VerifyIt

gem 'verify_it'

VerifyIt.configure do |config|
  config.secret_key_base = Rails.application.secret_key_base

  config.storage    = :redis
  config.redis_client = Redis.new(url: ENV["REDIS_URL"])

  config.sms_sender = ->(to:, code:, context:) {
    Twilio::REST::Client.new.messages.create(
      from: ENV["TWILIO_NUMBER"],
      to:   to,
      body: "Your verification code is: #{code}"
    )
  }

  config.email_sender = ->(to:, code:, context:) {
    EmailClient.new(to:).send("Your verification code is: #{code}")
  }

  config.test_mode       = Rails.env.test?
  config.bypass_delivery = Rails.env.test?
end

class User < ApplicationRecord
  include VerifyIt::Verifiable

  verifies :phone_number           # defaults to channel: :sms
  verifies :email, channel: :email
end

class VerificationsController < ApplicationController
  def create
    result = current_user.send_sms_code(request: request)

    if result.success?
      render json: { expires_at: result.expires_at }
    elsif result.rate_limited?
      render json: { error: "Too many requests" }, status: :too_many_requests
    else
      render json: { error: result.message }, status: :unprocessable_entity
    end
  end
end

class VerificationsController < ApplicationController
  def update
    result = current_user.verify_sms_code(params[:code], request: request)

    if result.verified?
      session[:phone_verified] = true
      render json: { verified: true }
    elsif result.locked?
      render json: { error: "Too many failed attempts. Try again later." }, status: :forbidden
    else
      remaining = VerifyIt.configuration.max_verification_attempts - result.attempts
      render json: { error: "Invalid code. #{remaining} attempts remaining." }
    end
  end
end

current_user.send_sms_code(request: request, context: {
  message_template: :code_verification_v1,
  locale: :es
})

current_user.send_email_code(context: {
  ip:         request.ip,
  user_agent: request.user_agent
})

# config/routes.rb
mount VerifyIt::Engine, at: "/verify"

# config/initializers/verify_it.rb
VerifyIt.configure do |config|
  config.secret_key_base = Rails.application.secret_key_base
  # ... your storage config (see Configuration Reference) ...

  # Resolve the authenticated record from the request (e.g. from a session or JWT).
  config.current_record_resolver = ->(request) {
    User.find_by(id: request.session[:user_id])
  }

  # Derive the delivery identifier from the record and the requested channel.
  config.identifier_resolver = ->(record, channel) {
    channel == :sms ? record.phone_number : record.email
  }

  config.sms_sender = ->(to:, code:, context:) {
    Twilio::REST::Client.new.messages.create(
      from: ENV["TWILIO_NUMBER"],
      to:   to,
      body: I18n.t("verify_it.sms.default_message", code: code)
    )
  }
end

require "verify_it"

VerifyIt.configure do |config|
  config.secret_key_base = ENV.fetch("VERIFY_IT_SECRET")
  config.storage         = :memory  # :memory, :redis, or :database

  config.sms_sender = ->(to:, code:, context:) {
    MySmsSender.deliver(to: to, body: "Your code: #{code}")
  }
end

# Send a code
result = VerifyIt.send_code(to: "+15551234567", channel: :sms, record: user)

# Verify a code
result = VerifyIt.verify_code(to: "+15551234567", code: "123456", record: user)

# Clean up
VerifyIt.cleanup(to: "+15551234567", record: user)

config.on_send = ->(record:, identifier:, channel:) {
  Analytics.track("verification_sent", user_id: record.id, channel: channel)
}

config.on_verify_success = ->(record:, identifier:, request: nil) {
  Analytics.track("verification_success", user_id: record.id)
}

config.on_verify_failure = ->(record:, identifier:, attempts:) {
  Analytics.track("verification_failure", user_id: record.id, attempts: attempts)
}

config.namespace = ->(record) { "org:#{record.organization_id}" }

# spec/support/verify_it.rb
RSpec.configure do |config|
  config.before(:each) do
    VerifyIt.configure do |c|
      c.storage         = :memory
      c.test_mode       = true
      c.bypass_delivery = true
      c.secret_key_base = "test_secret"
    end
  end
end

it "verifies phone number" do
  post "/verify/request", params: { channel: "sms" }, headers: auth_headers
  code = JSON.parse(response.body)["code"]  # available in test_mode

  post "/verify/confirm", params: { channel: "sms", code: code }, headers: auth_headers
  expect(response).to have_http_status(:ok)
end

VerifyIt.configure do |config|
  config.max_ip_send_attempts = 10          # max 10 sends per IP per window
  config.max_ip_verification_attempts = 20  # max 20 verifications per IP per window
end