Steps for backend config to complete consent flow - emergency contact

Notes

• The repository already contains Lambdas and client code for inviting and verifying emergency contacts.
• Configuration placeholders remain (e.g., AppConfig uses empty URLs).
• processEmergencyContactReply-cloudformation-template.json does not include an SNS subscription, so inbound SMS will not automatically trigger the Lambda.
• The stored base URL for confirmation links appears incorrect.

Summary

• The EmergencyContact model includes inviteStatus, verified, and verificationToken fields and is used throughout the app. The repository sends invites and verifies contacts using two HTTP endpoints configured via AppConfig.
• The docs describe how to send invites and verify consent, including a separate Lambda to handle SMS replies.
• Lambdas for sending invites, verifying contacts, and processing SMS replies exist under amplify/backend/function. sendEmergencyContactInvite builds a confirmation link using a base URL and appends ?token=...&id=....
• team-provider-info.json stores environment parameters, but verificationBaseUrl currently includes ?token= which would result in malformed links.

Gaps & Remaining Work

1. Correct configuration values
   • Ensure VERIFICATION_BASE_URL does not include query parameters; configure it to the Lambda function URL or hosted route only.
   • Populate inviteUrl and verifyUrl in AppConfig (these are empty placeholders until amplify pull sets them).
2. SNS subscription for inbound SMS
   • processEmergencyContactReply-cloudformation-template.json lacks an AWS::SNS::Subscription resource, so the Lambda won’t receive messages automatically. Add a subscription to the SNS topic specified by SNS_TOPIC_ARN.
3. AWS resource setup
   • Verify the SES sender address and request production access, as noted in the docs.
   • Ensure an SNS topic exists and is configured for SMS delivery.
   • Confirm the processEmergencyContactReply Lambda is subscribed to that topic and that the outbound invite function has permissions to publish.
4. Deployment steps
   • After adjusting configurations, redeploy the Amplify backend (amplify push).
   • Distribute the verification link domain so emergency contacts can open /verify_contact?token=<t>&id=<id> which routes to VerifyEmergencyContactScreen.

These items are outside of the core Flutter code but required to finalize validating emergency contact consent.