[CLOSED] Test user credentials in Appwrite

[wooden depot]

in appwrite cloud?

[marble jay]

Sorry I don't understand your question. What do you mean by fixed otp?

[wooden depot]

when you submit app in google play store , we have to provide a account so that they can watch our app , in mobile authentication with otp , how we will pass any my mobile number with reusable fixed otp so that they can login without asking me for otp . like firebase give this feature . you can set any fixed otp to any number . How will i achieve this in appwrite.

[marsh goblet]

Why don't you simply create one and provide them with the login details?

[neon hatch]

It's not a requirement, you can offer (if your app has) alternative login methods, so by sharing a password and email you should be fine

[wooden depot]

i have only mobile with otp login system , so i have to give mobile number and fixed otp

because my app get rejected because of this

we have to give more login method to achieve this?

[limber pebble]

I used an app with login in with OTP only

Just provide a note that you can use any phone and login will be created

I passed both apple and Google Play logins

[wooden depot]

yes you r right

but my app rejected before just because any user can not access my paid content , and google play console account wants a login credential that can access all paid content without purchasing it , for this i have to give a phone in which all content should show without any purchase.

[neon hatch]

What kind of paid content is it?

You could just give a code

A referrals code

[wooden depot]

i am creating educational course , so i sell course on app

by referal code i have to make such system so that by that code content is free, right?

[idle remnant]

you can just use a function for the app's auth process, instead of directly using createPhoneSession.

In the function, check if the number input by the user is something like 111-111-111. If it is, accept the 1234 otp, and create a session for that user

If the number is not the preset one, just run the normal phone auth flow

Not too tough to implement

[neon hatch]

Yes. Also as far as I know Google requires to use their payment system for in app content

[wooden depot]

its not compulsary , otherwise no one will sell course through google because of expensive charge , every body use razorpay , i also used that , i have used in almost 40 apps , all are in firebase , so it accepted through fixed otp

[wooden depot]

but its make my auth to run slow , because of extra layer , and for this we have to modify many code to get that

[idle remnant]

it really shouldn't affect your auth flow slower

[wooden depot]

and i will suggest appwrite to give this feature in future , because its compulsary for every app who use mobile auth , like firebase

[idle remnant]

it's just a simple check. if it's the test number, accept the fixed otp, and create a session .

if it isn't fixed number, exit the function

it should add hardly 20-40ms which is not at all noticeable

[wooden depot]

yes but if you think about 10k user login per day , it will cost noticable extra bandwidth by running this function.

[idle remnant]

why?

those 10k users don't even need to use the functio

maybe i phrase it wrong

see

in your code, when the user clicks the login button after inputting their number, a function is called right?

a local function, not an appwrite function

[wooden depot]

so for this i have to make it in client side?

[idle remnant]

in this local function, you must be sending the phone number to createPhoneVerification right?

Instead of directly doing this, just check if the entered number is your test number

[wooden depot]

i was thinking about cloudfunction

[idle remnant]

if it is, move them to the next screen and ask for otp, and accept the preset otp

if the number is not the test number, do the actual verification

[idle remnant]

no just a normal function in your app

[wooden depot]

but then any body can see this phone and preset otp and access all paid content to free

[wooden depot]

its not safe

[idle remnant]

You can just block the number after your app is published to play store

there's a Block account button in the user's settings

[wooden depot]

i am creating application from 3 years , and i show google does not just review one time , it checks many time , even if my app is not live , so if i delete , my app will be rejected

this problem i get many times , before firebase

[wooden depot]

this solution not works for google upload

[idle remnant]

okay

then how about this

instead of doing all the logic in the local function, just check if the number is a test number. If it is, create the session with OTP in your cloud function

This way, your OTP will not be visible on the client side.

if the number isn't a test number, do the normal flow.

Are you using flutter or java/kotlin?

Regardless of the framework, are you familiar with tree-shaking?

[wooden depot]

i used kotlin and flutter , but right now my app is in kotlin

[idle remnant]

.

[wooden depot]

no , heard this first time , but if this can solve my problem , i will learn about this

[idle remnant]

https://developer.android.com/build/shrink-code

This is a very common practice in mobile development. Read up on it

[wooden depot]

this is not fully secure , there is way to reverse this process

[idle remnant]

What's this process?

[wooden depot]

shrinking code

[idle remnant]

I'm askign what's the process to reverse?

[wooden depot]

i dont know , but reverse engineer can do it

[idle remnant]

Shubham it seems like you're trying to acheive the impossible.

[wooden depot]

i think this is better approach

[idle remnant]

Hacking is always a possibility

An app or website is never 100% secure

It's just harder to get into

[wooden depot]

i know , no body can fully. secure application

[idle remnant]

Exactly.

So you shouldn't be looking to do this - make hacking impossible

[wooden depot]

but its my work to atleast check all , that i can think its easy

[idle remnant]

It is easy, but it looks like you want 100% security. This is virtually impossible 😅

[wooden depot]

yes but we can make the layer so that normal hacker can not do this

[idle remnant]

The mthod I suggested, of sending the mobile number and and otp on cloud function is as good as it can get

At least for now.

[wooden depot]

i know it , even big platform like udemy and courseera app data leak

[wooden depot]

yes this is better approach

Actually i have planned to move completely from firebase and django to appwrite

so in migrating , i have lots of problem , and i have to ask every question

[idle remnant]

that's absolutely okay