[webhooks] include MMS support #131
Conversation
Deploying docs with
|
| Latest commit: |
51d3f8f
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://e01e21a7.docs-7wm.pages.dev |
| Branch Preview URL: | https://webhooks-include-mms-support.docs-7wm.pages.dev |
WalkthroughAdds MMS webhook support and payload examples; expands webhook FAQ with HTTPS/local‑network, self‑signed cert migration, RCS guidance, and local‑development warnings; reforms headings to emoji‑prefixed style; updates multi‑device docs with API links and a device‑removal warning; updates index to mention MMS. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
participant Sender as External Sender
participant Carrier as Carrier Network
participant Device as Android Device
participant App as Gateway App
participant Webhook as Customer Webhook
Sender->>Carrier: Send MMS
Carrier->>Device: Deliver MMS (PDU + attachment refs)
Device->>App: System delivers RECEIVE_MMS intent
App->>App: Verify RECEIVE_MMS permission, parse MMS metadata
App->>Webhook: POST "mms:received" (metadata payload)
Webhook-->>App: 2xx / non‑2xx response
note over App,Webhook: Non‑2xx triggers existing webhook retry policy
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
docs/features/webhooks.md (1)
320-328: Use constant‑time comparison in Node.js example.Switch to crypto.timingSafeEqual to match the “Best Practices” guidance and prevent timing attacks.
- function verifySignature(secretKey, payload, timestamp, signature) { - const message = payload + timestamp; - const expectedSignature = crypto - .createHmac('sha256', secretKey) - .update(message) - .digest('hex'); - - return expectedSignature === signature; - } + function verifySignature(secretKey, payload, timestamp, signature) { + const message = payload + timestamp; + const expected = crypto + .createHmac('sha256', secretKey) + .update(message) + .digest('hex'); + // Compare in constant time + const a = Buffer.from(expected, 'hex'); + const b = Buffer.from(signature, 'hex'); + if (a.length !== b.length) return false; + return crypto.timingSafeEqual(a, b); + }
🧹 Nitpick comments (8)
docs/index.md (1)
24-26: Keep MMS phrasing consistent with FAQ (metadata-only).Add a short parenthetical so the feature list aligns with the FAQ and the webhooks page.
-- 🔔 **Real-time incoming message notifications:** Receive instant notifications for incoming SMS and MMS messages via webhook. +- 🔔 **Real-time incoming message notifications:** Receive instant notifications for incoming SMS and MMS messages via webhook. - 📱 **Multimedia message support:** Handle MMS messages with attachments (images, videos, documents) through dedicated webhooks. + (Attachments are not included in webhook payloads; metadata only.)docs/features/multi-device.md (2)
9-9: Grammar nit: pluralize “trusted device”.- Use this method for trusted device, which will have full access to the account. + Use this method for trusted devices, which will have full access to the account.
60-82: Strengthen the deletion warning.Consider stating irreversibility to avoid accidental data loss.
!!! danger "Device Removal Warning" - Deleting a device will remove all associated messages, including pending ones. + Deleting a device will remove all associated messages, including pending ones. This action cannot be undone.docs/features/webhooks.md (2)
16-22: Fix nested list indentation to satisfy MD007 (ul-indent).Current field bullets are indented by 4 spaces; expected is 2. This will quiet markdownlint and render more consistently.
- - `messageId`: Content-based ID - - `data`: Base64-encoded data message - - `phoneNumber`: Sender's number - - `simNumber`: SIM index (nullable) - - `receivedAt`: Local timestamp + - `messageId`: Content-based ID + - `data`: Base64-encoded data message + - `phoneNumber`: Sender's number + - `simNumber`: SIM index (nullable) + - `receivedAt`: Local timestamp @@ - - `messageId`: Carrier generated ID - - `transactionId`: Unique MMS transaction identifier - - `subject`: Message subject line (nullable) - - `size`: Attachment size in bytes - - `contentClass`: MMS content classification (nullable) - - `phoneNumber`: Sender's number - - `simNumber`: SIM index (nullable) - - `receivedAt`: Local timestamp + - `messageId`: Carrier-generated ID + - `transactionId`: Unique MMS transaction identifier + - `subject`: Message subject line (nullable) + - `size`: Attachment size in bytes + - `contentClass`: MMS content classification (nullable) + - `phoneNumber`: Sender's number + - `simNumber`: SIM index (nullable) + - `receivedAt`: Local timestampAlso applies to: 23-31
112-117: Note the naming difference: device_id (API param) vs deviceId (payload).Call this out inline to reduce confusion for integrators.
```sh title="Cloud mode example" curl -X POST -u <username>:<password> \ -H "Content-Type: application/json" \ -d '{ "url": "https://your-server.com/webhook", "event": "sms:received", "device_id": "DEVICE_ID" }' \ https://api.sms-gate.app/3rdparty/v1/webhooks ``` + + !!! note "Naming" + API request parameters use `snake_case` (e.g., `device_id`), while webhook payload fields use `camelCase` (e.g., `deviceId`).docs/faq/webhooks.md (3)
67-67: Article usage: “a self‑signed certificate”.-## :material-certificate-outline: How to use webhooks with self-signed certificate? +## :material-certificate-outline: How to use webhooks with a self-signed certificate?
102-127: Insecure build guidance is clear; minor wording polish.-3. Install following the [standard installation process](../installation.md) +3. Install using the [standard installation process](../installation.md)
157-160: Cross-reference the webhooks page for attachment details.Add a link so readers can jump to the MMS payload section.
- The webhook system provides MMS metadata but does **not** include actual attachment content. + The webhook system provides MMS metadata but does **not** include actual attachment content. + See the MMS payload example in [Webhooks > Supported Events](../features/webhooks.md#-supported-events).
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (4)
docs/faq/webhooks.md(8 hunks)docs/features/multi-device.md(3 hunks)docs/features/webhooks.md(4 hunks)docs/index.md(2 hunks)
🧰 Additional context used
🪛 LanguageTool
docs/index.md
[grammar] ~1-~1: There might be a mistake here.
Context: # 🚀 SMS Gateway for Android™
(QB_NEW_EN)
docs/features/webhooks.md
[grammar] ~1-~1: There might be a mistake here.
Context: # 🌐 Webhooks Webhooks offer a powerful mechanism to re...
(QB_NEW_EN)
[grammar] ~5-~5: There might be a mistake here.
Context: ...rom your device. ## 📩 Supported Events
(QB_NEW_EN)
[grammar] ~16-~16: There might be a mistake here.
Context: ... :material-database: sms:data-received - messageId: Content-based ID - data: Base64-...
(QB_NEW_EN)
[grammar] ~17-~17: There might be a mistake here.
Context: ...ed** - messageId: Content-based ID - data: Base64-encoded data message - `pho...
(QB_NEW_EN)
[grammar] ~18-~18: There might be a mistake here.
