Make sure code is sent via email and sms

[eminogrande]

Same verification code via email and sms

[eminogrande]

@claude read docs.striga.com and come up with a implementation plan on how we send or re-send a email verification (is that possible at all or is the email send out automatically during user creation and cant be verified and sent out later again)?

[claude]

Claude finished @eminogrande's task —— View job

---

Research and Implementation Plan for Email/SMS Verification

Based on my comprehensive analysis of both the Striga API documentation and your current codebase, here are my findings and implementation recommendations:

Todo List:

• Read repository CLAUDE.md for guidelines
• Research Striga documentation at docs.striga.com
• Analyze current codebase for verification implementation
• Determine if email verification can be resent
• Create comprehensive implementation plan
• Document findings and recommendations

---

🔍 Key Findings

Email Verification Resend Capability

❌ Not Available: Striga does not provide an email resend endpoint. The API only offers:

• v1/user/resend-sms - For SMS verification codes
• No equivalent v1/user/resend-email endpoint exists

This means email verification codes cannot be resent after initial user creation. Emails are only sent automatically when v1/user/create is called.

Current Verification Flow Issue

Your codebase has a critical gap in /Nuri/Sources/Views/Create Card/Enter SMS Code/EnterSMSCodeViewModel.swift:96-104:

// COMMENTED OUT DUE TO BUILD ISSUES - NEEDS FIXING
/*
print("[SMS] 📧 Verifying email with same code (sandbox uses 123456 for both)...")
try await striga.verifyEmail(.init(
    userId: userId,
    verificationId: code  
))
*/

This code is commented out, meaning email verification is skipped, causing MFA failures when trying to use hosted cards.

Unified Code Support

✅ Good News: Striga's sandbox environment does support unified codes:

• Same code ("123456" in sandbox) works for both email and SMS
• Production likely sends different codes for each channel

---

🎯 Implementation Plan

Phase 1: Fix Current Email Verification

Priority: HIGH - Fix the commented-out email verification code

1. Uncomment and fix the email verification in EnterSMSCodeViewModel.swift:

   // After SMS verification succeeds, also verify email with same code
   try await striga.verifyEmail(.init(
       userId: userId,
       verificationId: code  // Same code works in sandbox
   ))

2. Add proper error handling for email verification failures

Phase 2: Add Email Resend Functionality (UI Only)

Since API doesn't support email resending, we need UI solutions:

1. Option A: Request New User Creation

   • If email verification fails/expires, guide user to create new account
   • Clear indication that email codes cannot be resent

2. Option B: Contact Support Flow

   • Provide support contact when email verification fails
   • Clear messaging about email limitations

Phase 3: Enhance SMS Verification UI

Current SMS resend works - enhance the UI:

1. Add resend timer and button for SMS codes
2. Clear messaging about which verification method can be resent
3. Unified experience where same code verifies both channels

Phase 4: Production Considerations

For production deployment:

1. Test with actual email/SMS (codes will likely be different)
2. Implement separate verification flows if unified codes don't work in production
3. Add retry logic for verification failures
4. Consider email provider integration as fallback (SendGrid, etc.)

---

🔧 Technical Implementation Details

Required API Endpoints (Already Available)

// Email verification
striga.verifyEmail(VerifyEmail(userId: String, verificationId: String))

// SMS verification  
striga.verifyMobile(VerifyMobile(userId: String, verificationCode: String))

// SMS resend (works)
striga.resendSMS(ResendSMS(userID: String))

// Email resend (NOT AVAILABLE)
// striga.resendEmail() - Does not exist

Data Models

• VerifyEmail uses verificationId parameter
• VerifyMobile uses verificationCode parameter
• Both accept the same code value in sandbox environment

---

🚀 Quick Fix Recommendation

Immediate action needed: Uncomment the email verification code in EnterSMSCodeViewModel.swift to fix the current MFA issue. This will enable both email and SMS verification with the same code in sandbox, which should resolve the "Multi-factor authentication not enabled" error.

Long-term solution: Since email resend isn't possible via API, focus on improving the user experience with clear messaging and alternative flows when email verification fails.

---