Add custom sms provider #558

mamousavi · 2022-07-21T18:55:26Z

What kind of change does this PR introduce?

Add support for using a custom SMS gateway to send out OTPs.

What is the current behavior?

Does not support custom gateways.

What is the new behavior?

By changing the following env variables, users will be able to send out OTPs through a custom SMS gateway:

GOTRUE_SMS_PROVIDER=gateway
GOTRUE_SMS_GATEWAY_URL=<gateway_url>
GOTRUE_SMS_GATEWAY_SENDER=<sender_number>
GOTRUE_SMS_GATEWAY_BEARER_TOKEN=<token>

Implementation will send the following to the SMS gateway:

{
  "recipient": "+1 234 567",
  "body": "This is from supabase. Your code is 123456 .",
  "sender": "<sender_number>"
}

Implementation will only consider the HTTP code returned from the SMS gateway; it ignores the rest of the response (e.g., response body and response type).

Additional context

Since it's impossible to support all SMS providers, user should be able to set up their custom SMS gateway for gotrue to send out OTPs.
Implementation mainly follows the set up custom SMS gateway guide from Auth0.
Closes Using custom (Unlimited) SMS Provider for sending OTP #385

J0 · 2022-07-22T07:26:08Z

Hey @mamousavi,

Thanks for the PR! Let us know if you need any help with this

Joel

mamousavi · 2022-07-22T07:30:54Z

Hey @J0,
Glad I could help. I believe it's done.

kangmingtay · 2022-07-22T07:49:10Z

@mamousavi thanks for the PR! Unfortunately, this wouldn't work because other SMS providers might have different API specifications for sending SMSes. Take Vonage for example, it requires the ApiKey and ApiSecret.

mamousavi · 2022-07-22T07:51:52Z

@kangmingtay that's exactly right, hence the name "custom". Ideally users need to wrap their preferred provider in their own endpoint.

mamousavi · 2022-07-22T07:54:41Z

@kangmingtay The default providers are not affordable for many developers in some countries. Plus Auth0 supports using a custom sms gateway which this PR was inspired by.

hf · 2022-07-25T08:39:26Z

Hey @mamousavi, this is a great PR!

We've been thinking about adding more general webhook capabilities to GoTrue, and this is a good first start. Would you mind using terms like WEBHOOK_SMS to align more closely with this strategy of ours?

For example, call the env. vars. something like WEBHOOK_SMS_URL and WEBHOOK_SMS_HEADERS. I'd personally prefer using a headers-type of environment variable to include any non-basic authorization to the URL, as this is a more flexible solution. I'd go with a JSON structure for it, with this TypeScript type for reference:

{
  [header: string]: string | string[]
}

So in your case, adding the Authorization header would look like:

{
  "Authorization": "Bearer <...>"
}

One really important piece that is missing from this is a way to authenticate GoTrue at the receiving service. Typically this is done by exchanging some sort of secret where GoTrue computes an HMAC value and adds it to the headers of the request. A good approach is Stripe's.

Also, we really appreciate tests so if you could add them that would be splendid!

mamousavi · 2022-07-25T09:56:35Z

Hey @hf thanks for the comment.
As a matter of fact, I'd prefer to add this as a new webhook event; I just thought It'd be easier to implement it this way since Auth0 already features the exact same thing.
Actually, this is my first time writing go and I just followed similar PRs; If you want to make it a webhook event, please go ahead and close this, I'd really appreciate it.

mamousavi · 2022-07-25T10:37:32Z

@hf In the current approach, the gateway is not supposed to be a webhook endpoint in the first place. Users might want to use the same gateway in their own microservices. There's no need for gotrue to sign the requests.

hf

Please also add tests for your custom provider!

hf · 2022-08-24T11:19:32Z

api/sms_provider/custom.go

+	body, err := json.Marshal(map[string]string{
+		"recipient": phone,
+		"body":      message,
+		"sender":    t.Config.Sender,
+	})
+	if err != nil {
+		return err
+	}
+
+	client := &http.Client{Timeout: defaultTimeout}
+	r, err := http.NewRequest("POST", t.Config.Url, bytes.NewBuffer(body))
+	if err != nil {
+		return err
+	}
+	r.Header.Add("Content-Type", "application/json")
+	if len(t.Config.BearerToken) > 0 {
+		r.Header.Add("Authorization", "Bearer "+t.Config.BearerToken)
+	}
+	res, err := client.Do(r)
+	if err != nil {
+		return err
+	}
+
+	if res.StatusCode/100 != 2 {
+		return fmt.Errorf("Unexpected response while calling the SMS gateway: %v", res.StatusCode)
+	}
+
+	return nil


I would suggest using a more generic approach here as mentioned in one of the previous comments. Instead of specifying an Authorization header specifically, it is better and more flexible in my opinion to set any headers that you may need -- like API keys or other special values.

