fix(auth): reject unsupported OTP destinations before paying Twilio

[bobodread876]

What happened

On 2026-08-25 our Twilio Verify service was hit with an SMS-pumping attack: 1,569 messages / $439.79 in one day, against a baseline of 1–10 OTPs per day (~$1/day; the entire previous month was $18.70). Traffic was concentrated in countries where Flash has no users — Uzbekistan, Turkey, Russia, Belarus, Armenia, Bosnia, Zambia, Ecuador and others — in sequential number blocks, converting at roughly 1%.

Why our existing defenses didn't stop it

Both were working as designed:

• Captcha is enforced. Every entry point routes through requestPhoneCodeWithCaptcha, which validates Geetest before anything else, and Geetest does not fail open.
• Rate limits are enforced. 16/hour per IP, 8/20min per phone number.

The attacker rotated IPs and solved captcha (cheap at scale), staying under every limit. 16/hour × ~100 IPs ≈ 1,600 — almost exactly the observed burst.

The real gap is ordering. The destination country is only checked by PhoneMetadataAuthorizer, which runs at login completion (src/app/authentication/login.ts) and in rewards — after the message has been sent and billed. Every fraudulent OTP went to a country we don't serve and we paid for it anyway.

Separately, smsAuthUnsupportedCountries / whatsAppAuthUnsupportedCountries already existed but were only used to filter the client's country picker (getSupportedCountries). The API never checked them, so the app hid unsupported countries while the endpoint still sent to them.

Changes

• Enforce the existing per-channel supported-country config server-side in requestPhoneCodeWithCaptcha and requestPhoneCodeForAuthedUser, immediately before the provider call. New pure helper isAuthChannelSupportedForCountry in @domain/authentication.
• Reject unparseable numbers as InvalidPhoneNumber (not as a blocked country) instead of forwarding them to Twilio.
• Two new config keys, smsAuthBlockedCountries / whatsAppAuthBlockedCountries, seeded with 25 attack-origin countries. Every one sent auth-code traffic with zero conversions across the full Twilio retention window. Countries with even one real signup (JM, US, NG, IN, GB, CA, DE, GH, KY, BJ, RW, SD, CD, MV, BD, BE, UG, TT, ML, CO, SK) are excluded by design — this is a fraud control, not a market policy. Plausible future markets with no conversions (FR, ZA, KE, PH, MY, EG, SA) were deliberately left unblocked.
• The block list is deliberately NOT the picker list. smsAuthUnsupportedCountries / whatsAppAuthUnsupportedCountries keep their empty defaults and keep governing globals.supportedCountries only. A country hidden from the picker cannot be selected in the app at all, so its numbers never reach the endpoint and the existing-user carve-out below would be unreachable for exactly the users it exists to protect. Enforcement and presentation are separate keys on purpose.
• Existing accounts are never locked out. requestPhoneCodeWithCaptcha serves login as well as signup, so a blocked country falls through to a Kratos identity lookup (IdentityRepository().getUserIdFromIdentifier, the same store login.ts resolves against): a phone that already belongs to an account still gets its login code. The lookup costs no Twilio spend, fails closed on any error, and is bounded by its own tiny per-IP probe budget (2/h, refunded on a confirmed account) so the free existence answer cannot be swept. The country stays selectable in the picker, so the carve-out is actually reachable from the app. requestPhoneCodeForAuthedUser has no such carve-out — binding a phone to an authed account is always a new registration of that number.
• Blocks are observable. Every rejection emits baseLogger.warn plus a verification / destination-blocked ops event (phone masked), so blocked-country counts land in the existing Discord ops feed and the list can be tuned from data instead of guesswork.
• Case-insensitive matching. The lists are raw configmap strings that src/config/yaml.ts casts to CountryCode[] without validating, so - uz would previously have disabled both the gate and the picker filter silently.
• The channel is normalized inside the gate. POST /auth/phone/code forwards req.body.channel verbatim ("SMS" / "WHATSAPP") while the two GraphQL resolvers lowercase it, so that route would have been gated against the wrong list the moment the two lists diverge.
• PhoneCountryNotAllowedError now has its own case in src/graphql/error-map.ts → "Phone number is not from a valid region" (ValidationInternalError), mirroring RestrictedRegionPhoneProviderError. It previously fell into the catch-all and surfaced a deliberate policy rejection as "Unexpected error occurred, please try again or contact support".
• InvalidPhoneNumber was in that same catch-all → "Phone number is not a valid phone number", alongside its provider-side twin. The catch-all message interpolates error.message, which for this error is the submitted number, so a malformed number was echoed back to the client inside an "unexpected error" string. Also fixes the pre-existing checkedToPhoneNumber path.
• Lower the requestCodePerIp schema default to 8/hour. A real user needs one or two.
• A number libphonenumber parses but cannot attribute to a region (340 of the 800 assigned NANP area codes are absent from the pinned 1.12.25 metadata, including in-service US overlays like +1 983 and +1 738) is gated on every region its calling code could denote, not rejected. +1 passes because no NANP region is blocked; +7 still fails closed because RU is. Only a number that does not parse at all is refused, under its own destination-unparsable telemetry phase.

