Add shared HMAC+domain auth for remote SMS wallet API.

Products can authenticate with one shared secret and tenant domain instead of per-version tokens; Bearer token remains as fallback.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/sms/remote-sms.controller.ts

@@ -1,6 +1,6 @@
 import { Body, Controller, Get, Post, Query, UseGuards } from '@nestjs/common';
 import { RemoteTenant } from '../auth/remote-tenant.decorator';
-import { RemoteTokenGuard } from '../auth/remote-token.guard';
+import { RemoteSmsAuthGuard } from '../auth/remote-sms-auth.guard';
 import { RemoteSmsConsumeDto } from './dto/sms-account.dto';
 import { SmsService } from './sms.service';
 
@@ -13,14 +13,17 @@ type RemoteTenantInfo = {
 };
 
 /**
- * Product apps (Hamkar/Khanegi) → SuperAdmin SMS wallet.
- * Auth: Authorization: Bearer {Tenant.remoteApiToken}
+ * Product apps → SuperAdmin SMS wallet.
+ *
+ * Auth (preferred): shared HMAC
+ *   X-Abshode-Domain, X-Abshode-Timestamp, X-Abshode-Signature
+ * Fallback: Authorization Bearer {Tenant.remoteApiToken}
  *
  * GET  /api/remote/sms/status?parts=1
  * POST /api/remote/sms/consume
  */
 @Controller('remote/sms')
-@UseGuards(RemoteTokenGuard)
+@UseGuards(RemoteSmsAuthGuard)
 export class RemoteSmsController {
   constructor(private readonly smsService: SmsService) {}
 

src/sms/sms.module.ts

@@ -1,14 +1,14 @@
 import { Module } from '@nestjs/common';
 import { NotificationsModule } from '../notifications/notifications.module';
+import { RemoteSmsAuthGuard } from '../auth/remote-sms-auth.guard';
 import { RemoteSmsController } from './remote-sms.controller';
 import { SmsController } from './sms.controller';
 import { SmsService } from './sms.service';
-import { RemoteTokenGuard } from '../auth/remote-token.guard';
 
 @Module({
   imports: [NotificationsModule],
   controllers: [SmsController, RemoteSmsController],
-  providers: [SmsService, RemoteTokenGuard],
+  providers: [SmsService, RemoteSmsAuthGuard],
   exports: [SmsService],
 })
 export class SmsModule {}