Furthermore, I don't see the need for the "sender" field. You only need to post the message and recipient phone number.

Finally, please handle HTTP errors and redirects correctly. For example, if the URL returns a 301 response, what happens? What's the timeout?

I just followed the guide from Auth0 which covers most use cases. It's not a matter of opinion; It's best we KISS.

Finally, please handle HTTP errors and redirects correctly. For example, if the URL returns a 301 response, what happens? What's the timeout?

It returns an error for any non-2xx response similar to the twilio provider. Also it uses the predefined timeout similar to all external providers.

api/sms_provider/sms_provider.go

hf · 2022-08-24T11:21:02Z

example.env

+GOTRUE_SMS_CUSTOM_SENDER=""
+GOTRUE_SMS_CUSTOM_BEARER_TOKEN=""


SENDER is not necessary IMO, while the BEARER_TOKEN should be replaced with a JSON-like map that sets various headers on the request (not just Authorization).

I know SENDER is not necessary but supplying it aligns better with other provider configurations.

mamousavi · 2022-08-24T13:22:13Z

I can't find any sms provider tests for reference.

hadi-codes · 2022-09-14T16:08:33Z

any updates?

sahalMoidu · 2023-08-13T14:24:32Z

@mamousavi @hf will this PR be merged and released any time soon?

rokk4 · 2023-08-20T11:05:37Z

I am willing to take care if this. I need this very urgently and I kinda don't want to maintain a fork.
@mamousavi @hf will this be merged soon?

abdirahmn1 · 2023-08-21T14:22:13Z

any updates? i reaaaaaaaaaaaally need this asap! and just like @rokk4 it will be tedious to maintain a fork, also i want to use the supabase platform instead of hosting said fork myself. Thanks to all the maintainers, all of your efforts are appreciated. 🤝

J0 · 2023-08-21T19:22:21Z

Hey @abdirahmn1 and team,

Thanks for patiently waiting and for taking the time to put together this PR. I'm really sorry to be the bearer of bad news but we're unlikely going to move forward with this PR as we'll be pursuing a hook based approach. The hope is that there'll be more room for flexibility in terms of SMS (e.g. dynamically select senders) with the hook since developers can modify code within the hook. Custom SMS Providers is on the top of our priority list and discussion is underway. We'll have more updates to share soon.

In the meantime, please let us know if there are any questions or concerns. Thanks!

abdirahmn1 · 2023-08-21T20:26:33Z

Hey @abdirahmn1 and team,

Thanks for patiently waiting and for taking the time to put together this PR. I'm really sorry to be the bearer of bad news but we're unlikely going to move forward with this PR as we'll be pursuing a hook based approach. The hope is that there'll be more room for flexibility in terms of SMS (e.g. dynamically select senders) with the hook since developers can modify code within the hook. Custom SMS Providers is on the top of our priority list and discussion is underway. We'll have more updates to share soon.

In the meantime, please let us know if there are any questions or concerns. Thanks!

Thanks @J0 for taking the time, is there a timeline for when this feature will be published?, if not, can you please give me a rough estimate and your opinion of when you think it might be available. Take care and stay safe 😊.

rohankm · 2024-01-23T17:30:26Z

Hi, when will these feature be merged ?

J0 · 2024-02-21T06:23:42Z

Thanks @J0 for taking the time, is there a timeline for when this feature will be published?, if not, can you please give me a rough estimate and your opinion of when you think it might be available. Take care and stay safe 😊.

We aim to merge support before the end of March, likely sooner. Going to close for now Let us know if there are further concerns.

Thanks everyone for the contribution!

h8f1z · 2024-04-03T14:07:10Z

@J0 March has ended. What's the update?

J0 · 2024-04-03T23:10:24Z

Ah thanks for patiently waiting. We’ve merged support in #1474 . Docs will follow within the next 2 weeks

h8f1z · 2024-06-22T20:38:35Z

Ah thanks for patiently waiting. We’ve merged support in #1474 . Docs will follow within the next 2 weeks

Why can't I still see the option to choose custom SMS provider on Supabase Auth Providers?
Does this change only apply to self-hosted Supabase?

