scan-flow: geolocation scan, location-aware SMS throttle (log sender), finder contact, sms_enabled toggle, branding — 19/19 phase-2 scenarios pass

frontend/internal/sms/geo.go

@@ -0,0 +1,16 @@
+package sms
+
+import "math"
+
+const earthRadiusM = 6371000.0
+
+// HaversineMeters returns the great-circle distance between two points
+// (lat/lng in decimal degrees) in metres.
+func HaversineMeters(lat1, lng1, lat2, lng2 float64) float64 {
+	rad := func(d float64) float64 { return d * math.Pi / 180 }
+	dLat := rad(lat2 - lat1)
+	dLng := rad(lng2 - lng1)
+	a := math.Sin(dLat/2)*math.Sin(dLat/2) +
+		math.Cos(rad(lat1))*math.Cos(rad(lat2))*math.Sin(dLng/2)*math.Sin(dLng/2)
+	return 2 * earthRadiusM * math.Asin(math.Sqrt(a))
+}

frontend/internal/sms/normalize.go

@@ -0,0 +1,21 @@
+package sms
+
+import "strings"
+
+// NormalizeAU normalises a phone number to international AU format without a
+// leading '+' or zero:
+//
+//	"+61432374487" -> "61432374487"
+//	"0432374487"   -> "61432374487"
+func NormalizeAU(phone string) string {
+	s := strings.Map(func(r rune) rune {
+		if r >= '0' && r <= '9' {
+			return r
+		}
+		return -1
+	}, phone)
+	if strings.HasPrefix(s, "0") && len(s) >= 10 {
+		s = "61" + s[1:]
+	}
+	return s
+}

frontend/internal/sms/sender.go

@@ -0,0 +1,9 @@
+// Package sms provides a swappable SMS sending abstraction for WhereWoof.
+// The log sender is the default so development and tests never send real SMS.
+package sms
+
+// Sender sends an SMS to a destination number in international format
+// (no leading '+', no leading zero — see NormalizeAU).
+type Sender interface {
+	Send(to, body string) error
+}

frontend/internal/sms/sms_test.go

@@ -0,0 +1,52 @@
+package sms
+
+import (
+	"math"
+	"testing"
+)
+
+func TestHaversineMeters(t *testing.T) {
+	cases := []struct {
+		name           string
+		lat1, lng1     float64
+		lat2, lng2     float64
+		wantMeters     float64
+		tolerancePct   float64
+	}{
+		{"same point", -33.86, 151.21, -33.86, 151.21, 0, 0},
+		{"Sydney CBD to Parramatta (~20km)", -33.8688, 151.2093, -33.8125, 151.0011, 20200, 0.02},
+		{"~250m at Sydney latitude", -33.86, 151.21, -33.86, 151.2128, 250, 0.20},
+		{"antipodal-ish long distance", 0, 0, 0, 180, 20037500, 0.01},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := HaversineMeters(tc.lat1, tc.lng1, tc.lat2, tc.lng2)
+			if tc.wantMeters == 0 {
+				if got > 1 {
+					t.Fatalf("same point: got %.1f m, want ~0", got)
+				}
+				return
+			}
+			diff := math.Abs(got-tc.wantMeters) / tc.wantMeters
+			if diff > tc.tolerancePct {
+				t.Fatalf("got %.1f m, want ~%.1f m (error %.1f%%)", got, tc.wantMeters, diff*100)
+			}
+		})
+	}
+}
+
+func TestNormalizeAU(t *testing.T) {
+	cases := []struct{ in, want string }{
+		{"+61432374487", "61432374487"},
+		{"0432374487", "61432374487"},
+		{"61432374487", "61432374487"},
+		{"+61 432 374 487", "61432374487"},
+		{"(04) 3237 4487", "61432374487"},
+		{"", ""},
+	}
+	for _, tc := range cases {
+		if got := NormalizeAU(tc.in); got != tc.want {
+			t.Errorf("NormalizeAU(%q) = %q, want %q", tc.in, got, tc.want)
+		}
+	}
+}

frontend/internal/sms/smsglobal.go

@@ -0,0 +1,85 @@
+package sms
+
+// ⚠️ VERIFY BEFORE REAL SMS (scan-flow task 9): the exact canonical-string
+// format for the HMAC signature and the JSON field names must be confirmed
+// against the account holder's MXT docs / their existing integration before
+// the real-SMS test. The Sender interface keeps this implementation swappable
+// if the auth scheme differs.
+
+import (
+	"bytes"
+	"crypto/hmac"
+	"crypto/md5"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"time"
+)
+
+// Client sends SMS via the SMSGlobal REST API.
+type Client struct {
+	apiKey    string
+	apiSecret string
+	from      string // empty => SMSGlobal shared/pooled number
+	http      *http.Client
+}
+
+// New returns an SMSGlobal client. from may be empty to use the shared pool.
+func New(apiKey, apiSecret, from string) *Client {
+	return &Client{
+		apiKey:    apiKey,
+		apiSecret: apiSecret,
+		from:      from,
+		http:      &http.Client{Timeout: 10 * time.Second},
+	}
+}
+
+// Send posts a message to the given destination (international format).
+func (c *Client) Send(to, body string) error {
+	payload, err := json.Marshal(map[string]string{
+		"message": body,
+		"to":      to,
+		"from":    c.from,
+	})
+	if err != nil {
+		return err
+	}
+
+	req, err := http.NewRequest(http.MethodPost, "https://api.smsglobal.com/sms/", bytes.NewReader(payload))
+	if err != nil {
+		return err
+	}
+	date := time.Now().UTC().Format(http.TimeFormat)
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Accept", "application/json")
+	req.Header.Set("Date", date)
+	req.Header.Set("Authorization", c.authorization(req, payload, date))
+
+	resp, err := c.http.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode >= 300 {
+		b, _ := io.ReadAll(io.LimitReader(resp.Body, 512))
+		return fmt.Errorf("smsglobal: status %d: %s", resp.StatusCode, string(b))
+	}
+	return nil
+}
+
+// authorization builds the REST v1 HMAC-SHA256 signature:
+// base64(HMAC-SHA256(canonicalString, apiSecret)), sent as "key:signature".
+// Canonical string per SMSGlobal docs: method&path&accept&date&contentType&contentMd5.
+func (c *Client) authorization(req *http.Request, body []byte, date string) string {
+	bodyHash := md5.Sum(body)
+	canonical := fmt.Sprintf("%s&%s&%s&%s&%s&%s",
+		req.Method, req.URL.Path, "application/json", date, "application/json",
+		base64.StdEncoding.EncodeToString(bodyHash[:]))
+	mac := hmac.New(sha256.New, []byte(c.apiSecret))
+	mac.Write([]byte(canonical))
+	sig := base64.StdEncoding.EncodeToString(mac.Sum(nil))
+	return fmt.Sprintf("%s:%s", c.apiKey, sig)
+}

frontend/internal/sms/smslog.go

@@ -0,0 +1,13 @@
+package sms
+
+import "log"
+
+// LogSender writes messages to the log instead of sending.
+// Used automatically when no SMS credentials are configured.
+type LogSender struct{}
+
+// Send logs the would-be SMS.
+func (LogSender) Send(to, body string) error {
+	log.Printf("SMS to %s: %s", to, body)
+	return nil
+}