From a3363dc26348995fdf2ab85029db7981228647fb Mon Sep 17 00:00:00 2001
From: Mike Helmick <helmick@google.com>
Date: Thu, 1 Apr 2021 18:41:41 -0700
Subject: [PATCH] user report messaging and signing (#1971)

---
 assets/server/realmadmin/_form_sms.html | 8 +++++++-
 pkg/controller/issueapi/send_sms.go     | 6 +++++-
 pkg/signatures/sms.go                   | 3 ++-
 3 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/assets/server/realmadmin/_form_sms.html b/assets/server/realmadmin/_form_sms.html
index 2a4edb996..ee0a7ae94 100644
--- a/assets/server/realmadmin/_form_sms.html
+++ b/assets/server/realmadmin/_form_sms.html
@@ -133,7 +133,7 @@
         <a class="dropdown-item" id="sms-template-new" href="#">New SMS template</a>
       </div>
       {{if $realm.AllowsUserReport}}
-        <small class="form-text text-muted">User initiated report is enabled, which always uses the <code>User Report</code> template.</small>
+        <small class="form-text text-muted">&nbsp;User initiated report is enabled, which always uses the <code>User Report</code> template.</small>
       {{end}}
     </div>
     {{if $realm.ErrorsFor "smsTextTemplate"}}
@@ -158,6 +158,12 @@
         {{joinStrings ($realm.ErrorsFor $v.Label) ", "}}
       </div>
       {{end}}
+      {{if (eq "User Report" $v.Label)}}
+        <div class="alert alert-warning" role="alert">
+          For the <strong>User Report</strong> template it is strongly recommended that you
+          indicate that the user should not use the code if they did not request it.
+        </div>
+      {{end}}
       {{if or (not $realm.AllowsUserReport) (ne "User Report" $v.Label)}}
       <button class="btn btn-danger mb-3 {{if eq $i 0}}d-none{{end}}" type="button" {{if ne $i 0}}onClick="removeTemplate('sms-template-{{$i}}');"{{end}}>Delete template</button>
       {{end}}
diff --git a/pkg/controller/issueapi/send_sms.go b/pkg/controller/issueapi/send_sms.go
index 894c06998..cc1a379bb 100644
--- a/pkg/controller/issueapi/send_sms.go
+++ b/pkg/controller/issueapi/send_sms.go
@@ -96,7 +96,11 @@ func (c *Controller) doSend(ctx context.Context, realm *database.Realm, smsProvi
 	// SMS signing.
 	if signer != nil {
 		var err error
-		message, err = signatures.SignSMS(signer, keyID, smsStart, signatures.SMSPurposeENReport, request.Phone, message)
+		purpose := signatures.SMSPurposeENReport
+		if request.TestType == api.TestTypeUserReport {
+			purpose = signatures.SMSPurposeUserReport
+		}
+		message, err = signatures.SignSMS(signer, keyID, smsStart, purpose, request.Phone, message)
 		if err != nil {
 			defer func() {
 				if err := stats.RecordWithOptions(ctx,
diff --git a/pkg/signatures/sms.go b/pkg/signatures/sms.go
index e70a9c1c5..0b1a697c9 100644
--- a/pkg/signatures/sms.go
+++ b/pkg/signatures/sms.go
@@ -40,7 +40,8 @@ type SMSPurpose string
 
 const (
 	// SMSPurposeENReport is an SMS purpose for EN reporting.
-	SMSPurposeENReport SMSPurpose = "EN Report"
+	SMSPurposeENReport   SMSPurpose = "EN Report"
+	SMSPurposeUserReport SMSPurpose = "User Report"
 )
 
 // SignSMS returns a new SMS message with the embedded signature using the