fix(api): keep a deferral while the phone gate state is unknown (#2554)

fluxer_api/src/api/auth/tests/DeferredPhoneGate.test.ts

@@ -632,6 +632,8 @@ describe('Deferred phone verification gate', () => {
 			await configurePhoneGate({deferred_phone_gate_window_hours: 0.0001});
 			const outsideWindow = await createGuildWithInvite(harness);
 			await addFillerMember(outsideWindow.inviteCode);
+			const beforeJoin = await readFlags(subject.userId);
+			expect(beforeJoin & DEFERRED_PHONE_ON_COMMUNITY_JOIN).not.toBe(0);
 			await createBuilder(harness, subject.token).post(`/invites/${outsideWindow.inviteCode}`).expect(200).execute();
 
 			const flags = await readFlags(subject.userId);

fluxer_api/src/api/risk/DeferredPhoneGateCache.ts

@@ -1,6 +1,10 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 
-let cachedEnabled = false;
+// Null until a policy has actually been read. A deferral is only ever granted
+// while the gate is on, so reading "not known yet" as "off" revokes it from every
+// account holding one and answers their next request with the phone requirement
+// the deferral exists to hold back.
+let cachedEnabled: boolean | null = null;
 
 export function resolveDeferredPhoneGateEnabled(policy: {
 	deferred_phone_gate_enabled: boolean;
@@ -9,7 +13,7 @@ export function resolveDeferredPhoneGateEnabled(policy: {
 	return policy.deferred_phone_gate_enabled && !policy.single_community_enabled;
 }
 
-export function getCachedDeferredPhoneGateEnabled(): boolean {
+export function getCachedDeferredPhoneGateEnabled(): boolean | null {
 	return cachedEnabled;
 }
 

fluxer_api/src/api/user/UserHelpers.ts

@@ -134,7 +134,7 @@ function suppressDeferredPhoneFlags(rawFlags: number): number {
 	if ((rawFlags & DEFERRED_PHONE_ON_COMMUNITY_JOIN) === 0) {
 		return rawFlags;
 	}
-	if (!getCachedDeferredPhoneGateEnabled()) {
+	if (getCachedDeferredPhoneGateEnabled() === false) {
 		return rawFlags & ~DEFERRED_PHONE_ON_COMMUNITY_JOIN;
 	}
 	return rawFlags & ~DEFERRABLE_PHONE_FLAGS;