pocket_phone 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 32813de625e81367b1f5270e095b09a810afa30eb04d4f96ff326f1bd8d9c96e
+  data.tar.gz: 2afbaa72756cd6eedd206720b127f5e9ae0add415e29710271294f7af48208f4
+SHA512:
+  metadata.gz: 7a819bd93cfc91c3dd90d1b4c3ba97220b16fccf1ca3cd7b022548497ce47b6a26df53ff5d776ebf10782231ce929a9e3021349e697f06709387d1902e960de2
+  data.tar.gz: e6304e63140854f42c3ffea1a0426e014ebb1cf602a8dd54eb8927494fb1d6005603db294ec523fcceb49251c3270b6c9109c8675de0a2a5d8b5e0460302c387

data/CHANGELOG.md

@@ -0,0 +1,14 @@
+# Changelog
+
+## 0.1.0
+
+First version.
+
+- A fake Sendblue API: messages, group messages, carousels, typing indicators,
+  tapbacks, read receipts, service lookup, media upload, contact sharing and
+  message history.
+- An iMessage-style inbox for the phones on the other end, with blue and green
+  bubbles, attachments, group chats and link previews.
+- Signed `receive` webhooks for what the phones send, plus status callbacks,
+  outbound webhooks and typing webhooks.
+- Per-person simulation of Android phones, failed sends and refused sends.

data/LICENSE

@@ -0,0 +1,28 @@
+BSD 3-Clause License
+
+Copyright (c) 2026, hmk
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

data/README.md

@@ -0,0 +1,184 @@
+# pocket_phone
+
+[![CI](https://github.com/hmk/pocket_phone/actions/workflows/ci.yml/badge.svg)](https://github.com/hmk/pocket_phone/actions/workflows/ci.yml)
+[![Gem Version](https://badge.fury.io/rb/pocket_phone.svg)](https://rubygems.org/gems/pocket_phone)
+
+Like [letter_opener](https://github.com/ryanb/letter_opener), but for iMessage
+and SMS, and in both directions.
+
+pocket_phone is a fake [Sendblue](https://sendblue.com) for development. Your
+app sends to it instead of to `api.sendblue.com`; what it sent shows up in an
+iMessage-style inbox in your browser, and what you type there reaches your app
+as a signed Sendblue webhook. No real phone, no real texts, no tunnel.
+
+- Blue bubbles for iMessage, green for SMS and RCS
+- Text back as any number of fake people, one-to-one or in a group
+- Typing dots, tapbacks, read receipts, attachments
+- Link previews drawn by iMessage's own rules, with a note when a link would
+  not get one
+- Make a person an Android phone, or make sends to them fail, with one click
+- Every message shows the request your app made and the webhooks it got back
+
+## Install
+
+```ruby
+# Gemfile
+group :development do
+  gem "pocket_phone"
+end
+```
+
+```ruby
+# config/routes.rb
+mount PocketPhone::Engine, at: "/pocket_phone" if Rails.env.development?
+```
+
+Then make two connections.
+
+**1. Point your Sendblue client at the engine.** Wherever the base URL lives,
+make it `http://localhost:3000/pocket_phone` in development in place of
+`https://api.sendblue.com`. The paths after it stay the same
+(`/api/send-message`, and so on), and so do the `sb-api-key-id` and
+`sb-api-secret-key` headers, which must be present but can hold anything.
+
+**2. Tell pocket_phone where your webhook is.**
+
+```ruby
+# config/initializers/pocket_phone.rb
+if defined?(PocketPhone::Engine)
+  PocketPhone.configure do |config|
+    config.webhook_url = "/webhooks/sendblue"        # where texts from the phone go
+    config.signing_secret = ENV["SENDBLUE_WEBHOOK_SECRET"]
+    config.from_number = ENV["SENDBLUE_FROM_NUMBER"] # your line, for phones that text first
+  end
+end
+```
+
+Open <http://localhost:3000/pocket_phone>.
