feat: Enhance SMS import client with JWT diagnostics and error handling

[teebhagg]

No description provided.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
cedi-wise	Ready	Preview, Comment	Jul 8, 2026 7:58am
cediwise	Ready	Preview, Comment	Jul 8, 2026 7:58am

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: d54e6c50-50eb-46ca-9ea9-6bc4a874c876

📥 Commits

Reviewing files that changed from the base of the PR and between 9906944 and cd3c1aa.

📒 Files selected for processing (4)

• cediwise-mobile-app/services/smsImportClient.ts
• cediwise-mobile-app/utils/auth.ts
• cediwise-web-official/server/api/v1/sms-import.post.ts
• cediwise-web-official/server/lib/sms-import/auth.ts

Disabled knowledge base sources:

• Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

---

📝 Walkthrough

Summary by CodeRabbit

• Bug Fixes

  • SMS imports now return clearer unauthorized errors, including more specific reasons when a token is missing, invalid, or expired.
  • Authentication handling for imports is more reliable across different request formats.
  • Access tokens are now checked using JWT expiry data, improving refresh timing and reducing unexpected sign-in issues.

• New Features

  • Import failures now include error codes, making responses easier to interpret.
  • Import diagnostics now provide more useful request details when troubleshooting failures.

Walkthrough

This PR adds JWT-based diagnostics and expiry checks to the mobile app's SMS import client and auth utilities, and introduces structured failure codes to the web server's SMS import authentication library and endpoint, propagating auth error codes through API responses.

Changes

SMS Import Auth Diagnostics and Coded Failures

Layer / File(s)	Summary
SMS import client env, diagnostics, and error mapping cediwise-mobile-app/services/smsImportClient.ts	Adds Supabase env constants, returns/logs JWT diagnostics (including issuer match), refines 401 error mapping based on decoded auth code, and includes diagnostics/hasAnonKey in request logs and headers.
Mobile JWT-based access token expiry cediwise-mobile-app/utils/auth.ts	Adds JWT payload parsing for exp, an isJwtExpired helper, and updates token expiration/refresh checks to prefer JWT exp with fallback to stored expiresAt.
Auth failure codes and header reading cediwise-web-official/server/lib/sms-import/auth.ts	Adds AuthFailureCode type, extends AuthResult with code, adds readAuthorizationHeader, reworks JWT validation (admin/anon fallback), and adds codes to webhook and missing-authorization failures.
SMS import endpoint wiring cediwise-web-official/server/api/v1/sms-import.post.ts	Uses readAuthorizationHeader and includes the failure code in the JSON error response.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant App as Mobile App
  participant Client as smsImportClient
  participant API as Import API
  App->>Client: postSmsImportBody(messages)
  Client->>Client: getTokenDiagnostics(accessToken)
  Client->>API: POST /sms-import (apikey if available)
  API-->>Client: response (ok or 401)
  alt non-OK response
    Client->>Client: log warn with tokenDiagnostics
    Client->>Client: mapApiError(status, payload)
  else ok
    Client->>Client: log warn (request ok)
  end
  Client-->>App: result or SmsImportClientError

Loading

sequenceDiagram
  participant Client
  participant Endpoint as sms-import.post.ts
  participant Auth as authenticateSmsImportRequest
  Client->>Endpoint: POST /api/v1/sms-import
  Endpoint->>Endpoint: readAuthorizationHeader(event)
  Endpoint->>Auth: authenticateSmsImportRequest(header, body)
  Auth-->>Endpoint: AuthResult (ok or error with code)
  alt auth failed
    Endpoint-->>Client: jsonResponse {error, code}
  else auth ok
    Endpoint-->>Client: process import
  end

Loading

Possibly related PRs

• teebhagg/CediWise#43: Builds on the same SMS import feature, sharing readAuthorizationHeader usage and structured 401 code fields.
• teebhagg/CediWise#44: Also modifies cediwise-mobile-app/services/smsImportClient.ts for JWT diagnostics and error mapping.

Suggested labels: bug

Poem

A rabbit hops through tokens tall,
Checking exp before they fall,
Codes now tag each auth mistake,
No more guessing what's at stake!
🐰🔐 Hop, decode, and log away~

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/web-sms-import-endpoint

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⚠️ ESLint: 6 warning(s), 0 errors (warnings do not fail CI).

❌ TypeScript errors (tsc --noEmit). Fix type errors before merging. Workflow run