feat: harden sessions and track downstream acknowledgements

api/src/sms-config/client-sms-config.controller.ts

@@ -1,6 +1,7 @@
 import { Body, Controller, Get, Param, Post, Put } from '@nestjs/common';
 import { ApiTags } from '@nestjs/swagger';
 import { TenantId } from '../common/tenant-id.decorator';
+import { RequireRecentAuthentication } from '../auth/require-recent-authentication.decorator';
 import {
   CreateSignatureMaterialDto,
   CreateSmsApplicationDto,
@@ -39,11 +40,13 @@ export class ClientSmsConfigController {
   }
 
   @Post('applications/:id/secret/reset')
+  @RequireRecentAuthentication()
   resetApplicationSecret(@Param('id') applicationId: string, @Body() body: StatusChangeDto) {
     return this.smsConfig.resetApplicationSecret(applicationId, body);
   }
 
   @Post('applications/:id/status')
+  @RequireRecentAuthentication()
   changeApplicationStatus(@Param('id') applicationId: string, @Body() body: StatusChangeDto) {
     return this.smsConfig.changeApplicationStatus(applicationId, body);
   }