Context: ... - data: Base64-encoded data message - phoneNumber: Sender's number - simNumber: SIM...
(QB_NEW_EN)
[grammar] ~19-~19: There might be a mistake here.
Context: ...age - phoneNumber: Sender's number - simNumber: SIM index (nullable) - `receivedAt...
(QB_NEW_EN)
[grammar] ~20-~20: There might be a mistake here.
Context: ... - simNumber: SIM index (nullable) - receivedAt: Local timestamp - :material-multimedi...
(QB_NEW_EN)
[grammar] ~23-~23: There might be a mistake here.
Context: ... - :material-multimedia: mms:received - messageId: Carrier generated ID - `transactio...
(QB_NEW_EN)
[grammar] ~24-~24: There might be a mistake here.
Context: ... - messageId: Carrier generated ID - transactionId: Unique MMS transaction identifier ...
(QB_NEW_EN)
[grammar] ~25-~25: There might be a mistake here.
Context: ...onId: Unique MMS transaction identifier - subject`: Message subject line (nullable) - ...
(QB_NEW_EN)
[grammar] ~26-~26: There might be a mistake here.
Context: ...ubject: Message subject line (nullable) - size: Attachment size in bytes - conten...
(QB_NEW_EN)
[grammar] ~27-~27: There might be a mistake here.
Context: ...) - size: Attachment size in bytes - contentClass: MMS content classification (nullable) ...
(QB_NEW_EN)
[grammar] ~28-~28: There might be a mistake here.
Context: ...: MMS content classification (nullable) - phoneNumber: Sender's number - simNumber`: SIM...
(QB_NEW_EN)
[grammar] ~29-~29: There might be a mistake here.
Context: ...le) - phoneNumber: Sender's number - simNumber: SIM index (nullable) - `receivedAt...
(QB_NEW_EN)
[grammar] ~30-~30: There might be a mistake here.
Context: ... - simNumber: SIM index (nullable) - receivedAt: Local timestamp - 📤 **sms...
(QB_NEW_EN)
[grammar] ~154-~154: There might be a mistake here.
Context: ...ideos, or other multimedia attachments). - For sms:sent/delivered/failed: S...
(QB_NEW_EN)
docs/faq/webhooks.md
[grammar] ~30-~30: There might be a mistake here.
Context: ... with an HTTP server without encryption? Due to Android OS security requirements a...
(QB_NEW_EN)
[grammar] ~137-~137: There might be a mistake here.
Context: ...dio) ``` Verification Steps: - [ ] Check if message has multimedia atta...
(QB_NEW_EN)
[grammar] ~147-~147: There might be a mistake here.
Context: ...ed ``` Required Permissions: - [ ] SMS permission - [ ] MMS permiss...
(QB_NEW_EN)
[grammar] ~148-~148: There might be a mistake here.
Context: ... Permissions**: - [ ] SMS permission - [ ] MMS permission 3. **Webhook Registr...
(QB_NEW_EN)
docs/features/multi-device.md
[grammar] ~2-~2: There might be a mistake here.
Context: # 📱📱 Multi-Device Support The app supports multiple devices for a si...
(QB_NEW_EN)
[grammar] ~37-~37: There might be a mistake here.
Context: ...h "Continue" ## 📨 Message Distribution === ":fontawesome-solid-dice: Random Sele...
(QB_NEW_EN)
🪛 markdownlint-cli2 (0.17.2)
docs/features/webhooks.md
17-17: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
18-18: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
19-19: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
20-20: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
21-21: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
24-24: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
25-25: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
26-26: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
27-27: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
28-28: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
29-29: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
30-30: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
31-31: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
docs/faq/webhooks.md
46-46: Code block style
Expected: fenced; Actual: indented
(MD046, code-block-style)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Cloudflare Pages
🔇 Additional comments (9)
docs/index.md (1)
1-1: Title tweak LGTM.Emoji-prefixed title is fine and consistent with other pages.
docs/features/multi-device.md (3)
13-18: Verify UI labels (“Offline” → “Sign In”).Confirm these tab names match the current app UI; otherwise, update steps for accuracy.
Would you like me to open a follow-up PR once the exact labels are confirmed?
64-79: Verify external API doc links resolve.Ensure both “List Devices” and “Remove Device” documentation URLs are valid and up to date.
If you want, I can script-check these endpoints for 200/OK in CI and flag regressions.
37-58: Message Distribution examples LGTM.JSON payloads and endpoints look consistent with prior docs.
docs/features/webhooks.md (3)
154-154: Confirm the data SMS port (53739).Validate that 53739 is still the correct default port for sms:data-received; if configurable, add a note pointing to settings.
I can add a conditional note about overrides if needed.
147-149: Scope of “Webhook Registration Notification”.If the app notifies on any new webhook (not just sms:received), consider generalizing the note; otherwise, clarify that only sms:received triggers this notification.
Happy to update the copy once confirmed.
196-215: MMS payload example LGTM.Fields align with the Supported Events table and FAQ. Timestamp format and nullable fields are clear.
docs/faq/webhooks.md (2)
30-41: HTTP/HTTPS exception policy LGTM and consistent with the features page.
128-156: MMS webhook troubleshooting flow LGTM.Covers type verification, permissions, and event registration; good actionable steps.
There was a problem hiding this comment.
Actionable comments posted: 0
♻️ Duplicate comments (1)
docs/index.md (1)
7-7: Clarify MMS webhook payload scope (metadata-only, no attachments).To keep index in sync with FAQ, explicitly state that MMS webhooks carry metadata only and do not include attachment binaries.
-SMS Gateway for Android turns your Android smartphone into an SMS and MMS gateway. It's a lightweight application that allows you to send SMS messages programmatically via an API and receive webhooks on incoming SMS and MMS messages. This makes it ideal for integrating messaging functionality into your own applications or services. +SMS Gateway for Android turns your Android smartphone into an SMS and MMS gateway. It's a lightweight application that allows you to send SMS messages programmatically via an API and receive webhooks on incoming SMS and MMS messages. MMS webhooks include message metadata (subject, size, etc.) but not attachment content—see the FAQ for details on retrieving attachments. This makes it ideal for integrating messaging functionality into your own applications or services.
🧹 Nitpick comments (7)
docs/index.md (2)
24-25: Be explicit that MMS webhooks are metadata-only.Small wording tweak to prevent the common assumption that attachments are pushed via webhook.
-- 🔔 **Real-time incoming message notifications:** Receive instant notifications for incoming SMS and MMS messages via webhook. -+ 🔔 **Real-time incoming message notifications:** Receive instant notifications for incoming SMS and MMS messages via webhook. MMS webhooks carry metadata only; attachments are not delivered in the webhook. - -- 📱 **Multimedia message support:** Handle MMS messages through dedicated webhooks. +- 📱 **Multimedia message support:** Handle MMS messages via dedicated metadata-only webhooks; fetch attachments separately (see FAQ).
