Backend: migrate ENABLE_STRONG_VERIFICATION to strong_verification_enabled flag

Replace the static ENABLE_STRONG_VERIFICATION env config with a per-request
`strong_verification_enabled` feature flag so strong verification can be
toggled remotely without a deploy. The Iris ID credentials stay in env and
are now required in production unconditionally (since the flag can be
flipped on at any time), failing loudly at boot if missing.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: aapeliv

app/backend.dev.env

@@ -18,7 +18,6 @@ STRIPE_API_KEY=sk_test_...
 STRIPE_WEBHOOK_SECRET=whsec_...
 STRIPE_RECURRING_PRODUCT_ID=price_...
 
-ENABLE_STRONG_VERIFICATION=0
 IRIS_ID_PUBKEY=public-key-...
 IRIS_ID_SECRET=secret-...
 # corresponds to private key e6c2fbf3756b387bc09a458a7b85935718ef3eb1c2777ef41d335c9f6c0ab272

app/backend/src/couchers/config.py

@@ -45,8 +45,7 @@
     ("STRIPE_API_KEY", str),
     ("STRIPE_WEBHOOK_SECRET", str),
     ("STRIPE_RECURRING_PRODUCT_ID", str),
-    # Strong verification through Iris ID
-    ("ENABLE_STRONG_VERIFICATION", bool),
+    # Strong verification through Iris ID (gated at runtime by the `strong_verification_enabled` feature flag)
     ("IRIS_ID_PUBKEY", str),
     ("IRIS_ID_SECRET", str),
     ("VERIFICATION_DATA_PUBLIC_KEY", bytes),
@@ -151,15 +150,15 @@ def check_config(cfg: dict[str, Any]) -> None:
             raise Exception("Production site must have SMS enabled")
         if cfg["IN_TEST"]:
             raise Exception("IN_TEST while not DEV")
+        # Strong verification is gated at runtime by the `strong_verification_enabled` feature flag, which
+        # can be flipped on remotely at any time, so prod must always have the Iris ID credentials present.
+        if not cfg["IRIS_ID_PUBKEY"] or not cfg["IRIS_ID_SECRET"] or not cfg["VERIFICATION_DATA_PUBLIC_KEY"]:
+            raise Exception("Iris ID credentials must be configured in production")
 
     if cfg["ENABLE_DONATIONS"]:
         if not cfg["STRIPE_API_KEY"] or not cfg["STRIPE_WEBHOOK_SECRET"] or not cfg["STRIPE_RECURRING_PRODUCT_ID"]:
             raise Exception("No Stripe API key/recurring donation ID but donations enabled")
 
-    if cfg["ENABLE_STRONG_VERIFICATION"]:
-        if not cfg["IRIS_ID_PUBKEY"] or not cfg["IRIS_ID_SECRET"] or not cfg["VERIFICATION_DATA_PUBLIC_KEY"]:
-            raise Exception("No Iris ID pubkey/secret or verification data pubkey but strong verification enabled")
-
     if cfg["ENABLE_POSTAL_VERIFICATION"]:
         if (
             not cfg["MYPOSTCARD_API_KEY"]

app/backend/src/couchers/servicers/account.py

@@ -428,7 +428,7 @@ def VerifyPhone(
     def InitiateStrongVerification(
         self, request: empty_pb2.Empty, context: CouchersContext, session: Session
     ) -> account_pb2.InitiateStrongVerificationRes:
-        if not config["ENABLE_STRONG_VERIFICATION"]:
+        if not context.get_boolean_value("strong_verification_enabled", default=False):
             context.abort_with_error_code(grpc.StatusCode.UNAVAILABLE, "strong_verification_disabled")
 
         user = session.execute(select(User).where(User.id == context.user_id)).scalar_one()

app/backend/src/tests/conftest.py

@@ -181,7 +181,6 @@ def testconfig():
     config["STRIPE_WEBHOOK_SECRET"] = ""
     config["STRIPE_RECURRING_PRODUCT_ID"] = ""
 
-    config["ENABLE_STRONG_VERIFICATION"] = False
     config["IRIS_ID_PUBKEY"] = ""
     config["IRIS_ID_SECRET"] = ""
     # corresponds to private key e6c2fbf3756b387bc09a458a7b85935718ef3eb1c2777ef41d335c9f6c0ab272

app/backend/src/tests/test_strong_verification.py

@@ -238,7 +238,6 @@ def do_and_check_sv(
 
 def monkeypatch_sv_config(monkeypatch):
     new_config = config.copy()
-    new_config["ENABLE_STRONG_VERIFICATION"] = True
     new_config["IRIS_ID_PUBKEY"] = "dummy_pubkey"
     new_config["IRIS_ID_SECRET"] = "dummy_secret"
     new_config["VERIFICATION_DATA_PUBLIC_KEY"] = bytes.fromhex(
@@ -637,7 +636,8 @@ def test_strong_verification_regression2(db, monkeypatch):
         )
 
 
-def test_strong_verification_disabled(db):
+def test_strong_verification_disabled(db, feature_flags):
+    feature_flags.set("strong_verification_enabled", False)
     user, token = generate_user()
 
     with account_session(token) as account: