feat(pnba): add optional auth channel for code flows

Author: PromiseFru

docs/grpc.md

@@ -274,6 +274,7 @@ Requests a one-time passcode (OTP) for Phone Number-Based Authentication.
 | platform | string | Yes | Platform identifier |
 | phone_number | string | Yes | Phone number to receive OTP |
 | request_identifier | string | Optional | Request identifier for tracking |
+| channel | string | Optional | The medium used to send the code (e.g., "whatsapp", "telegram", "signal") |
 
 **Response:** `GetPNBACodeResponse`
 
@@ -315,6 +316,7 @@ Exchanges a one-time passcode (OTP) for a token, stores it, and returns encrypte
 | password | string | Optional | Password for two-step verification |
 | request_identifier | string | Optional | Request identifier for tracking |
 | client_ephemeral_public_keys | list[PublicKey] | Yes | Exactly 256 ephemeral public keys generated by the client |
+| channel | string | Optional | The medium used to receive the code (e.g., "whatsapp", "telegram", "signal") |
 
 **Response:** `ExchangePNBACodeAndStoreResponse`
 

grpc_services/v3/exchange_pnba_code.py

@@ -60,6 +60,7 @@ def ExchangePNBACodeAndStore(self, request, context):
             "base_path": adapter.assets_path,
             "password": request.password or None,
             "request_identifier": request.request_identifier or None,
+            "channel": request.channel or None,
         }
 
         if params.get("password"):
@@ -103,7 +104,7 @@ def ExchangePNBACodeAndStore(self, request, context):
                 proto_id=adapter.proto_id,
                 token_data={
                     "account_id": result["userinfo"]["account_identifier"],
-                    "token": result["userinfo"]["account_identifier"],
+                    "token": {"name": result["userinfo"].get("name")},
                 },
                 session=s,
             )

grpc_services/v3/get_pnba_code.py

@@ -37,6 +37,7 @@ def GetPNBACode(self, request, context):
                 "phone_number": request.phone_number,
                 "base_path": adapter.assets_path,
                 "request_identifier": request.request_identifier or None,
+                "channel": request.channel or None,
             },
         )
 

grpc_services/v3/sync_keys.py

@@ -28,6 +28,15 @@ def SyncKeys(self, request, context):
     if auth_error:
         return auth_error
 
+    if not payload_bin:
+        logger.error("missing token ciphertext in request payload")
+        return self.handle_create_grpc_error_response(
+            context,
+            response,
+            "token ciphertext is required in the request payload",
+            grpc.StatusCode.INVALID_ARGUMENT,
+        )
+
     invalid = self.handle_request_field_validation(
         context,
         request,

lib_relaysms_payload_specs

@@ -134,6 +134,8 @@ message GetPNBACodeRequest {
   string phone_number = 2;
   // Optional request identifier for tracking the request
   string request_identifier = 3;
+  // The medium used to deliver the code (e.g., "whatsapp", "telegram", "signal").
+  string channel = 4;
 }
 
 // Response message for getting the PNBA code
@@ -165,6 +167,8 @@ message ExchangePNBACodeAndStoreRequest {
   string request_identifier = 5;
   // Client ephemeral public keys to associate with the stored token
   repeated PublicKey client_ephemeral_public_keys = 6;
+  // The medium used to receive the code (e.g., "whatsapp", "telegram", "signal").
+  string channel = 7;
 }
 
 // Response message for exchanging the PNBA code for a token and storing it

protos/v3/publisher.proto

@@ -1,6 +1,8 @@
 # SPDX-License-Identifier: GPL-3.0-only
 """v1 Services for the REST API."""
 