26-26: Fix misleading phrasing about “reading” past messages via webhooks.Webhooks are push; accessing previously received messages is typically via an API endpoint, not “the same webhook system.”
-- 📖 **Read received messages:** Access [previously received messages](./features/reading-messages.md) using the same webhook system used for real-time notifications. +- 📖 **Read received messages:** Access [previously received messages](./features/reading-messages.md) via the API (history endpoints), complementing real-time webhook notifications.docs/faq/webhooks.md (5)
30-57: Tighten local‑dev HTTPS guidance with concrete commands.Great section. Consider adding explicit examples for ADB reverse and a tunnel command so users can succeed faster.
2. **Localhost with Reverse Port Forwarding** - Use `127.0.0.1` with ADB reverse port forwarding to access local servers + Use `127.0.0.1` with ADB reverse port forwarding to access local servers: + ```bash + # Forward device port 9876 to your machine's localhost:9876 + adb reverse tcp:9876 tcp:9876 + # Your webhook URL on device can be: http://127.0.0.1:9876/webhooks + ``` @@ 3. **Secure Tunnels** - Services like [Cloudflare Tunnel](https://www.cloudflare.com/products/tunnel/) or [ngrok](https://ngrok.com/) provide HTTPS endpoints for local servers + Services like [Cloudflare Tunnel](https://www.cloudflare.com/products/tunnel/) or [ngrok](https://ngrok.com/) provide HTTPS endpoints for local servers: + ```bash + # Example with Cloudflare Tunnel + cloudflared tunnel --url http://localhost:9876 + # Example with ngrok + ngrok http http://localhost:9876 + ```
67-77: Specify deprecation version/date for self‑signed cert removal.“Removed in version 2.x” is vague. Pin the exact version (e.g., 2.0.0) and, if possible, add an ETA or release date to set expectations.
128-156: Solid MMS troubleshooting; add cross‑links to event and payload docs.Link directly to the
mms:receivedevent and payload example in the Webhooks feature page to close the loop.-## :material-multimedia: Why isn't my MMS webhook triggering? +## :material-multimedia: Why isn't my MMS webhook triggering? +See the [`mms:received` event and payload](../features/webhooks.md#mmsreceived) for reference.
157-160: Point to attachment retrieval guidance.Since attachments aren’t in the webhook, add where to fetch them (API/docs anchor) to reduce support churn.
- The webhook system provides MMS metadata but does **not** include actual attachment content. + The webhook system provides MMS metadata but does **not** include actual attachment content. + See how to retrieve MMS attachments from the device/API in [Webhooks → MMS](../features/webhooks.md#mmsreceived) or the dedicated MMS retrieval guide.
1-170: Resolve markdownlint MD046 by ensuring all code samples are fenced.The linter flagged an “indented” code block around the “Solutions for Local Networks” area. Scan and convert any indented code to fenced triple‑backticks with a language hint.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (3)
docs/faq/webhooks.md(8 hunks)docs/features/multi-device.md(4 hunks)docs/index.md(2 hunks)
🧰 Additional context used
🪛 LanguageTool
docs/faq/webhooks.md
[grammar] ~30-~30: There might be a mistake here.
Context: ... with an HTTP server without encryption? Due to Android OS security requirements a...
(QB_NEW_EN)
[grammar] ~137-~137: There might be a mistake here.
Context: ...dio) ``` Verification Steps: - [ ] Check if message has multimedia atta...
(QB_NEW_EN)
[grammar] ~147-~147: There might be a mistake here.
Context: ...ed ``` Required Permissions: - [ ] SMS permission - [ ] MMS permiss...
(QB_NEW_EN)
[grammar] ~148-~148: There might be a mistake here.
Context: ... Permissions**: - [ ] SMS permission - [ ] MMS permission 3. **Webhook Registr...
(QB_NEW_EN)
docs/features/multi-device.md
[grammar] ~2-~2: There might be a mistake here.
Context: # 📱📱 Multi-Device Support The app supports multiple devices for a si...
(QB_NEW_EN)
[grammar] ~37-~37: There might be a mistake here.
Context: ...h "Continue" ## 📨 Message Distribution === ":fontawesome-solid-dice: Random Sele...
(QB_NEW_EN)
docs/index.md
[grammar] ~1-~1: There might be a mistake here.
Context: # 🚀 SMS Gateway for Android™
(QB_NEW_EN)
🪛 markdownlint-cli2 (0.17.2)
docs/faq/webhooks.md
46-46: Code block style
Expected: fenced; Actual: indented
(MD046, code-block-style)
🔇 Additional comments (3)
docs/features/multi-device.md (3)
39-47: Example looks good; curl --json usage is correct.The payload and flags are clear and copy/paste-friendly.
80-82: Good, high‑impact warning about device deletion side effects.Clear and actionable; thanks for calling out irreversible message removal.
54-56: No changes needed:deviceIdis correct for the multi-device send APIThe parameter casing in this section aligns with the rest of the send-message and read-message endpoints, which uniformly use camelCase
deviceId. The only places where snake_casedevice_idappears are in webhook‐registration calls (e.g. in docs/features/webhooks.md and docs/faq/webhooks.md), where the API explicitly expectsdevice_id. Since multi-device messages are sent via the messages API (not the webhook-registration endpoint), leavingdeviceIdhere is correct.
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (1)
docs/index.md (1)
7-7: Clarify MMS webhook payloads (metadata-only; no attachments).To prevent developer confusion, explicitly state that MMS webhooks do not include attachment binaries. This aligns the index with the detailed Webhooks and FAQ pages and a prior review note.
Apply this diff:
-SMS Gateway for Android turns your Android smartphone into an SMS and MMS gateway. It's a lightweight application that allows you to send SMS messages programmatically via an API and receive webhooks on incoming SMS and MMS messages. This makes it ideal for integrating messaging functionality into your own applications or services. +SMS Gateway for Android turns your Android smartphone into an SMS and MMS gateway. It's a lightweight application that allows you to send SMS messages programmatically via an API and receive webhooks on incoming SMS and MMS messages. MMS webhooks include message metadata (e.g., subject, size, media count) but do not include attachment content. See the [Webhooks](./features/webhooks.md) and [Webhook FAQ](./faq/webhooks.md) for details.If the product already supports sending MMS via API, consider this optional tweak as well:
-...allows you to send SMS messages programmatically via an API... +...allows you to send SMS and MMS messages programmatically via an API...Can you confirm whether MMS sending via API is GA? If yes, we should adopt the optional tweak; otherwise we’ll keep “SMS” only. I can sweep the repo to verify references if helpful.
🧹 Nitpick comments (3)
docs/index.md (3)
24-24: Note that MMS webhook payloads are metadata-only in the notifications bullet.Small tweak to avoid implying attachments are pushed via webhooks.
