New Token scheme for interacting with sms.callpipe.com

[uncheckederror]

https://github.com/AccelerateNetworks/fusionpbx-webtexting/blob/82170b891e25100c65110e53ef480d1c77cf01fd/providers/accelerate-networks.php#L63C1-L64C1

The above line seems to grab the auth token for POSTing requests to the Messaging API at sms.callpipe.com from the SESSION. I am not sure where the value comes from, but I know that it is no longer going to work. We need to find all the places that consume this token for interacting with sms.callpipe.com and update them.

To get a token from the new version of sms.callpipe.com you'll need to submit a username and password for a valid account in the ops.acceleratenetworks.com app to the /login endpoint. You'll need to POST a JSON body like this:

{
  "email": "string",
  "password": "string"
}

In response you'll receive something like this:

{
  "tokenType": "Bearer",
  "accessToken": "CfDJ8EM4yFX--dROl8EGtE7CURgx6YKQ_TFRsaOvspAbf40UXtRgXJjaXW4EL3Gv1Ry7w1TSA1iCmMdUrGUJ_ONuQklfv6eOyFBW290uKb4kbdee0qL0qhexQRpL9Ah6S0Zk3RhVVazXbIzKXYTZqdvL7Fv6W7aoh0Y4ftMgjU6os6NzzqN0D2PIdbSpCGWFwaGBLe1MbURFzirtHyYtnoNTk9eyhRqaOSEbIGqFtgwKTADRAqaDctkfRTXSI6gztGynTjJUspNwN-X2nKHNR2My-DbY_VsFnsdfkz8eeaCUkGAF9NcbEBx1fRmV3fm2JOSIwzncJuqmdcaDx0oXUJDh9Cwjb8iTSVl9aobIGqFDR_LuoDJHp7t2GdnKKFW_EBT1ewkYqviD2gLDQJEWWHbDuhk9zJ2I_CCb81DLsd5L7VFKr90WUpMAy6OnReozdYkqjiT3Zb7UlniTcrYTFqP8urg0sYmYBSGK11iKh5NjOSNOHOICyFp5GDQbDFWpRR5ErPhAI1agOkGmCEtR9db4wn0R2ciXiV7fv4LGFPM1JzH2t8_-EJYWcsAzQzxCrsgvKn1bHTo7crCTGChCiiC6zBlcrtvqKkW3n6j4Q_STjyIg9IBeHoZOqt3AnTtl02vUz-PVFvmdHlzDgwDYv9fWZw4qmAsRRDXRBcsOYmt1xppSSujStAv340Q6ZOMB-Uef9F5NB9cC4nIcjQWLTsy2Qje8R1mHA7xV6Du_0xqtOXs_Jp-3L3iMtsF_c2HM0Ph2iZci9kgN36fIJXURIXPeE-_SJwM4xtxQhw0VZL5LQT4JDIciEpVa5Dve3Jp5FjbqOJCRtHWBi1ml9BL-mANRKiNJ8JbuLN6k9DAckYsjVummCMIKcosXWqSwLqwhcuYj-HF6RBeI-UzhFmHe2jr3AID9jkZR_BVKKkhOkqh2719K",
  "expiresIn": 3600,
  "refreshToken": "CfDJ8EM4yFX--dROl8EGtE7CURjxb53FHGWhLFD__XvzPLw_e5aPLXvOhU8qNG9CVr82LcnAmmN7_ZDW4SsRwL90PhohxduYBDrvOLUYsKIQd1Sr-uvJ06z6FVE8R5N1QKIQbIDtWrNzgGOK0C9LaJ_i6XKN5h5f2FLOSi08BU3EbsW1tTyox-o4aa-J1aGLOQxoGb9F4fKr3JmHUnPg88Fye2fNM_KADwBO_Q2gOqQsobaeCs993O28Ijs6w-khbb4j7Ka8cS2wzEETdFz16gYNVOEbD5lqsVDIp8KneWYGWOsVl8dkxbUS2EaL64GRPM3y78Dt_iL958mwvGCnp4sYQrdl-TjM1_8onGAGwnZCoHSbgYIRBpwNbxoH7jvBy4c3w2VZA-amRvCOKQWR2OrRTNC87WxkkAsD5uxRgsekMXqYe1lWeLgADksHvAZA17Zg-xBOxv3Tjvv30TLQ3C1pWQ_v75gpIY313orsIYmQnH75eyNhJ6IsusX9YMQZTWp1x07g0XbQNix1rY8f7LpKMOa-Y4G-yWjiedpmOhBCkWCHB8HRlzBVapejjAddKaqC2jrPkUaMUZWBkSBD-id0_zkjy7rE0uJpET4u50rCLwUfRTRZSRdS4nx7z896f7_kQqYzhuJtpV7Qt9vYf3J7km-dwAgUC6LooUJAIpHqq1VoZUBvH25oOL6rhJbi0mpOYE8xqB8Krqd8YsSd6WJoVDQNjG1wlTX_Ot0EfVvWpTNS7ISQxEV-t9vJHdQe-ihDTvhKMLTHipoHTgkbcrEpTLjI1jTUnaeNDau8G3SCiWyj7taqokS51jf5ydZm-be1QqfveUGWtusXqSKShLw6XN2Mr_kTJR0XNi4r0Cor_IVOdV0XDks2X1N5pxnATG_9D8JsZsos23EvAkAoJjLoz-bCaTpkkljP-Rb3HGPSxJMh"
}

Where currently we add an Authorization header to the outbound message request and give it the value

"Bearer ".$_SESSION['webtexting']['acceleratenetworks_api_key']['text']

We'll need to update this to replace "$_SESSION['webtexting']['acceleratenetworks_api_key']['text']" with the value of the "accessToken" field from /login response JSON. But this "accessToken" will only be valid from the point in time when the /login endpoint responds to you, until the "expiresIn" time span elapses. In this case 3600 seconds or 1 hour. At any time prior to that expiration the "accessToken" will be valid.

To get a new accessToken without repeating the login you can use the refresh token on the /refresh endpoint.

{
  "refreshToken": "string"
}

And get back another:

{
  "tokenType": "Bearer",
  "accessToken": "...",
  "expiresIn": 3600,
  "refreshToken": "..."
}

Alternatively you can just repeat the login process, but you don't want to repeat the login process every time you need to make an request to sms.callpipe.com as that would be wasteful. You need some method to manage getting and refreshing a valid token that lives outside of the HTTP call, perhaps you could store everything in the session and then login or refresh if the session values are invalid just before making the outbound HTTP call.

IIRC, the old tokens never expired so the same token was used all the time to auth requests to sms.callpipe.com, but that will not work anymore and it was sad from a security PoV that we were doing that before.

I have not deployed the updated token scheme to sms.callpipe.com as it will break the current version of webtexting. If you want to try it out while building this feature you can run the Messaging project locally. https://github.com/AccelerateNetworks/NumberSearch/tree/master/Messaging

@danry25 I think we'll need to deploy the new sms.callpipe.com first, which will break webtexting, and then an updated version of webtexting that can handle this new token scheme shortly there after to minimize downtime. We should probably do this after hours.

[dunkeltron]

@uncheckederror I think we've migrated fully to the new token scheme can we mark this closed? Or would you rather we wait for information on how to persist the tokens?

[uncheckederror]

@uncheckederror I think we've migrated fully to the new token scheme can we mark this closed? Or would you rather we wait for information on how to persist the tokens?

I am going to close this and then open a new issue for figuring out how to persist information between page loads in FusionPBX. Thanks for your work on this!