+
+## Try it without an app
+
+```
+bundle install
+bundle exec rake demo
+```
+
+That runs pocket_phone on <http://localhost:4567/pocket_phone> with a small bot
+behind it. Text it "link", "photo" or "thanks". The bot is 40 lines in
+[`demo/config.ru`](demo/config.ru) and talks to Sendblue the ordinary way.
+
+## Configuration
+
+Any setting marked *lazy* also takes a lambda, read each time it is needed, for
+values that live in your database or are not loaded when the initializer runs.
+
+| Setting | Default | |
+|---|---|---|
+| `webhook_url` *lazy* | none | Where `receive` webhooks go. A full URL, or a path on the server pocket_phone is mounted in. |
+| `outbound_webhook_url` *lazy* | none | Where status updates for every message your app sends go. A `status_callback` on a send is always honoured as well. |
+| `typing_webhook_url` *lazy* | none | Where `typing_indicator` webhooks go when you type on the phone. |
+| `signing_secret` *lazy* | none | Signs webhooks, as described below. |
+| `secret_header` *lazy* | `sb-signing-secret` | The header the secret itself is sent in. |
+| `from_number` *lazy* | first line seen | Your Sendblue line. |
+| `api_key_id`, `api_secret` *lazy* | none | If set, API calls must carry exactly these. |
+| `account_email` *lazy* | `pocket_phone@example.com` | The `accountEmail` in payloads. |
+| `storage_path` *lazy* | `tmp/pocket_phone` | Where conversations and attachments are kept. |
+| `people` | `[]` | People to create on first use: `[{ name: "Alice", number: "+15555550101", service: "iMessage" }]` |
+| `delivery_delay` | `0.4` | Seconds between `QUEUED`, `SENT` and `DELIVERED`. |
+| `link_previews` | `true` | Fetch pages to draw link cards. |
+| `inbound_reactions` | `:text` | How a tapback made on the phone reaches your app. See below. |
+| `webhook_timeout` | `45` | Seconds to wait for your app to answer a webhook. |
+| `async` | `true` | Deliver on background threads. Set `false` in tests for inline delivery with no delays. |
+
+## What is faked
+
+| Endpoint | Notes |
+|---|---|
+| `POST /api/send-message` | `content`, `media_url`, `send_style`, `status_callback`, `app_card` |
+| `POST /api/send-group-message` | By `group_id`, or `numbers` to create the group |
+| `POST /api/send-carousel` | 2 to 20 images, iMessage only |
+| `POST /api/send-typing-indicator` | `state` and `max_duration_ms` are honoured |
+| `POST /api/send-reaction` | Six tapbacks or one emoji; a leading `-` removes it |
+| `POST /api/mark-read` | Shows "Read" under the phone's last message |
+| `POST /api/modify-group` | `add_recipient`, `remove_recipient` |
+| `GET /api/evaluate-service` | Answers with the person's phone type |
+| `POST /api/upload-file`, `POST /api/upload-media-object` | Files are kept locally and served back |
+| `POST /api/v2/contact-sharing/profile` | The line's shared name and photo |
+| `GET /api/v2/messages`, `GET`/`DELETE /api/v2/messages/:handle` | |
+
+Requests are checked the way Sendblue checks them: missing keys are a 401, a
+number that is not E.164 is a 400, a tapback on an SMS is a 422. Anything else
+under `/api` answers 404 with a message naming the endpoint, so a call that is
+not faked is obvious rather than silently accepted.
+
+App cards are drawn as the static card a recipient sees without the extension
+installed. The extension itself runs on an iPhone and cannot be faked.
+
+## Webhooks
+
+When `signing_secret` is set, every webhook carries both things Sendblue sends:
+
+- `x-sendblue-signature: t=<unix seconds>,v1=<hex>`, an HMAC-SHA256 of
+  `"<t>.<raw body>"` keyed by the secret
+- the secret itself in `sb-signing-secret` (or the header you named)
+
+Under a message the phone sent you will see **Delivered** when your app
+answered 2xx, **Not Delivered** with the reason when it did not, and **Read**
+once your app called `mark-read`. Open a message's details (the ⓘ) to see
+every webhook and its response, and to send the `receive` webhook again, which
+is how you check that a redelivery is not answered twice.