Apply this diff:
-- 🔔 **Real-time incoming message notifications:** Receive instant SMS and MMS notifications via webhooks. +- 🔔 **Real-time incoming message notifications:** Receive instant SMS and MMS notifications via webhooks (MMS payloads are metadata-only; attachments are not included—see [Webhooks](./features/webhooks.md)).
1-1: Verify H1 emoji usage across the docs toolchain (anchors/ToC/SEO).The rocket emoji in the H1 is fine stylistically, but some generators and linkers produce emoji-including slugs, which can affect deep links and ToC anchors.
Please run a quick docs build preview and validate:
- The page title/SEO metadata render as expected.
- In-page anchors and any inbound links to this H1 remain stable.
If needed, we can move the emoji into the hero section instead of the H1 while keeping the visual flair.
7-7: Optional: Add cross-links to Supported Events for discoverability.Improve wayfinding from the index to the new mms:received event details.
Apply this diff:
-... receive webhooks on incoming SMS and MMS messages. ... +... receive webhooks on incoming SMS and MMS messages (see [Supported Events](./features/webhooks.md#supported-events)). ...-- 🔔 **Real-time incoming message notifications:** Receive instant SMS and MMS notifications via webhooks (MMS payloads are metadata-only; attachments are not included—see [Webhooks](./features/webhooks.md)). +- 🔔 **Real-time incoming message notifications:** Receive instant SMS and MMS notifications via webhooks (MMS payloads are metadata-only; attachments are not included—see [Supported Events](./features/webhooks.md#supported-events)).Also applies to: 24-25
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
docs/index.md(2 hunks)
🧰 Additional context used
🪛 LanguageTool
docs/index.md
[grammar] ~1-~1: There might be a mistake here.
Context: # 🚀 SMS Gateway for Android™
(QB_NEW_EN)
[grammar] ~25-~25: There might be a mistake here.
Context: ...bhooks used for real-time notifications. 🔒 Security and Privacy: - 🔐 **End-to-e...
(QB_NEW_EN)
There was a problem hiding this comment.
Actionable comments posted: 0
♻️ Duplicate comments (1)
docs/index.md (1)
7-7: Clarify that MMS webhooks exclude media attachmentsTo prevent confusion, explicitly state that MMS webhook payloads contain metadata only (not the binary media). This mirrors the detail you added to the Webhooks feature page and aligns expectations on the landing page.
Apply this diff:
-SMS Gateway for Android turns your Android smartphone into an SMS and MMS gateway. It's a lightweight application that allows you to send SMS messages programmatically via an API and receive webhooks on incoming SMS and MMS messages. This makes it ideal for integrating messaging functionality into your own applications or services. +SMS Gateway for Android turns your Android smartphone into an SMS and MMS gateway. It's a lightweight application that allows you to send SMS messages programmatically via an API and receive webhooks on incoming SMS and MMS messages. For MMS, webhooks include message metadata (e.g., subject, size, media count) but not the attachment files—see the [Webhooks](./features/webhooks.md) page for details. This makes it ideal for integrating messaging functionality into your own applications or services.
🧹 Nitpick comments (2)
docs/index.md (2)
24-24: Add a short MMS note to the “Real-time … notifications” bulletSmall inline note reduces back-and-forth when developers expect attachments to appear in webhook payloads.
-- 🔔 **Real-time incoming message notifications:** Receive instant SMS and MMS notifications via [webhooks](./features/webhooks.md). +- 🔔 **Real-time incoming message notifications:** Receive instant SMS and MMS notifications via [webhooks](./features/webhooks.md). Note: MMS webhooks include metadata only; media files are not included.
25-25: Approve link update; recommend adding explicit attachments exclusion noteThe link in docs/index.md correctly switches to the
.mdfile, and the target exists. However, themms:receivedsection in docs/features/webhooks.md currently lacks an explicit “attachments not included” note. Consider adding one for clarity.• docs/index.md (line 25)
- 📖 **Retrieve previously received messages:** Access your message history via [Reading Messages](./features/reading-messages/). + 📖 **Retrieve previously received messages:** Access your message history via [Reading Messages](./features/reading-messages.md).• docs/features/webhooks.md (around the mms:received section)
– Insert a bullet or callout such as:
“❗ Note: Multimedia attachments (images, videos, etc.) are not included in themms:receivedpayload.”
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
docs/index.md(2 hunks)
🧰 Additional context used
🪛 LanguageTool
docs/index.md
[grammar] ~1-~1: There might be a mistake here.
Context: # 🚀 SMS Gateway for Android™
(QB_NEW_EN)
[grammar] ~25-~25: There might be a mistake here.
Context: ...Messages](./features/reading-messages/). 🔒 Security and Privacy: - 🔐 **End-to-e...
(QB_NEW_EN)
🔇 Additional comments (1)
docs/index.md (1)
1-1: Heading style change looks goodEmoji-prefixed H1 renders fine in most doc generators. No action needed.
capcom6
force-pushed
the
webhooks/include-mms-support
branch
from
9497ddf to
c2fa933
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
docs/features/webhooks.md (1)
158-171: Add MMS attachments exclusion note and index pointerIt appears the “MMS attachments not included” clarification is missing from the MMS webhook docs, and the main docs/index.md doesn’t link to this note. Please update both to ensure consistency:
• In
docs/features/webhooks.md(around the=== "mms:received"block, e.g. after line 200):=== "mms:received" { "event": "mms:received", … } +> **Note:** MMS attachments (images, videos, and other media) are _not_ included in the webhook payload. Only metadata (e.g., URLs and content-type headers) is delivered.• In
docs/index.md(under the Webhooks list):- [Webhooks](features/webhooks.md) + [Webhooks](features/webhooks.md) - **MMS**: only metadata is delivered—see [Receiving MMS Metadata](features/webhooks.md#mmsreceived) for details.These additions will surface the exclusion note and guide readers from the index to the correct section.
♻️ Duplicate comments (2)
docs/index.md (2)
24-25: “Reading Messages” phrasing/link looks goodThanks for switching to “Retrieve previously received messages” and using the relative link. This resolves prior confusion about using webhooks for history.
7-7: Clarify MMS webhook payloads: metadata only, no attachmentsThis sentence can mislead readers into expecting attachment bytes in the webhook. Explicitly state that MMS webhooks include metadata (subject, size, etc.) but not attachment content, and point to the Webhooks page for details.
Apply this diff:
-SMS Gateway for Android turns your Android smartphone into an SMS and MMS gateway. It's a lightweight application that allows you to send SMS messages programmatically via an API and receive webhooks on incoming SMS and MMS messages. This makes it ideal for integrating messaging functionality into your own applications or services. +SMS Gateway for Android turns your Android smartphone into an SMS and MMS gateway. It's a lightweight application that allows you to send SMS messages programmatically via an API and receive webhooks on incoming SMS and MMS messages. MMS webhooks include message metadata (e.g., subject, size, content class), not attachment content; see [Webhooks](./features/webhooks.md#mmsreceived) for details. This makes it ideal for integrating messaging functionality into your own applications or services.
