feat: Issue #751 - SMS/Email delivery infrastructure

[theothersideofgod]

Summary

Issue #751: Email & SMS Delivery for Magic Links, OTP, MFA

This PR implements the complete delivery infrastructure for passwordless authentication flows.

Supported Types

SMS Delivery (send-sms)

Type	Description
sign_in_sms_otp	Sign-in OTP via SMS
sign_up_sms	Sign-up verification SMS
enable_sms_mfa	MFA setup verification
mfa_challenge_sms	MFA challenge code
phone_verification	Phone number verification
sms_otp_code	DB procedure compatibility
mfa_verification_code	DB procedure compatibility

Email Delivery (send-verification-link)

Type	Description
forgot_password	Password reset link
magic_link_sign_in	Magic link sign-in
magic_link_sign_up	Magic link sign-up
email_otp	Email OTP code
email_mfa_setup	MFA setup via email
mfa_challenge	MFA challenge code
magic_link_email	DB procedure compatibility
email_otp_code	DB procedure compatibility
mfa_verification_code	DB procedure compatibility

Changes

SMS Delivery (Twilio)

File	Description
functions/send-sms/handler.ts	Multi-provider SMS handler (Twilio, AWS SNS, Vonage, stub)
functions/send-sms/handler.json	Function manifest with Twilio dependency
k8s/base/functions/send-sms.yaml	Knative service with twilio-credentials secretRef
k8s/base/kustomization.yaml	Add send-sms to resources + update required secrets

Email Delivery Enhancements

File	Description
functions/send-verification-link/handler.ts	Add magic link, OTP, MFA email types

Runtime Fixes

File	Description
packages/fn-runtime/	Fix databaseId header in meta GraphQL client

Refactoring & Security

Commit	Description
86719b1	Rename email functions to send-verification-link/send-email
5f0ee96	Genericize internal infra identifiers
4914d21	Remove hardcoded secrets from HEAD

K8s Deployment

Before deploying, create the Twilio secret:

kubectl create secret generic twilio-credentials \
  --from-literal=TWILIO_ACCOUNT_SID="ACxxx" \
  --from-literal=TWILIO_AUTH_TOKEN="xxx" \
  --from-literal=TWILIO_FROM_NUMBER="+1xxx" \
  -n <namespace>

Error Handling

• Missing credentials: Job fails with Twilio credentials not configured
• Invalid credentials: Job fails with Twilio API error message
• Unknown type: Returns Unknown sms_type: <type> or Unknown email_type: <type>

Test Plan

• Real Twilio SMS delivery tested and confirmed
• Stub mode works for local development
• Email types compatible with DB procedures
• K8s deployment with secret injection
• Magic link email flow E2E test
• Email OTP flow E2E test

Related PRs

• constructive-hub#364: Local development configuration

🤖 Generated with Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​agentic-kit/​ollama@​1.2.0
	npm/​twilio@​5.13.1
	npm/​@​constructive-io/​graphql-query@​3.25.5

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm markdown-it is 91.0% likely obfuscated Confidence: 0.91 Location: Package overview From: pnpm-lock.yaml → npm/@constructive-io/graphql-query@3.25.5 → npm/markdown-it@14.1.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/markdown-it@14.1.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report