
    User->>Ranj:enter code
    Ranj->>Dalan: Post mobiles/verify params
    Dalan->>Ranj: 401, message: 'Invalid bearer token'
    Dalan->>Ranj: 404, message: 'Record is not found', 'phone.doesnt_exist'
    Dalan->>Ranj: 422, message: 'Validation errors'
    Dalan->>Ranj: 400, message: phone.verification_invalid
    note right of Ranj: if user wants to replace a new verified phone and the legacy phone has owner_phone label, we should check ownership. if it doesnt legacy phone labels all changes will be rollback.
    Dalan->>Ranj: success 2xx
    Ranj->>User: show result

3.3 KiB Raw Permalink Blame History