🧹 Nitpick comments (10)
docs/features/webhooks.md (5)
154-154: Avoid implying MMS attachments are in the webhookTweak the Step 4 bullet so “includes images…” doesn’t read as if attachments are sent in the webhook payload.
-- **For `mms:received`**: Send an MMS message to the device (includes images, videos, or other multimedia attachments). +- **For `mms:received`**: Send an MMS message to the device. The webhook payload includes MMS metadata (e.g., subject, size), not attachment bytes.
16-21: Fix MD007 list indentation for consistency with markdownlintIndent list items under “Supported Events” by 2 spaces to appease markdownlint (MD007). Current 4‑space indentation triggers warnings.
- - `messageId`: Content-based ID - - `data`: Base64-encoded data message - - `phoneNumber`: Sender's number - - `simNumber`: SIM index (nullable) - - `receivedAt`: Local timestamp + - `messageId`: Content-based ID + - `data`: Base64-encoded data message + - `phoneNumber`: Sender's number + - `simNumber`: SIM index (nullable) + - `receivedAt`: Local timestamp @@ - - `messageId`: Carrier generated ID - - `transactionId`: Unique MMS transaction identifier - - `subject`: Message subject line (nullable) - - `size`: Attachment size in bytes - - `contentClass`: MMS content classification (nullable) - - `phoneNumber`: Sender's number - - `simNumber`: SIM index (nullable) - - `receivedAt`: Local timestamp + - `messageId`: Carrier-generated ID + - `transactionId`: Unique MMS transaction identifier + - `subject`: Message subject line (nullable) + - `size`: Attachment size in bytes + - `contentClass`: MMS content classification (nullable) + - `phoneNumber`: Sender's number + - `simNumber`: SIM index (nullable) + - `receivedAt`: Local timestampMinor copy edit: “Carrier-generated” takes a hyphen when used adjectivally.
Also applies to: 23-31
196-215: Optional: include a minimal media reference field or example noteIf the app surfaces media references (e.g., content URIs or IDs) later in the flow, consider adding an example field like
mediaCountor a note that attachments are retrieved via a separate API. This preempts integrator questions.If media references are intentionally omitted, confirm and we’ll add a one‑line note under the JSON block instead of a field to keep the contract minimal.
261-279: Signing: recommend timestamp validity window in examplesYou mention validating timestamps below; reinforce it by adding a short code comment in each sample to check ±5 minutes (or your chosen skew) before comparing the signature.
Happy to submit a follow-up PR with updated code snippets (Go/Python/JS/PHP) demonstrating timestamp window checks.
349-357: Troubleshooting: add MMS-specific hintSince MMS often fails due to missing RECEIVE_MMS permission or RCS confusion, add a bullet linking to the MMS FAQ section “Why isn't my MMS webhook triggering?”
!!! failure "No Webhooks Received?" - 1. Verify the webhook URL is correct + 1. Verify the webhook URL is correct 2. Ensure the device can reach your server 3. Verify SSL certificate validity 4. Check device and server logs 5. Test with [webhook.site](https://webhook.site) temporary endpoint + 6. For MMS issues, see [:material-multimedia: Why isn't my MMS webhook triggering?](../faq/webhooks.md#material-multimedia-why-isnt-my-mms-webhook-triggering)docs/features/multi-device.md (3)
41-46: Add Content-Type header to curl JSON examplesMany users copy/paste these. Include the JSON content type to avoid 415/parse errors on strict servers.
curl https://api.sms-gate.app/3rdparty/v1/messages \ -u "username:password" \ + -H "Content-Type: application/json" \ --json '{ "textMessage": {"text": "Test message"}, "phoneNumbers": ["+19162255887"] }'
51-58: Add Content-Type header to explicit device selection exampleSame rationale as above.
curl https://api.sms-gate.app/3rdparty/v1/messages \ -u "username:password" \ + -H "Content-Type: application/json" \ --json '{ "textMessage": {"text": "Test message"}, "phoneNumbers": ["+19162255887"], "deviceId": "dev_abc123" }'
80-82: Verify data deletion semantics on device removalThe danger note states that deleting a device removes all associated messages, including pending ones, and is irreversible. Please confirm this behavior across Cloud and Private modes and whether sent/received logs on the server are also purged.
If needed, I can draft a short “Data Retention” subsection clarifying what remains on other devices/server after removal.
docs/faq/webhooks.md (2)
46-57: Local-network guidance: add concrete adb reverse snippetStep 2 references reverse port forwarding; adding a code block improves copy‑paste usability and addresses markdownlint’s code‑block style hint.
2. **Localhost with Reverse Port Forwarding** - Use `127.0.0.1` with ADB reverse port forwarding to access local servers + Use `127.0.0.1` with ADB reverse port forwarding to access local servers + ```bash + adb reverse tcp:9876 tcp:8080 + # Then register your webhook to: + # http://127.0.0.1:9876/webhooks + ```
67-77: Deprecation of self-signed certs: add timeline/targetYou note removal in “version 2.x”. Adding an approximate timeline or linking to a roadmap/changelog will help users plan migrations.
If you have a target release (e.g., 2.0 GA in Q4 2025), I can add it here with a link to the release notes.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (4)
docs/faq/webhooks.md(8 hunks)docs/features/multi-device.md(4 hunks)docs/features/webhooks.md(4 hunks)docs/index.md(2 hunks)
🧰 Additional context used
🪛 LanguageTool
docs/faq/webhooks.md
[grammar] ~30-~30: There might be a mistake here.
Context: ... with an HTTP server without encryption? Due to Android OS security requirements a...
(QB_NEW_EN)
[grammar] ~137-~137: There might be a mistake here.
Context: ...dio) ``` Verification Steps: - [ ] Check if message has multimedia atta...
(QB_NEW_EN)
[grammar] ~147-~147: There might be a mistake here.
Context: ...ed ``` Required Permissions: - [ ] SMS permission - [ ] MMS permiss...
(QB_NEW_EN)
[grammar] ~148-~148: There might be a mistake here.
Context: ... Permissions**: - [ ] SMS permission - [ ] MMS permission 3. **Webhook Registr...
(QB_NEW_EN)
docs/features/multi-device.md
[grammar] ~2-~2: There might be a mistake here.
Context: # 📱📱 Multi-Device Support The app supports multiple devices for a si...
(QB_NEW_EN)
[grammar] ~37-~37: There might be a mistake here.
Context: ...h "Continue" ## 📨 Message Distribution === ":fontawesome-solid-dice: Random Sele...
(QB_NEW_EN)
docs/features/webhooks.md
[grammar] ~1-~1: There might be a mistake here.
Context: # 🌐 Webhooks Webhooks offer a powerful mechanism to re...
(QB_NEW_EN)
[grammar] ~5-~5: There might be a mistake here.
