Backend: fix feature-flag gating gaps for SMS and postal verification

Evaluate sms_enabled per-user instead of globally - send_sms always has a
user in scope (its only caller, ChangePhone, has the context), so global
evaluation skipped feature-usage tracking and would silently fall through to
the default if the flag ever became a rollout/experiment.

Gate ConfirmPostalAddress on postal_verification_enabled. Previously only the
free address-validation step (InitiatePostalVerification) was gated, so a user
already past step 1 could still trigger a (paid) postcard with the flag off.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: aapeliv

app/backend/src/couchers/phone/sms.py

@@ -4,8 +4,9 @@
 import boto3
 import luhn
 
-from couchers import crypto, experimentation
+from couchers import crypto
 from couchers.config import config
+from couchers.context import CouchersContext
 from couchers.db import session_scope
 from couchers.models import SMS
 
@@ -25,14 +26,14 @@ def format_message(token: str) -> str:
     return f"{token} is your Couchers.org verification code. If you did not request this, please ignore this message. Best, the Couchers.org team."
 
 
-def send_sms(number: str, message: str) -> str:
+def send_sms(context: CouchersContext, number: str, message: str) -> str:
     """Send SMS to a E.164 formatted phone number with leading +. Return "success" on
     success, "unsupported operator" on unsupported operator, and any other
     string for any other error."""
 
     assert len(message) <= 140, "Message too long"
 
-    if not experimentation.get_global_boolean_value("sms_enabled", default=False):
+    if not context.get_boolean_value("sms_enabled", default=False):
         logger.info(f"SMS not enabled, need to send to {number}: {message}")
         return "SMS not enabled."
 

app/backend/src/couchers/servicers/account.py

@@ -349,7 +349,7 @@ def ChangePhone(
             context.abort_with_error_code(grpc.StatusCode.RESOURCE_EXHAUSTED, "reverification_too_early")
 
         token = sms.generate_random_code()
-        result = sms.send_sms(phone, sms.format_message(token))
+        result = sms.send_sms(context, phone, sms.format_message(token))
 
         if result == "success":
             user.phone = phone

app/backend/src/couchers/servicers/postal_verification.py

@@ -168,6 +168,11 @@ def ConfirmPostalAddress(
         """
         Step 2: User confirms address, we generate code and send postcard.
         """
+        # Gate the step that actually commits to sending a (paid) postcard, not just the initial
+        # address validation - otherwise turning the flag off wouldn't stop postcards mid-flow.
+        if not context.get_boolean_value("postal_verification_enabled", default=False):
+            context.abort_with_error_code(grpc.StatusCode.UNAVAILABLE, "postal_verification_disabled")
+
         attempt = session.execute(
             select(PostalVerificationAttempt)
             .where(PostalVerificationAttempt.id == request.postal_verification_attempt_id)

app/backend/src/tests/test_postal_verification.py

@@ -15,7 +15,7 @@
 from couchers.helpers.postal_verification import generate_postal_verification_code, has_postal_verification
 from couchers.jobs.worker import process_job
 from couchers.models import User
-from couchers.models.postal_verification import PostalVerificationAttempt
+from couchers.models.postal_verification import PostalVerificationAttempt, PostalVerificationStatus
 from couchers.postal.my_postcard import _generate_back_left_side_png
 from couchers.proto import postal_verification_pb2
 from couchers.resources import get_postcard_front_image
@@ -60,6 +60,32 @@ def test_postal_verification_disabled(db, feature_flags):
         assert e.value.code() == grpc.StatusCode.UNAVAILABLE
 
 
+def test_postal_verification_confirm_disabled(db, feature_flags):
+    """Confirming (which queues the paid postcard) must respect the flag, not just initiation."""
+    feature_flags.set("postal_verification_enabled", False)
+    user, token = generate_user()
+
+    # Seed a pending attempt directly, since initiation is gated by the same flag.
+    with session_scope() as session:
+        attempt = PostalVerificationAttempt(
+            user_id=user.id,
+            status=PostalVerificationStatus.pending_address_confirmation,
+            address_line_1="123 Main St",
+            city="Test City",
+            country_code="US",
+        )
+        session.add(attempt)
+        session.flush()
+        attempt_id = attempt.id
+
+    with postal_verification_session(token) as pv:
+        with pytest.raises(grpc.RpcError) as e:
+            pv.ConfirmPostalAddress(
+                postal_verification_pb2.ConfirmPostalAddressReq(postal_verification_attempt_id=attempt_id)
+            )
+        assert e.value.code() == grpc.StatusCode.UNAVAILABLE
+
+
 def test_postal_verification_happy_path(db):
     """Test the complete happy path for postal verification."""
     user, token = generate_user()

app/backend/src/tests/test_verification.py

@@ -7,6 +7,7 @@
 
 import couchers.phone.sms
 from couchers.config import config
+from couchers.context import make_background_user_context
 from couchers.crypto import random_hex
 from couchers.db import session_scope
 from couchers.models import SMS, User
@@ -43,7 +44,7 @@ def test_ChangePhone(db, monkeypatch, push_collector: PushCollector):
         assert e.value.code() == grpc.StatusCode.UNIMPLEMENTED
 
         # Test with operator not supported by SMS backend
-        def deny_operator(phone, message):
+        def deny_operator(context, phone, message):
             assert phone == "+46701740605"
             return "unsupported operator"
 
@@ -54,7 +55,7 @@ def deny_operator(phone, message):
         assert e.value.code() == grpc.StatusCode.UNIMPLEMENTED
 
         # Test with successfully sent SMS
-        def succeed(phone, message):
+        def succeed(context, phone, message):
             assert phone == "+46701740605"
             return "success"
 
@@ -94,7 +95,7 @@ def test_ChangePhone_ratelimit(db, monkeypatch):
     user_id = user.id
     with account_session(token) as account:
 
-        def succeed(phone, message):
+        def succeed(context, phone, message):
             return "success"
 
         monkeypatch.setattr(couchers.phone.sms, "send_sms", succeed)
@@ -166,7 +167,7 @@ def test_phone_uniqueness(monkeypatch):
     user2, token2 = generate_user()
     with account_session(token1) as account1, account_session(token2) as account2:
 
-        def succeed(phone, message):
+        def succeed(context, phone, message):
             return "success"
 
         monkeypatch.setattr(couchers.phone.sms, "send_sms", succeed)
@@ -217,7 +218,10 @@ def test_send_sms(db, monkeypatch):
         sns.publish.return_value = {"MessageId": msg_id}
         mock.client.return_value = sns
 
-        assert couchers.phone.sms.send_sms("+46701740605", "Testing SMS message") == "success"
+        assert (
+            couchers.phone.sms.send_sms(make_background_user_context(1), "+46701740605", "Testing SMS message")
+            == "success"
+        )
 
         mock.client.assert_called_once_with("sns")
         sns.publish.assert_called_once_with(
@@ -239,7 +243,10 @@ def test_send_sms(db, monkeypatch):
 
 def test_send_sms_disabled(db, feature_flags):
     feature_flags.set("sms_enabled", False)
-    assert couchers.phone.sms.send_sms("+46701740605", "Testing SMS message") == "SMS not enabled."
+    assert (
+        couchers.phone.sms.send_sms(make_background_user_context(1), "+46701740605", "Testing SMS message")
+        == "SMS not enabled."
+    )
 
 
 def test_sms_verification_no_donation():