+
+## Simulating people
+
+Each person has two settings in the thread's header:
+
+- **Phone**: iPhone (iMessage), Android (SMS) or Android (RCS). Sends to an
+  Android phone come back with that `service` and `was_downgraded: true`, and
+  iMessage-only calls are refused.
+- **Sends to it**: delivered; fail after sending (the send is accepted, then an
+  `ERROR` status arrives by callback); or refused (the send answers 200 with
+  `"status": "ERROR"`, which is how Sendblue reports a blocked number).
+
+A group is blue only while everyone in it has an iPhone.
+
+## Link previews
+
+iMessage expands a link into a card only when the message contains exactly one
+URL, at the very start or end, not touching punctuation. pocket_phone applies
+the same rule and says so under a message whose link would stay plain text. The
+page is fetched with the user agent Messages uses, so a site that serves `og:`
+tags only to crawlers answers as it would for real.
+
+A preview of a page on `localhost` (or any private address) is drawn with a
+warning: a real phone could not have fetched it.
+
+## Where it differs from Sendblue
+
+- Payload shapes follow Sendblue's documentation and the fields its webhooks
+  are known to carry. Sendblue changes these without notice; if your app
+  depends on a field, check it against a real payload.
+- Sendblue documents no webhook for a tapback made by a recipient. With
+  `inbound_reactions = :text`, pocket_phone sends it as a received message
+  with the text an iPhone falls back to (`Loved “hello”`). Set `:none` to keep
+  phone-side tapbacks in the UI only.
+- Webhooks are not retried automatically. Use "Send the webhook again".
+- Rate limits, opt-outs, contacts, line provisioning and calls are not faked.
+
+## Notes
+
+- Mount it in development only. It has no authentication of its own.
+- State lives in `tmp/pocket_phone`. "Clear conversations" keeps your people;
+  delete the directory to start over completely.
+- A request in your app that sends a message is calling its own server. Run
+  more than one thread or worker in development (Puma does by default).
+
+## Development
+
+```
+bundle install
+bundle exec rake test
+```
+
+## License
+
+BSD 3-Clause. See [LICENSE](LICENSE).

data/app/controllers/pocket_phone/api/sendblue_controller.rb

@@ -0,0 +1,329 @@
+# frozen_string_literal: true
+
+module PocketPhone
+  module Api
+    # The part of Sendblue's API that pocket_phone answers. Requests are
+    # checked the way Sendblue checks them, so a client that would be refused
+    # for real is refused here too; nothing leaves the machine.
+    class SendblueController < ActionController::API
+      TAPBACKS = %w[love like dislike laugh emphasize question].freeze
+      # Sendblue's code for a number it will not send to.
+      BLOCKED = 4002
+
+      # A request Sendblue would turn down, with the status and body it uses.
+      class Refusal < StandardError
+        attr_reader :status, :body
+
+        def initialize(status, body)
+          @status = status
+          @body = body
+          super(body["message"] || body["error_message"])
+        end
+      end
+
+      wrap_parameters false
+      rescue_from(Refusal) { |refusal| render json: refusal.body, status: refusal.status }
+      before_action :remember_base_url, :require_credentials
+
+      # --- sending ----------------------------------------------------------
+
+      def send_message
+        number = recipient!(params[:number])
+        line = line!
+        body = message_body!
+
+        message, conversation = store.write do |db|
+          db.ensure_line(line)
+          person = db.ensure_person(number)
+          conversation = db.direct(line, number)
+          attrs = body.merge("to_number" => number, "service" => person["service"], "outcome" => person["outcome"])
+          [db.add_message(conversation, outbound(line, attrs)), conversation]
+        end
+        carry(message)
+        render json: Payloads.message(message, conversation)
+      end
+
+      # A group is addressed by `group_id`, or made on the spot from `numbers`.
+      def send_group_message
+        line = line!
+        body = message_body!
