Send pin email to Flowdock.
Refactor otp_code to abstract Twilio and AuthToken concerns out of User. Do not store otp_code in the DB.
Refactored authentication code. Secret key is not sent to client. Warden authentication requires mobile and pin to be present. Created token model to handle token generation / validation and data extraction.
Change Gemfile to github syntax
Provide an .env sample file so it's easy to see which keys are required.
Moved warden controller helper from application to authentication controller. Added current_user specs
Provide a mock token validity
Ensure APIPIE examples are available for authentication controller.
Added otp_auth_key to be used to authenticate with pin.
Move warden pin strategy to it's own module so we can test it.
Removing find_all_by_otp_secret_key scope as it's no longer used.
Removed warden session setup as we're not using sessions
Remove check_for_mobile_uniqueness as this reveals whether or not a mobile number exists in our system. A hacker could use the API to start enumerating HK mobile numbers with accounts in our system. There are 30 million possible HK mobile numbers.
If user signs up with existing mobile number, halt registration and send pin to existing user.
Added validations for Hong Kong mobile numbers. Must start with +852 followed by 8 digits with start with a 5, 6, or 9.
Update documentation with Hong Kong mobile number restraints.
When successful verification, send back user object in payload.