Deploy notes

Companion PR: lnflash/deployments#192 — required. tf-modules/flash/flash-values.tmpl.yaml hard-sets the whole rateLimits object for dev/test/prod, which suppresses the schema default, so the requestCodePerIp change here is inert in every deployed environment until that PR merges.

The country lists are not set anywhere in lnflash/deployments (verified by grep), so the seeded schema defaults do apply on deploy. Re-verify before rollout if that changes — a configmap value always wins over the default. The enforcement lands either way.

Merge checklist

• Merge lnflash/deployments#192 with (or before) this, or the rate-limit bullet above is untrue in prod.
• Count existing accounts by dialing prefix for the 25 blocked codes against prod (mongo accounts joined to kratos identities) and paste the counts here. "No Twilio conversion inside the retention window" is not the same claim as "no account exists" — a diaspora user who registered before the window is not visible in the Twilio data. The carve-out plus the picker split means a non-zero count is not a lockout, but any country with real accounts should still come off the list, since those users would otherwise be gated on every new phone binding.
• The country lists are two keys now. If a configmap ever sets them, set *AuthBlockedCountries for enforcement — setting *AuthUnsupportedCountries instead hides the country from the picker and takes the carve-out away with it.

Testing

• test/flash/unit/app/authentication/request-code-destination.spec.ts: covers both entry points — provider never called for a blocked country, per-channel lists are independent, channel casing normalized, lowercase config entries still match, unparsable numbers rejected as InvalidPhoneNumber under their own telemetry phase, NANP overlays libphonenumber cannot attribute still delivered while an unattributable +7 still fails closed, paged kinds expiring after a quiet period without re-paging mid-flood, rejection happens even when captcha passes, blocked requests emit the log + ops event, allowed requests emit neither, existing users in a blocked country still get a code, repository failure fails closed, and requestPhoneCodeForAuthedUser has no carve-out and fires no otp-sent event when blocked.
• test/flash/unit/config/schema.spec.ts: asserts the shipped defaults against the real configSchema with no @config mock — both block lists are 25 uppercase ISO codes containing UZ and TR and none of the 21 converting countries, both picker lists are empty, and requestCodePerIp is 8/h.
• test/flash/unit/config/rate-limits.spec.ts: pins getRequestCodeBlockedCountryPerIpLimits() to 5 points / 1h / 1h block — the shared-CGNAT reason the block duration is not the 24h the other auth limiters use.
• test/flash/unit/app/authentication/supported-countries.spec.ts: runs against the real config and asserts UZ/TR/RU are still offered in the picker, i.e. the carve-out is reachable from the app.
• test/flash/unit/domain/authentication/index.spec.ts: allow, per-channel block, both-channel block, empty lists, and lowercase config entries for both isAuthChannelSupportedForCountry and getSupportedCountries.
• test/flash/unit/graphql/error-map.spec.ts: pins PhoneCountryNotAllowedError and InvalidPhoneNumber to validation messages, not the catch-all, and asserts the submitted number is not echoed back.
• Full unit suite: 2281 passed / 208 suites. yarn tsc-check, yarn tsc-check-noimplicitany, yarn eslint-check, yarn build, yarn madge-check, yarn check-yaml and typos all clean.

Follow-ups (not in this PR)

• Twilio-side: geo-permissions allowlist, Verify rate limits, Fraud Guard (raised to Max during the incident).
• Consider a per-country rate limit — market-agnostic, catches the next pumping run without needing to predict which country it comes from.
• Watch the destination-blocked ops feed for a week and prune any country that shows real-looking traffic.

🤖 Generated with Claude Code

https://claude.ai/code/session_018sCFQXDf4s6f1zsrpmaShL

[bobodread876]

Merge-condition evidence

1. Per-country account count against prod — done. Kratos identities on prod, grouped by dialing prefix (no individual numbers left the cluster), cross-referenced against session activity:

Accounts across the 25 blocked countries	51 (18 countries have ≥1)
Active in the last 90 days	2 — TZ ×1, UZ ×1
Remaining 16 countries	zero sessions in 90d; newest identity 2026-03

Top counts: TR 8, CM 7, RU 4, SN 4, IL 4, TZ 4, UA 3.

So the gate's real-world lockout exposure is two accounts, and both are exactly what the existing-user carve-out was built for — now that the picker split (4ed233858) makes that carve-out reachable from the app at all. Recommendation: keep all 25. Dropping countries on 51 dormant identities would give back most of the fraud surface to protect users who aren't there.

Caveat worth recording: +7 matches Kazakhstan as well as Russia, so some of those 4 may be KZ (not blocked). All 4 are inactive, so it doesn't change the decision.

2. requestCodePerIp 16 → 8 — companion PR open: lnflash/deployments#193. Confirmed the finding: tf-modules/flash/flash-values.tmpl.yaml hard-sets the whole rateLimits object for dev/test/prod, so the schema-default change here is inert on its own. Either merge order is safe.