+        numbers = Array(params[:numbers]).map(&:to_s)
+        numbers.each { |number| recipient!(number) }
+        group_id = params[:group_id].to_s
+
+        message, conversation = store.write do |db|
+          db.ensure_line(line)
+          conversation = db.group(group_id) if group_id.present?
+          if conversation.nil?
+            next if numbers.size < 2
+
+            conversation = db.create_group(line: line, participants: numbers, group_id: group_id)
+          end
+          attrs = body.merge("service" => db.service_for(conversation), "outcome" => "delivered")
+          [db.add_message(conversation, outbound(line, attrs)), conversation]
+        end
+        unless message
+          refuse!(400, group_id.present? ? "Group #{group_id} was not found; send `numbers` to create it." :
+            "You must specify a `group_id` or at least two `numbers`.")
+        end
+
+        carry(message)
+        render json: Payloads.message(message, conversation)
+      end
+
+      def send_carousel
+        number = recipient!(params[:number])
+        line = line!
+        urls = Array(params[:media_urls]).map(&:to_s)
+        refuse!(400, "You must provide between 2 and 20 HTTPS image URLs.") unless urls.size.between?(2, 20)
+
+        message, conversation = store.write do |db|
+          db.ensure_line(line)
+          person = db.ensure_person(number)
+          refuse!(422, "Carousels are only supported on iMessage") unless person["service"] == "iMessage"
+
+          conversation = db.direct(line, number)
+          attrs = { "to_number" => number, "media_urls" => urls, "service" => "iMessage",
+                    "outcome" => person["outcome"], "send_style" => params[:send_style].presence }
+          [db.add_message(conversation, outbound(line, attrs)), conversation]
+        end
+        carry(message)
+        render json: Payloads.message(message, conversation)
+      end
+
+      # --- the small gestures -----------------------------------------------
+
+      def send_typing_indicator
+        refuse!(400, "You must specify a `number` in the request body.") if params[:number].blank?
+        number = recipient!(params[:number])
+        state = params[:state].presence || "start"
+        refuse!(400, '`state` must be either "start" or "stop".') unless %w[start stop].include?(state)
+        duration = Integer(params[:max_duration_ms].presence || 60_000, exception: false)
+        unless duration&.between?(1, 300_000)
+          refuse!(400, "`max_duration_ms` must be an integer between 1 and 300000.")
+        end
+
+        store.write do |db|
+          line = Numbers.normalize(params[:from_number])
+          conversation = line.empty? ? db.latest_direct(number) : db.direct(line, number, create: false)
+          next unless conversation
+
+          if state == "start"
+            conversation["typing_until"] = (Time.now.utc + (duration / 1000.0)).iso8601(3)
+          else
+            conversation.delete("typing_until")
+          end
+        end
+        render json: { status: "QUEUED", status_code: 200, error_message: nil, number: number }
+      end
+
+      def send_reaction
+        line!
+        reaction = params[:reaction].to_s
+        remove = reaction.start_with?("-")
+        name = reaction.delete_prefix("-")
+        unless TAPBACKS.include?(name) || single_emoji?(name)
+          refuse!(400, "Invalid reaction. Must be one of love, like, dislike, laugh, emphasize, question, " \
+                       "or exactly one emoji")
+        end
+
+        store.write do |db|
+          message = db.message(params[:message_handle])
+          unless message && message["direction"] == "phone"
+            refuse!(404, "The message to react to was not found for this account")
+          end
+          refuse!(422, "Reactions are only supported on iMessage messages") unless message["service"] == "iMessage"
+
+          db.react(message, by: "line", reaction: name, remove: remove)
+        end
+        render json: { status: "OK", message: "Reaction request sent",
+                       message_handle: params[:message_handle], reaction: reaction }
+      end
+
+      def mark_read
+        number = recipient!(params[:number])
+        line = line!
+        store.write do |db|
+          conversation = db.direct(line, number, create: false)
+          conversation["read_at"] = PocketPhone.now if conversation
+        end
+        render json: { status: "OK", message: "Mark read request sent", number: number }
+      end
+
+      def evaluate_service
+        number = recipient!(params[:number])
+        render json: { number: number, service: store.read.people.dig(number, "service") || "iMessage" }
+      end
+
+      # The name and photo iMessage shows for the line.
