fix(triggers): attach Twilio auth fields to both triggers so status callbacks are verified

The Account SID / Auth Token fields were only on the primary trigger, so
deploying twilio_sms_status alone never captured authToken into providerConfig
and signature verification was silently skipped. Following the incident.io /
Rootly / RevenueCat pattern, the auth fields are now added to each trigger
conditioned on its own selectedTriggerId; the shared inner subBlock IDs keep the
values persisted across trigger types.

Author: waleedlatif1

apps/sim/triggers/twilio/sms-received.ts

@@ -21,7 +21,7 @@ export const twilioSmsReceivedTrigger: TriggerConfig = {
     triggerOptions: twilioSmsTriggerOptions,
     includeDropdown: true,
     setupInstructions: twilioSmsReceivedInstructions(),
-    extraFields: buildTwilioSmsAuthFields(),
+    extraFields: buildTwilioSmsAuthFields('twilio_sms_received'),
   }),
 
   outputs: buildTwilioSmsOutputs(),

apps/sim/triggers/twilio/sms-status.ts

@@ -1,6 +1,7 @@
 import { TwilioIcon } from '@/components/icons'
 import { buildTriggerSubBlocks } from '@/triggers'
 import {
+  buildTwilioSmsAuthFields,
   buildTwilioSmsOutputs,
   twilioSmsStatusInstructions,
   twilioSmsTriggerOptions,
@@ -19,6 +20,7 @@ export const twilioSmsStatusTrigger: TriggerConfig = {
     triggerId: 'twilio_sms_status',
     triggerOptions: twilioSmsTriggerOptions,
     setupInstructions: twilioSmsStatusInstructions(),
+    extraFields: buildTwilioSmsAuthFields('twilio_sms_status'),
   }),
 
   outputs: buildTwilioSmsOutputs(),

apps/sim/triggers/twilio/utils.ts

@@ -1,23 +1,21 @@
 import type { SubBlockConfig } from '@/blocks/types'
 import type { TriggerOutput } from '@/triggers/types'
 
-/** All Twilio SMS trigger IDs, used to share auth fields across both triggers. */
-export const TWILIO_SMS_TRIGGER_IDS = ['twilio_sms_received', 'twilio_sms_status'] as const
-
 export const twilioSmsTriggerOptions = [
   { label: 'SMS Received', id: 'twilio_sms_received' },
   { label: 'Message Status', id: 'twilio_sms_status' },
 ]
 
 /**
- * Shared Account SID + Auth Token fields. Rendered only by the primary trigger
- * (with a condition covering both trigger IDs) so the fields are not duplicated
- * when both triggers' subBlocks are spread into the block.
+ * Account SID + Auth Token fields, used to verify the `X-Twilio-Signature`
+ * header. Added to each trigger (conditioned on its own `selectedTriggerId`) so
+ * the values are captured into `providerConfig` whichever trigger is deployed —
+ * the inner subBlock IDs stay shared so the values persist across trigger types.
  */
-export function buildTwilioSmsAuthFields(): SubBlockConfig[] {
+export function buildTwilioSmsAuthFields(triggerId: string): SubBlockConfig[] {
   const condition = {
     field: 'selectedTriggerId',
-    value: [...TWILIO_SMS_TRIGGER_IDS],
+    value: triggerId,
   }
   return [
     {