mamousavi added 2 commits July 21, 2022 23:05

Add custom sms provider

aa75140

Change request body format to json

70545b1

kangmingtay closed this Jul 22, 2022

kangmingtay reopened this Jul 22, 2022

mamousavi added 3 commits July 22, 2022 23:04

Rename ACCESS_TOKEN to BEARER_TOKEN

f7574f9

Add request context to README.md

f2d17d1

Add response context to README.md

61deaa0

mamousavi mentioned this pull request Aug 19, 2022

Using custom (Unlimited) SMS Provider for sending OTP #385

Closed

myemuk mentioned this pull request Aug 24, 2022

Limit sms per phone number #605

Closed

hf reviewed Aug 24, 2022

View reviewed changes

Rename custom to gateway

24c75d1

mamousavi requested a review from hf August 26, 2022 11:14

Merge branch 'supabase:master' into custom_sms_provider

fe9eb0f

mamousavi requested a review from a team as a code owner September 28, 2022 19:04

Add test for custom sms provider

4562f53

Thore1954 mentioned this pull request Feb 5, 2023

feat: add sms provider sendblue #922

Closed

mamousavi added 3 commits February 11, 2023 12:01

Merge branch 'master' into custom_sms_provider

37d1e84

Merge branch 'master' into custom_sms_provider

2183541

Merge branch 'master' into custom_sms_provider

5f6105d

abdirahmn1 mentioned this pull request Aug 22, 2023

Adds new sms provider Africa's Talking #1217

Closed

J0 closed this Feb 21, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add custom sms provider #558

Add custom sms provider #558

mamousavi commented Jul 21, 2022 •

edited

Loading

J0 commented Jul 22, 2022 •

edited

Loading

mamousavi commented Jul 22, 2022

kangmingtay commented Jul 22, 2022

mamousavi commented Jul 22, 2022

mamousavi commented Jul 22, 2022 •

edited

Loading

hf commented Jul 25, 2022

mamousavi commented Jul 25, 2022 •

edited

Loading

mamousavi commented Jul 25, 2022 •

edited

Loading

hf left a comment

hf Aug 24, 2022

mamousavi Aug 24, 2022 •

edited

Loading

mamousavi Aug 24, 2022 •

edited

Loading

hf Aug 24, 2022

mamousavi Aug 25, 2022

mamousavi commented Aug 24, 2022

hadi-codes commented Sep 14, 2022

sahalMoidu commented Aug 13, 2023

rokk4 commented Aug 20, 2023

abdirahmn1 commented Aug 21, 2023

J0 commented Aug 21, 2023

abdirahmn1 commented Aug 21, 2023

rohankm commented Jan 23, 2024

J0 commented Feb 21, 2024

h8f1z commented Apr 3, 2024

J0 commented Apr 3, 2024 •

edited

Loading

h8f1z commented Jun 22, 2024

		GOTRUE_SMS_CUSTOM_SENDER=""
		GOTRUE_SMS_CUSTOM_BEARER_TOKEN=""

Add custom sms provider #558

Add custom sms provider #558

Conversation

mamousavi commented Jul 21, 2022 • edited Loading

What kind of change does this PR introduce?

What is the current behavior?

What is the new behavior?

Additional context

J0 commented Jul 22, 2022 • edited Loading

mamousavi commented Jul 22, 2022

kangmingtay commented Jul 22, 2022

mamousavi commented Jul 22, 2022

mamousavi commented Jul 22, 2022 • edited Loading

hf commented Jul 25, 2022

mamousavi commented Jul 25, 2022 • edited Loading

mamousavi commented Jul 25, 2022 • edited Loading

hf left a comment

Choose a reason for hiding this comment

hf Aug 24, 2022

Choose a reason for hiding this comment

mamousavi Aug 24, 2022 • edited Loading

Choose a reason for hiding this comment

mamousavi Aug 24, 2022 • edited Loading

Choose a reason for hiding this comment

hf Aug 24, 2022

Choose a reason for hiding this comment

mamousavi Aug 25, 2022

Choose a reason for hiding this comment

mamousavi commented Aug 24, 2022

hadi-codes commented Sep 14, 2022

sahalMoidu commented Aug 13, 2023

rokk4 commented Aug 20, 2023

abdirahmn1 commented Aug 21, 2023

J0 commented Aug 21, 2023

abdirahmn1 commented Aug 21, 2023

rohankm commented Jan 23, 2024

J0 commented Feb 21, 2024

h8f1z commented Apr 3, 2024

J0 commented Apr 3, 2024 • edited Loading

h8f1z commented Jun 22, 2024

mamousavi commented Jul 21, 2022 •

edited

Loading

J0 commented Jul 22, 2022 •

edited

Loading

mamousavi commented Jul 22, 2022 •

edited

Loading

mamousavi commented Jul 25, 2022 •

edited

Loading

mamousavi commented Jul 25, 2022 •

edited

Loading

mamousavi Aug 24, 2022 •

edited

Loading

mamousavi Aug 24, 2022 •

edited

Loading

J0 commented Apr 3, 2024 •

edited

Loading