+      def contact_profile
+        line = Numbers.normalize(params[:fromNumber] || params[:from_number])
+        refuse!(400, "You must specify a `fromNumber` in the request body.") if line.empty?
+
+        name = [params[:firstName] || params[:first_name], params[:lastName] || params[:last_name]].compact.join(" ")
+        store.write do |db|
+          profile = db.ensure_line(line)
+          profile["name"] = name.presence
+          profile["photo_url"] = (params[:photoUrl] || params[:photo_url]).presence
+        end
+        render json: { status: "OK" }
+      end
+
+      def modify_group
+        number = recipient!(params[:number])
+        type = params[:modify_type].to_s
+        refuse!(400, '`modify_type` must be "add_recipient" or "remove_recipient".') unless
+          %w[add_recipient remove_recipient].include?(type)
+
+        echo = { "group_id" => params[:group_id].to_s, "modify_type" => type, "number" => number }
+        store.write do |db|
+          conversation = db.group(params[:group_id]) or
+            refuse!(404, "Group #{params[:group_id]} was not found", echo.merge("error" => "group_not_found"))
+          if type == "add_recipient"
+            db.ensure_person(number)
+            conversation["participants"] |= [number]
+          elsif conversation["participants"].size <= 2
+            refuse!(400, "Cannot remove from a group with 3 total members; Apple requires at least 3.",
+              echo.merge("error" => "group_too_small"))
+          else
+            conversation["participants"] -= [number]
+          end
+        end
+        render json: { "status" => "OK" }.merge(echo)
+      end
+
+      # --- media ------------------------------------------------------------
+
+      def upload_file
+        file = params[:file]
+        refuse!(400, "You must attach a `file`.") unless file.respond_to?(:original_filename)
+
+        name = store.save_media(file, file.original_filename)
+        render status: :created, json: { status: "OK", message: "File uploaded successfully",
+                                         media_url: media_url_for(name), mediaObjectId: name }
+      end
+
+      def upload_media_object
+        refuse!(400, "You must specify a `media_url` in the request body.") if params[:media_url].blank?
+
+        render status: :created, json: { status: "OK", message: "File uploaded successfully",
+                                         mediaObjectId: File.basename(URI.parse(params[:media_url].to_s).path) }
+      end
+
+      # --- reading back -----------------------------------------------------
+
+      def messages
+        db = store.read
+        found = db.messages.values.reverse.filter_map do |message|
+          conversation = db.conversations[message["conversation_id"]]
+          conversation && Payloads.message(message, conversation)
+        end
+        found.select! { |m| m["is_outbound"].to_s == params[:is_outbound] } if params[:is_outbound].present?
+        %w[status service group_id from_number to_number number].each do |field|
+          found.select! { |m| m[field].to_s == params[field].to_s } if params[field].present?
+        end
+        limit = params.fetch(:limit, 100).to_i.clamp(1, 100)
+        offset = [params[:offset].to_i, 0].max
+        render json: { status: "OK", data: found[offset, limit] || [],
+                       pagination: { limit: limit, offset: offset, total: found.size } }
+      end
+
+      def message
+        db = store.read
+        found = db.message(params[:handle]) or refuse!(404, "Message not found")
+        render json: { status: "OK", data: Payloads.message(found, db.conversations[found["conversation_id"]]) }
+      end
+
+      def delete_message
+        deleted = store.write { |db| db.messages.delete(params[:handle]) }
+        refuse!(404, "Message not found") unless deleted
+
+        render json: { status: "OK", message: "Message deleted" }
+      end
+
+      def missing
+        refuse!(404, "pocket_phone does not fake #{request.method} #{request.path.delete_prefix(request.script_name)} yet")
+      end
+
+      private
+
+      def store = PocketPhone.store
+
+      def remember_base_url
+        PocketPhone.base_url = request.base_url
+      end
+
+      # Sendblue wants both keys on every call. With none configured here any
+      # pair will do, so long as the client sent one.
