Verify your users by call or SMS

#Verify your users by call or SMS

It's a common practice: a user signs up, you send an SMS to their phone with a code, they enter that code in your application and they're off to the races.

This package makes it simple to add this capability to your Laravel application.

#Installation

You can install the package via composer:

composer require worksome/verify-by-phone

You can publish the config file by running:

php artisan vendor:publish --tag="verify-by-phone-config"

#Configuration

This package is built to support multiple verification services. The primary service is Twilio. You may configure the service in the config file at config/verify-by-phone.php under driver, or by using the dedicated .env variable: VERIFY_BY_PHONE_DRIVER.

#twilio

To use our Twilio integration, you'll need to provide an account_sid, auth_token and verify_sid. All of these can be set in the config/verify-by-phone.php file under services.twilio.

#Usage

To use this package, you'll want to inject the \Worksome\VerifyByPhone\Contracts\PhoneVerificationService contract into your application. Let's imagine that you want to send the verification code in a controller method:

public function sendVerificationCode(Request $request, PhoneVerificationService $verificationService)
{
    // Send a verification code to the given number
    $verificationService->send(new PhoneNumber($request->input('phone')));
 
    return redirect(route('home'))->with('message', 'Verification code sent!');
}

It's as simple as that! Note that we are using \Propaganistas\LaravelPhone\PhoneNumber to safely parse numbers in different formats.

Now, when a user receives their verification code, you'll want to check that it is valid. Use the verify method for this:

public function verifyCode(Request $request, PhoneVerificationService $verificationService)
{
    // Verify the verification code for the given phone number
    $valid = $verificationService->verify(
        new PhoneNumber($request->input('phone')),
        $request->input('code')
    );
 
    if ($valid) {
        // Mark your user as valid
    }
}

The first parameter is the phone number (again using \Propaganistas\LaravelPhone\PhoneNumber), and the second is the verification code provided by the user.

#Validation rule

We offer a rule to make it easy to verify a verification code during validation.

Be aware that this rule will call the verify method of the PhoneVerificationService contract, and likely will make an HTTP request.

Validator::validate($request->all(), [
    'phone_number' => ['required'],
    'verification_code' => ['required', Rule::verificationCodeIsValid('phone_number')],
]);

If your data doesn't include the phone number, you may instead pass it in manually:

Validator::validate($request->all(), [
    'verification_code' => ['required', Rule::verificationCodeIsValid('+441174960123')],
]);

We extend the Rule class for visual consistency with other rules, but you can also use the VerificationCodeIsValid rule directly for better IDE support:

Validator::validate($request->all(), [
    'verification_code' => ['required', new VerificationCodeIsValid('+441174960123')],
]);

This rule will also handle the case where the verification code has expired and return a suitable error message.

#Artisan commands

This package ships with a couple of artisan commands that allow you to send and verify verification codes.

# Send a verication code to the given phone number
php artisan verify-by-phone:send "+441174960123"
 
# Check that a given verication code is valid for the given phone number
php artisan verify-by-phone:verify "+441174960123" 1234

The verify command will return a console failure if verification fails.

#Testing

When writing tests, you likely do not want to make real requests to services such as Twilio. To support testing, we provide a FakeVerificationService that can be used to mock the verification service. To use it, you should set an env variable in your phpunit.xml with the following value:

 
<env name='VERIFY_BY_PHONE_DRIVER' value='null'/>

Alternatively, you may manually swap out the integration in your test via using the swap method. The fake implementation has some useful testing methods you can use:

it('tests something to do with SMS verification', function () {
    $service = new FakeVerificationService();
    $this->swap(PhoneVerificationService::class, $service);
 
    // Customise what happens when calling `send`
    $service->sendUsing(fn () => throw new Exception('Something went wrong'));
 
    // Customise what happens when calling `verify`
    $service->verifyUsing(fn () => throw new Exception('Something went wrong'));
 
    // Throw a VerificationCodeExpiredException
    $service->actAsThoughTheVerificationCodeExpired();
 
    // Assert that a verification was "sent" on the given number
    $service->assertSentVerification(new PhoneNumber('+441174960123'));
});

You may execute this project's tests by running:

composer test

#Changelog

Please see CHANGELOG for more information on what has changed recently.

#Contributing

Please see CONTRIBUTING for details.

#Security Vulnerabilities

Please review our security policy on how to report security vulnerabilities.

#Credits

• Luke Downing
• All Contributors

#License

The MIT License (MIT). Please see License File for more information.