Context: ...rom your device. ## 📩 Supported Events
(QB_NEW_EN)
[grammar] ~16-~16: There might be a mistake here.
Context: ... :material-database: sms:data-received - messageId: Content-based ID - data: Base64-...
(QB_NEW_EN)
[grammar] ~17-~17: There might be a mistake here.
Context: ...ed** - messageId: Content-based ID - data: Base64-encoded data message - `pho...
(QB_NEW_EN)
[grammar] ~18-~18: There might be a mistake here.
Context: ... - data: Base64-encoded data message - phoneNumber: Sender's number - simNumber: SIM...
(QB_NEW_EN)
[grammar] ~19-~19: There might be a mistake here.
Context: ...age - phoneNumber: Sender's number - simNumber: SIM index (nullable) - `receivedAt...
(QB_NEW_EN)
[grammar] ~20-~20: There might be a mistake here.
Context: ... - simNumber: SIM index (nullable) - receivedAt: Local timestamp - :material-multimedi...
(QB_NEW_EN)
[grammar] ~23-~23: There might be a mistake here.
Context: ... - :material-multimedia: mms:received - messageId: Carrier generated ID - `transactio...
(QB_NEW_EN)
[grammar] ~24-~24: There might be a mistake here.
Context: ... - messageId: Carrier generated ID - transactionId: Unique MMS transaction identifier ...
(QB_NEW_EN)
[grammar] ~25-~25: There might be a mistake here.
Context: ...onId: Unique MMS transaction identifier - subject`: Message subject line (nullable) - ...
(QB_NEW_EN)
[grammar] ~26-~26: There might be a mistake here.
Context: ...ubject: Message subject line (nullable) - size: Attachment size in bytes - conten...
(QB_NEW_EN)
[grammar] ~27-~27: There might be a mistake here.
Context: ...) - size: Attachment size in bytes - contentClass: MMS content classification (nullable) ...
(QB_NEW_EN)
[grammar] ~28-~28: There might be a mistake here.
Context: ...: MMS content classification (nullable) - phoneNumber: Sender's number - simNumber`: SIM...
(QB_NEW_EN)
[grammar] ~29-~29: There might be a mistake here.
Context: ...le) - phoneNumber: Sender's number - simNumber: SIM index (nullable) - `receivedAt...
(QB_NEW_EN)
[grammar] ~30-~30: There might be a mistake here.
Context: ... - simNumber: SIM index (nullable) - receivedAt: Local timestamp - 📤 **sms...
(QB_NEW_EN)
[grammar] ~154-~154: There might be a mistake here.
Context: ...ideos, or other multimedia attachments). - For sms:sent/delivered/failed: S...
(QB_NEW_EN)
docs/index.md
[grammar] ~1-~1: There might be a mistake here.
Context: # 🚀 SMS Gateway for Android™
(QB_NEW_EN)
[grammar] ~25-~25: There might be a mistake here.
Context: ...Messages](./features/reading-messages/). 🔒 Security and Privacy: - 🔐 **End-to-e...
(QB_NEW_EN)
🪛 markdownlint-cli2 (0.17.2)
docs/faq/webhooks.md
46-46: Code block style
Expected: fenced; Actual: indented
(MD046, code-block-style)
docs/features/webhooks.md
17-17: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
18-18: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
19-19: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
20-20: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
21-21: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
24-24: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
25-25: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
26-26: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
27-27: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
28-28: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
29-29: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
30-30: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
31-31: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
🔇 Additional comments (1)
docs/faq/webhooks.md (1)
128-161: Clear, unambiguous MMS guidance—LGTMThe MMS troubleshooting and the explicit “attachments not included” section are clear and actionable. Nice work.
capcom6
force-pushed
the
webhooks/include-mms-support
branch
from
c2fa933 to
27ca772
Compare
There was a problem hiding this comment.
Actionable comments posted: 0
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
docs/features/webhooks.md (1)
1-400: Fix list indentation and add missing MMS attachments note
- Replace 4-space indentation before all field bullets with 2 spaces in docs/features/webhooks.md (currently lines 10–31).
- Add a note under mms:received indicating that MMS attachments are not included in the payload.
♻️ Duplicate comments (2)
docs/features/webhooks.md (1)
23-32: Add explicit “attachments not included” note under mms:received.Avoid confusion: make it clear that MMS webhooks carry metadata only; media is not in the payload. Add a short note with a pointer to Reading Messages.
- :material-multimedia: **mms:received** - `messageId`: Carrier generated ID - `transactionId`: Unique MMS transaction identifier - `subject`: Message subject line (nullable) - `size`: Attachment size in bytes - `contentClass`: MMS content classification (nullable) - `phoneNumber`: Sender's number - `simNumber`: SIM index (nullable) - `receivedAt`: Local timestamp + +!!! note "MMS attachments are not included" + The webhook provides MMS metadata only; attachment content (images, video, audio, etc.) is not included in the payload. + See [Reading Messages](./reading-messages.md) for retrieving message content/history.docs/index.md (1)
7-7: Clarify MMS webhook contents (metadata only).Avoid any implication that attachments arrive via webhook.
-SMS Gateway for Android turns your Android smartphone into an SMS and MMS gateway. It's a lightweight application that allows you to send SMS messages programmatically via an API and receive webhooks on incoming SMS and MMS messages. This makes it ideal for integrating messaging functionality into your own applications or services. +SMS Gateway for Android turns your Android smartphone into an SMS and MMS gateway. It's a lightweight application that allows you to send SMS messages programmatically via an API and receive webhooks on incoming SMS and MMS messages. MMS webhooks include message metadata (subject, size, etc.) but not attachment files—see [Reading Messages](./features/reading-messages/) for details. This makes it ideal for integrating messaging functionality into your own applications or services.
🧹 Nitpick comments (8)
docs/features/webhooks.md (5)
9-15: Fix list indentation (markdownlint MD007).Child bullets are indented with 4 spaces; expected is 2. This impacts all event field lists.
- - `messageId`: Content-based ID - - `message`: SMS content + - `messageId`: Content-based ID + - `message`: SMS contentApply similarly for sms:data-received and mms:received sub-bullets (reduce indent from 4 to 2 spaces).
Also applies to: 16-22, 23-31
154-156: Prevent misread: avoid implying attachments are delivered.Minor wording tweak so the test step doesn’t suggest media is sent in the webhook.
- **For `mms:received`**: Send an MMS message to the device (includes images, videos, or other multimedia attachments). + **For `mms:received`**: Send an MMS message with media to the device (note: the webhook contains metadata only).
196-215: Optional: add a one-line reminder in the MMS example block.Reinforce metadata-only semantics next to the JSON example.
=== "mms:received" +> Note: Attachments are not included in the webhook payload; only metadata is shown below.
279-297: Signing guidance is solid; consider showing timestamp window check.Add a short snippet to demonstrate rejecting stale requests (±5 min), since you recommend it below.