+      def require_credentials
+        key = request.headers["sb-api-key-id"].to_s
+        secret = request.headers["sb-api-secret-key"].to_s
+        expected_key = PocketPhone.config.api_key_id
+        expected_secret = PocketPhone.config.api_secret
+        valid = key.present? && secret.present? &&
+                (expected_key.nil? || expected_key.to_s == key) &&
+                (expected_secret.nil? || expected_secret.to_s == secret)
+        refuse!(401, "Missing or invalid `sb-api-key-id` / `sb-api-secret-key` headers.") unless valid
+      end
+
+      def refuse!(status, message, extra = {})
+        raise Refusal.new(status, { "status" => "ERROR", "message" => message, "error_message" => message }.merge(extra))
+      end
+
+      def recipient!(value)
+        refuse!(400, "You must specify a `number` in the request body.") if value.blank?
+        refuse!(400, "`#{value}` is not a valid E.164 phone number (for example +19998887777).") unless
+          Numbers.valid?(value)
+
+        value.to_s
+      end
+
+      def line!
+        value = params[:from_number]
+        refuse!(400, "You must specify a `from_number` in the request body.") if value.blank?
+        refuse!(400, "`from_number` must be an E.164 phone number on your account.") unless
+          value.to_s.match?(Numbers::E164)
+
+        value.to_s
+      end
+
+      def message_body!
+        card = params[:app_card].presence && params[:app_card].to_unsafe_h
+        if params[:content].blank? && params[:media_url].blank? && card.nil?
+          refuse!(400, "You must specify `content`, a `media_url` or an `app_card`.")
+        end
+        refuse!(400, "An `app_card` cannot be combined with `media_url`.") if card && params[:media_url].present?
+
+        { "content" => params[:content].to_s, "media_url" => params[:media_url].presence,
+          "send_style" => params[:send_style].presence, "app_card" => card }
+      end
+
+      def outbound(line, attrs)
+        attrs = attrs.merge("direction" => "app", "from_number" => line, "status" => "QUEUED",
+          "status_callback" => params[:status_callback].presence,
+          "request" => request.request_parameters.except("format"))
+        return attrs unless attrs["outcome"] == "rejected"
+
+        # Sendblue answers 200 with status ERROR when it refuses a send, so
+        # the HTTP status alone does not say whether a message went out.
+        attrs.merge("status" => "ERROR", "error_code" => BLOCKED,
+          "error_message" => "This number cannot be messaged (simulated by pocket_phone)")
+      end
+
+      def carry(message)
+        return if message["status"] == "ERROR"
+
+        Carrier.deliver_to_phone(message["handle"])
+        Carrier.fetch_preview(message["handle"])
+      end
+
+      def single_emoji?(text)
+        text.match?(/\A\X\z/) && text.match?(/\p{Emoji}/) && !text.match?(/\A[0-9#*]\z/)
+      end
+
+      def media_url_for(name)
+        "#{request.base_url}#{request.script_name}/media/#{name}"
+      end
+    end
+  end
+end

data/app/controllers/pocket_phone/application_controller.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+module PocketPhone
+  class ApplicationController < ActionController::Base
+    protect_from_forgery with: :exception
+    layout "pocket_phone/application"
+
+    # The page carries its own inline styles and script, like letter_opener_web;
+    # a host app's policy written for its own pages would block both.
+    content_security_policy(false) if respond_to?(:content_security_policy)
+
+    before_action :remember_base_url
+
+    private
+
+    def store = PocketPhone.store
+
+    def remember_base_url
+      PocketPhone.base_url = request.base_url
+    end
+
+    # The line a phone texts when it starts the conversation: the one the app
+    # is configured with, else one the app has already sent from.
+    def default_line(database)
+      Numbers.normalize(PocketPhone.config.from_number).presence ||
+        database.lines.keys.first || PocketPhone::FALLBACK_LINE
+    end
+
+    def media_url_for(name)
+      "#{request.base_url}#{request.script_name}/media/#{name}"
+    end
+  end
+end