+import base64
+
 from sqlalchemy import delete
 from sqlalchemy.orm import Session
 
@@ -33,6 +35,9 @@ def _get_adapter_params(
 ) -> dict:
     cat_id = content.get_cat_id()
     extra_params = extras or {}
+    attachment = content.get_attachment()
+    if attachment:
+        extra_params["attachments"] = [{"data": base64.b64encode(attachment).decode()}]
 
     match cat_id:
         case rrs.V1ContentCategories.EMAIL:
@@ -41,6 +46,7 @@ def _get_adapter_params(
                 "to_email": content.get_to().decode(),
                 "subject": content.get_subject().decode(),
                 "message": content.get_body().decode(),
+                "recipient": content.get_to().decode(),
                 **extra_params,
             }
         case rrs.V1ContentCategories.MESSAGE:
@@ -135,7 +141,7 @@ def publish_content(
                 token_data=token.token_data,
                 content=content,
                 extras={
-                    "phone_number": token.token_data["token"],
+                    "phone_number": token.token_data["account_id"],
                     "base_path": adapter.assets_path,
                 },
             )

rest_services/v1/services.py

@@ -82,6 +82,10 @@ Requests a passcode/OTP for Phone Number-Based Authentication (PNBA).
 python -m tests.client get-pnba-code --platform telegram --phone-number +123456789
 ```
 
+```sh
+python -m tests.client get-pnba-code --platform telegram --phone-number +123456789 --auth-channel signal
+```
+
 ### 6. Exchange PNBA Code
 
 Exchanges the PNBA OTP code for a token, decrypts it, and stores the session data.
@@ -90,6 +94,10 @@ Exchanges the PNBA OTP code for a token, decrypts it, and stores the session dat
 python -m tests.client exchange-pnba-code --platform telegram --phone-number +123456789 --code <OTP_CODE>
 ```
 
+```sh
+python -m tests.client exchange-pnba-code --platform telegram --phone-number +123456789 --code <OTP_CODE> --auth-channel signal
+```
+
 If the account has two-step verification enabled, re-run with `--password`:
 
 ```sh

tests/README.md

@@ -371,8 +371,17 @@ def cmd_revoke_oauth2_token(host, port, tls, rest_api, token, **_):
 
 @cli.command("get-pnba-code")
 @shared_options
+@click.option("--auth-channel", help="The medium used to receive the code.")
 def cmd_get_pnba_code(
-    host, port, tls, rest_api, platform, phone_number, request_identifier, **_
+    host,
+    port,
+    tls,
+    rest_api,
+    platform,
+    phone_number,
+    request_identifier,
+    auth_channel,
+    **_,
 ):
     """Request a PNBA code."""
     logger.info("platform=%s | phone_number=%s", platform, phone_number)
@@ -393,7 +402,8 @@ def cmd_get_pnba_code(
             publisher_pb2.GetPNBACodeRequest(
                 platform=platform,
                 phone_number=phone_number,
-                request_identifier=request_identifier or "",
+                request_identifier=request_identifier,
+                channel=auth_channel,
             ),
             metadata=metadata,
         )
@@ -409,6 +419,7 @@ def cmd_get_pnba_code(
 @shared_options
 @click.option("--code", required=True, help="Authorization code.")
 @click.option("--password", help="Two-step verification password.")
+@click.option("--auth-channel", help="The medium used to receive the code.")
 def cmd_exchange_pnba_code(
     host,
     port,
@@ -419,6 +430,7 @@ def cmd_exchange_pnba_code(
     request_identifier,
     code,
     password,
+    auth_channel,
     **_,
 ):
     """Exchange a PNBA code, decrypt the token, and store session data."""
@@ -451,6 +463,7 @@ def cmd_exchange_pnba_code(
                     )
                     for i, kp in enumerate(client_keypairs)
                 ],
+                channel=auth_channel,
             ),
             metadata=metadata,
         )
@@ -929,7 +942,7 @@ def cmd_send(
         sys.exit(1)
 
     len_att = len(attachment_bytes) if attachment_bytes else 0
-    sess_id = secrets.randbelow(256) if has_attachment else None
+    sess_id = secrets.randbelow(128) if has_attachment else None
 
     try:
         payload = rrs.V1Payloads(
@@ -941,10 +954,7 @@ def cmd_send(
         )
         if has_attachment:
             segments = payload.split(rrs.Transports.SMS)
-            segments_b64 = [
-                seg.decode() if isinstance(seg, (bytes, bytearray)) else seg
-                for seg in segments
-            ]
+            segments_b64 = [seg.decode() for seg in segments]
         else:
             raw = payload.serialize_without_attachment()
             segments_b64 = [b64(raw, urlsafe=False)]