Phone number verification via Twilio SMS in Meteor

lovetap.org, my current side-project, sends people pictures from their Google photo albums directly to their phone at random intervals.
I wanted to make sure that people who sign up for the service actually own the phone number they're signing up with. I found a lot of tutorials on how to send a random code to a user's phone that they then have to enter on the website in order to verify their phone, but I was looking for something even simpler. lovetap will send you a text and all you have to do is reply "Yes" to verify your phone number.
How do you implement something like this with Twilio in a Meteor application? Well, it's actually not that hard:

First, you'll need a twilio account (duh).

When a user enters a number that hasn't been verified, send a text message asking them to verify (this is server-side code):

HTTP.post(twilioBaseUrl + '/Accounts/' + twilioAccountSid + '/Messages', {
	auth: twilioAccountSid + ':' + twilioAuthToken,
    params: {
            	From: twilioFromNumber,
                To: toNumber,
                Body: body
            }
});

Now, this is where it gets a little more complicated. The next step is to mark the number as verified when a user replies "Yes" to the message we just sent him. To achieve this, we'll tell twilio to hit a web hook in our application whenever someone responds to a text message.

In your twilio account, go to "Dev Tools", then "TwiML Apps". Enter a friendly name, and under "SMS & MMS", the URL of the webhook in your application. This is the URL that twilio will get whenever one of your users replies to a text message you sent them. I set it to "GET" as I couldn't get it to work with a POST. In the Meteor app, we'll have to create a new route in iron router for our web hook:

this.route('/webhooks/twilio/handleresponse', {
            where: 'server'
        })
        .get(function() {
            this.response.end(Twilio.handleResponse(this));
        });

Now, we just need to handle the data that twilio sends in the request:

		// extract data from twilio-post
        var date = new Date();
        var messageSid = routeContext.params.query.MessageSid;
        var accountSid = routeContext.params.query.AccountSid;
        var from = routeContext.params.query.From;
        var to = routeContext.params.query.To;
        var body = routeContext.params.query.Body;

        if (!from){
            return 'No from-number';
        }

        // unfortunately, iron router loses the + because it's URL encoded.
        // we'll clumsily add it by hand:
        from = '+' + from.trim();
        to = '+' + to.trim();

        // validated or not?
        var verified = false;
        body = body.toLowerCase();
        if (body.indexOf('yes') !== -1 || body === 'y') {
            verified = true;
        }

        // update validated numbers collection
        var responseBody = '';
        if (verified) {
            // set number to verified:
            NumberStatus.update({
                clean_number: from
            }, {
                '$set': {
                    verified_on: date
                }
            }, {
                multi: true
            });

            responseBody = 'Thanks! You\'ll soon receive your first picture!';
        } else {

            // set number to not verified:
            NumberStatus.update({
                clean_number: from
            }, {
                '$unset': {
                    verified_on: date
                }
            }, {
                multi: true
            });

            responseBody = 'OK, we won\'t send you pictures.\nIf you change your mind, simply reply "Yes" to this message.';
        }

        // Set the headers
        routeContext.response.writeHead(200, {
            'Content-Type': 'application/xml'
        });

        // respond with twiml:
        return '<?xml version="1.0" encoding="UTF-8"?><Response><Sms from="[TWILIOFROM]" to="[TO]">[BODY]</Sms></Response>'
            .replace('[TWILIOFROM]', twilioFromNumber)
            .replace('[TO]', from)
            .replace('[BODY]', responseBody);

We now  marked the number as verified in our database and can safely send to it.