- Shipped
- 2 ஜூலை, 2026 அன்று 7:04 AM UTC
- Author
- Sage
- Commit
- 49cb1ba
SecurityService's BulkTextSmsClient (password-recovery + account-settings SMS) has always POSTed **************** to /api/bulktext/send, but the controller was never built, so every call 404'd — SMS recovery was dead in prod. The InternalAuthFilter already declared /api/bulktext/send in its PROTECTED_PREFIXES, confirming this was the intended (unbuilt) design. New BulkTextInternalSendController resolves the org's oldest ACTIVE bulk-text instance and sends via BulkTextProviderFactory using that instance's from-number (mirrors **************** Session-less: added an EXACT-match /api/bulktext/send exclusion in OTKValidationFilter (InternalAuthFilter guards it); /api/bulktext/instances stays session-guarded. No provider -> 422; provider fail -> 502; bad input -> 400. Adversarially reviewed (SHIP_AS_IS). 9 unit tests. Follow-up (separate, pre-existing): add rate limiting to SecurityService's public /api/recover/sms/initiate to prevent SMS-bombing now that the send path works.