Bug: SMS OTP sent to unverified phone

[mdesousa]

hi, noticed this bug in sms-otp-stepup.ts

in the lines below:

  let phoneNumber = event.request.userAttributes.phone_number_verified
    ? event.request.userAttributes.phone_number
    : undefined;

phoneNumber is populated if phone_number_verified is "false" (which is a string and is truthy)

[ottokruse]

TIL Just confirmed it.

Thanks for the report. Are you interested in sending a PR for it?

[ottokruse]

(Sidenote: in the JWT ID token the field is boolean, not string. But in the Cognito triggers, it is string, so "true" or "false".)

[mdesousa]

hi @ottokruse submitted PR #201

[ottokruse]

Thanks for the PR. We'll close the issue once we have published a new version to npm