Twilio Messaging

CaseSolo's Twilio messaging implementation lives in src/lib/integrations/twilio.ts and the routes under:

• /api/integrations/twilio
• /api/webhooks/twilio

Implemented Contracts

• Production SMS send through Twilio REST API.
• Optional MessagingServiceSid support for sender-pool routing.
• Optional Twilio StatusCallback URL support for delivery tracking.
• E.164 recipient validation before outbound send.
• 1,600-character SMS body guard.
• TCPA opt-in and opt-out tracking via SmsConsent.
• STOP/CANCEL/END/QUIT/UNSUBSCRIBE opt-out handling.
• START/YES/UNSTOP/SUBSCRIBE opt-in handling.
• Inbound SMS persistence in SmsMessage.
• Contact and latest client-case resolution for inbound message threading.
• Delivery status updates from Twilio status callbacks.
• Signature verification for production webhooks and local smoke tests that opt into strict verification.
• TCPA-aware SMS template registry for intake, appointment, document request, and settlement update messaging.
• Communication sequences can use sms steps through sendSms().

Admin Configuration

/api/integrations/twilio stores firm-scoped Twilio settings in firm.settings.twilio:

• connected
• accountSid
• authToken
• phoneNumber
• messagingServiceSid
• statusCallbackUrl
• smsEnabled
• voiceEnabled
• messageCount
• lastActivity

GET responses redact the auth token and expose only accountSidHint.

Webhook Security

Production webhook requests must include X-Twilio-Signature. Local smoke tests can require the same behavior with:

x-casesolo-require-twilio-signature: true

Status callbacks return 204. Inbound message callbacks return TwiML with Content-Type: text/xml.

Verification

Focused tests:

npm run test:run -- twilio

The tests cover live send behavior, Messaging Service/status callback payloads, E.164 validation, TCPA keywords, template rendering, inbound contact/case threading, status callbacks, and webhook signature enforcement.