1. Get raw request body **as received** (before JSON parsing) 2. Concatenate with `X-Timestamp` value 3. Compute HMAC-SHA256 using the signing key 4. Compare result with `X-Signature` header +5. Reject if `abs(now - X-Timestamp) > 300` seconds
62-69: Consistency: “device_id” param vs “deviceId” payload key.Looks intentional (API param vs payload field). Just flagging to ensure API docs use snake_case consistently for request params.
Also applies to: 84-90, 106-118
docs/features/multi-device.md (1)
80-82: Clarify deletion scope.Specify whether deletion removes server-side records only, on-device data, or both; and whether it affects Cloud vs Private differently.
-Deleting a device will remove all associated messages, including pending ones. This action cannot be undone. +Deleting a device removes all associated messages on the server (including pending ones). On-device data is not altered. This action cannot be undone. (Clarify if behavior differs for Cloud vs Private.)docs/faq/webhooks.md (2)
145-173: Good MMS troubleshooting + attachments clarification.Consider adding a one-liner link to the mms:received example for quick reference.
-## :material-multimedia: Why isn't my MMS webhook triggering? +## :material-multimedia: Why isn't my MMS webhook triggering? +See the `mms:received` payload example in [Webhooks](../features/webhooks.md#step-5-receive-the-payload-).Also applies to: 174-178
46-46: markdownlint MD046 reported at line 46.I can’t spot an indented code block here; please re-run markdownlint and convert any indented blocks to fenced (```), if present.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (4)
docs/faq/webhooks.md(9 hunks)docs/features/multi-device.md(4 hunks)docs/features/webhooks.md(4 hunks)docs/index.md(2 hunks)
🧰 Additional context used
🪛 markdownlint-cli2 (0.17.2)
docs/faq/webhooks.md
46-46: Code block style
Expected: fenced; Actual: indented
(MD046, code-block-style)
docs/features/webhooks.md
17-17: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
18-18: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
19-19: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
20-20: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
21-21: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
24-24: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
25-25: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
26-26: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
27-27: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
28-28: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
29-29: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
30-30: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
31-31: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
🪛 LanguageTool
docs/features/multi-device.md
[grammar] ~1-~1: There might be a mistake here.
Context: # 📱📱 Multi-Device Support The app supports multiple devices for a ...
(QB_NEW_EN)
[grammar] ~37-~37: There might be a mistake here.
Context: ...h "Continue" ## 📨 Message Distribution === ":fontawesome-solid-dice: Random Sel...
(QB_NEW_EN)
docs/index.md
[grammar] ~1-~1: There might be a mistake here.
Context: # 🚀 SMS Gateway for Android™
(QB_NEW_EN)
[grammar] ~25-~25: There might be a mistake here.
Context: ...Messages](./features/reading-messages/). 🔒 Security and Privacy: - 🔐 **End-to-...
(QB_NEW_EN)
🔇 Additional comments (7)
docs/features/webhooks.md (2)
216-222: Retry math sanity check looks fine.14 retries with 10s base exponential backoff ≈ 45.5 hours (~2 days). LGTM.
1-1: Heading/style updates look good and consistent with site.Also applies to: 5-5
docs/features/multi-device.md (2)
37-47: Examples LGTM.E.164 recipient format and device selection examples are clear.
Also applies to: 49-58
5-10: Nice distinction between trusted vs untrusted devices.Wording is clear; no changes needed.
Also applies to: 19-36
docs/faq/webhooks.md (2)
30-57: HTTP vs HTTPS guidance reads well; anchors align with links.Exception blocks and local-network solutions are clear.
128-144: Multipart delivery explanation is accurate and consistent with Webhooks page.docs/index.md (1)
24-26: “Retrieve previously received messages” fix looks good.
There was a problem hiding this comment.
Actionable comments posted: 0
♻️ Duplicate comments (1)
docs/features/webhooks.md (1)
23-32: Add explicit “attachments not included” note under mms:received + minor copy tweakAvoid confusion: clarify that the webhook sends only MMS metadata, not media. Also hyphenate “Carrier-generated”.
- :material-multimedia: **mms:received** - - `messageId`: Carrier generated ID + - `messageId`: Carrier-generated ID - `transactionId`: Unique MMS transaction identifier - `subject`: Message subject line (nullable) - - `size`: Attachment size in bytes + - `size`: Total attachment size in bytes (all parts) - `contentClass`: MMS content classification (nullable) - `phoneNumber`: Sender's number - `simNumber`: SIM index (nullable) - `receivedAt`: Local timestamp + +!!! note "MMS attachments are not included" + The webhook payload contains MMS metadata only; attachment content (images, video, audio, etc.) is not included. + See [Reading Messages](../features/reading-messages.md) for retrieving message content/history.
🧹 Nitpick comments (6)
docs/features/webhooks.md (6)
16-21: Fix unordered-list indentation to satisfy markdownlint (MD007)Indent nested bullet items by two spaces (currently four) to pass linting and render consistently in mkdocs-material card lists.
- :material-database: **sms:data-received** - - `messageId`: Content-based ID - - `data`: Base64-encoded data message - - `phoneNumber`: Sender's number - - `simNumber`: SIM index (nullable) - - `receivedAt`: Local timestamp + - `messageId`: Content-based ID + - `data`: Base64-encoded data message + - `phoneNumber`: Sender's number + - `simNumber`: SIM index (nullable) + - `receivedAt`: Local timestamp - :material-multimedia: **mms:received** - - `messageId`: Carrier-generated ID - - `transactionId`: Unique MMS transaction identifier - - `subject`: Message subject line (nullable) - - `size`: Total attachment size in bytes (all parts) - - `contentClass`: MMS content classification (nullable) - - `phoneNumber`: Sender's number - - `simNumber`: SIM index (nullable) - - `receivedAt`: Local timestamp + - `messageId`: Carrier-generated ID + - `transactionId`: Unique MMS transaction identifier + - `subject`: Message subject line (nullable) + - `size`: Total attachment size in bytes (all parts) + - `contentClass`: MMS content classification (nullable) + - `phoneNumber`: Sender's number + - `simNumber`: SIM index (nullable) + - `receivedAt`: Local timestampAlso applies to: 23-31
169-174: Normalize phone number format in examples (use E.164 consistently)Examples mix local and E.164 formats. Prefer E.164 across docs for clarity.
