Open tprudentova opened 1 year ago
Security limitations:
There are 2 ways I can invite users that don’t yet have TWP:
Clicking the Invite button opens an invitation pop-up. It includes the following:
A box for entering the phone number
If I enter phone number in wrong format and click Send, the invitation isn’t sent, the field is highlighted in red and a warning “Please, enter phone number in correct format” appears
If I leave the field empty and click Send, the invitation isn’t sent, the field is highlighted in red and a warning “This field cannot be blank” appears
Clicking it redirects me to the Unregistered users section of the Contacts tab. From hereon I follow the Invite from contacts tab path (that is described below). If I haven’t yet given access to my contacts, I’m asked to give access.
Cancel
Clicking it closes the Invitation pop-up
Send
If I click Send after entering the correct phone number, an SMS message is sent to the entered number with text “Hello there! It’s Name Surname, I’m using Twake Chat. Join me! link”. The message is sent in English by default, in French if the phone number starts with +33, in Vietnamese if it starts with +84, in Russian if it starts with +7. English for all other country codes.
When the invitation is sent, I see a toast message.
If I click on the Invite button next to a contact in the contacts list, the Invitation pop-up opens. The box for entering phone number is pre-filled with the phone number of a selected contact.
If the contact has more than 1 phone number in my device’s phone book, I see a pop-up for selecting one first. I select by clicking on the correct number. Then the Invitation pop-up opens, it is also pre-filled.
For the rest of the flow see Invitation pop-up section above.
Invitee receives an SMS message to their phone number that contains the following text:
The invitation SMS contain the following text: “Hello there! I’m using Twake Chat. Join me! *link***” Link from the message leads to landing page where I can find a link that redirects me to app store/google play, depending on my OS.
When the invitee follows the link, download the app, completes sign-up and appears inside Twake Chat, they see a pending invitation from me.
https://domain.tld/#/room/%21MalvWMbAGJhMgeBBnJ%3Amatrix.org?email=alice_matrix%40yopmail.com&signurl=https%3A%2F%2Fvector.im%2F_matrix%2Fidentity%2Fapi%2Fv1%2Fsign-ed25519%3Ftoken%3DwYTrwVSMjuLJveSCHsbREHibQglAiTqtPuzQItUgDXRQRQJGmOPvecvXRhKcwjAjrHYmbEGKdzorZrMFHwMvJvahXukUpzolrZZjSlHtxSiRpRLolUMbbVqbegBlbwJk%26private_key%3DLD5TGcNqyNEmQr3J0zCdI_kvMERxxgrVesLe_hVY8rc&room_name=hello%20-%20renamed%20-%201&room_avatar_url=mxc%3A//matrix.org/hVsKlTWovDRlvsIavcqRdAOd&inviter_name=Dat%20Pham%20H&guest_access_token=&guest_user_id=&room_type=
/_twake/sms
{
"to": "string",
"text": "string"
}