"payload": { "messageId": "abc123", - "message": "Android is always a sweet treat!", - "phoneNumber": "6505551212", + "message": "Android is always a sweet treat!", + "phoneNumber": "+16505551212", "simNumber": 1, "receivedAt": "2024-06-22T15:46:11.000+07:00" "payload": { "messageId": "abc123", "data": "SGVsbG8gRGF0YSBXb3JsZCE=", - "phoneNumber": "6505551212", + "phoneNumber": "+16505551212", "simNumber": 1, "receivedAt": "2024-06-22T15:46:11.000+07:00" "payload": { "messageId": "mms_12345abcde", - "phoneNumber": "+1234567890", + "phoneNumber": "+16505551212", "simNumber": 1,Also applies to: 186-191, 199-205
91-96: Show MMS registration example alongside SMSAdd a second curl showing event "mms:received" to reduce guesswork.
https://api.sms-gate.app/3rdparty/v1/webhooks } + +```sh title="Cloud mode example (MMS)" +curl -X POST -u <username>:<password> \ + -H "Content-Type: application/json" \ + -d '{ "url": "https://your-server.com/webhook", "event": "mms:received" }' \ + https://api.sms-gate.app/3rdparty/v1/webhooks +```
216-221: Clarify retry triggers and idempotency guidanceState which responses trigger retries (non-2xx, network errors). Do 4xx responses retry? Recommend documenting idempotency via a stable request identifier or X-Idempotency-Key to make retries safe.
279-347: HMAC signature comparison: normalize header case + constant-time compareHex signatures may arrive upper/lower/mixed case. Normalize incoming signature to lowercase before comparison in all samples. The equality helpers are constant-time; this change improves robustness.
@@ Go - expectedSignature := hex.EncodeToString(expectedMAC) - - return hmac.Equal([]byte(expectedSignature), []byte(signature)) + expectedSignature := hex.EncodeToString(expectedMAC) // lowercase + sig := strings.ToLower(signature) + return hmac.Equal([]byte(expectedSignature), []byte(sig))@@ Python - expected_signature = hmac.new(secret_key.encode(), message, hashlib.sha256).hexdigest() - return hmac.compare_digest(expected_signature, signature) + expected_signature = hmac.new(secret_key.encode(), message, hashlib.sha256).hexdigest() # lowercase + return hmac.compare_digest(expected_signature, signature.lower())@@ JavaScript - const expectedSignature = crypto + const expectedSignature = crypto .createHmac('sha256', secretKey) .update(message) .digest('hex'); - - return expectedSignature === signature; + return crypto.timingSafeEqual( + Buffer.from(expectedSignature, 'utf8'), + Buffer.from(String(signature).toLowerCase(), 'utf8') + );@@ PHP - $expected_signature = hash_hmac('sha256', $message, $secret_key); - - return hash_equals($expected_signature, $signature); + $expected_signature = hash_hmac('sha256', $message, $secret_key); // lowercase hex + return hash_equals($expected_signature, strtolower($signature));
28-29: Document allowed values for contentClassList the possible MMS contentClass values (and mapping if normalized), or link to a spec/reference, so integrators can build enums/validations.
Also applies to: 209-210
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
docs/features/webhooks.md(4 hunks)
🧰 Additional context used
🪛 LanguageTool
docs/features/webhooks.md
[grammar] ~1-~1: There might be a mistake here.
Context: # 🌐 Webhooks Webhooks offer a powerful mechanism to r...
(QB_NEW_EN)
[grammar] ~5-~5: There might be a mistake here.
Context: ...rom your device. ## 📩 Supported Events
(QB_NEW_EN)
[grammar] ~16-~16: There might be a mistake here.
Context: ... :material-database: sms:data-received - messageId: Content-based ID - data: Base64-...
(QB_NEW_EN)
[grammar] ~17-~17: There might be a mistake here.
Context: ...ed** - messageId: Content-based ID - data: Base64-encoded data message - `pho...
(QB_NEW_EN)
[grammar] ~18-~18: There might be a mistake here.
Context: ... - data: Base64-encoded data message - phoneNumber: Sender's number - simNumber: SIM...
(QB_NEW_EN)
[grammar] ~19-~19: There might be a mistake here.
Context: ...age - phoneNumber: Sender's number - simNumber: SIM index (nullable) - `receivedAt...
(QB_NEW_EN)
[grammar] ~20-~20: There might be a mistake here.
Context: ... - simNumber: SIM index (nullable) - receivedAt: Local timestamp - :material-multimedi...
(QB_NEW_EN)
[grammar] ~23-~23: There might be a mistake here.
Context: ... - :material-multimedia: mms:received - messageId: Carrier generated ID - `transactio...
(QB_NEW_EN)
[grammar] ~24-~24: There might be a mistake here.
Context: ... - messageId: Carrier generated ID - transactionId: Unique MMS transaction identifier ...
(QB_NEW_EN)
[grammar] ~25-~25: There might be a mistake here.
Context: ...onId: Unique MMS transaction identifier - subject`: Message subject line (nullable) - ...
(QB_NEW_EN)
[grammar] ~26-~26: There might be a mistake here.
Context: ...ubject: Message subject line (nullable) - size: Attachment size in bytes - conten...
(QB_NEW_EN)
[grammar] ~27-~27: There might be a mistake here.
Context: ...) - size: Attachment size in bytes - contentClass: MMS content classification (nullable) ...
(QB_NEW_EN)
[grammar] ~28-~28: There might be a mistake here.
Context: ...: MMS content classification (nullable) - phoneNumber: Sender's number - simNumber`: SIM...
(QB_NEW_EN)
[grammar] ~29-~29: There might be a mistake here.
Context: ...le) - phoneNumber: Sender's number - simNumber: SIM index (nullable) - `receivedAt...
(QB_NEW_EN)
[grammar] ~30-~30: There might be a mistake here.
Context: ... - simNumber: SIM index (nullable) - receivedAt: Local timestamp - 📤 **sms...
(QB_NEW_EN)
[style] ~154-~154: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...**: Send a data SMS to port 53739. - **For mms:received`**: Send an MMS message t...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
🪛 markdownlint-cli2 (0.17.2)
docs/features/webhooks.md
17-17: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
18-18: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
19-19: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
20-20: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
21-21: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
24-24: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
25-25: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
26-26: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
27-27: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
28-28: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
29-29: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
30-30: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
31-31: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Cloudflare Pages
🔇 Additional comments (1)
docs/features/webhooks.md (1)
147-149: Confirm scope of “Webhook Registration Notification”Is the notification shown for all webhook events, or only for sms:received? If global, reword to “When a new webhook is registered…”. If not, clarify why only SMS triggers it.
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (1)
docs/features/webhooks.md (1)
23-32: Add explicit “attachments not included” note for mms:received.Prevents devs from assuming media blobs are pushed in the webhook.
- `receivedAt`: Local timestamp + +!!! note "MMS attachments are not included" + The webhook contains MMS metadata only; attachment content (images, video, audio, etc.) is not included. + See [Reading Messages](../features/reading-messages.md) for retrieving message content/history.
🧹 Nitpick comments (3)
docs/features/webhooks.md (3)
16-22: Fix list indentation and one grammar nit in Supported Events.
- Indentation inside the grid card trips MD007; either re-indent to 2 spaces or locally disable the rule around this block.
- “Carrier generated ID” → “Carrier-generated ID”.
Apply either of the following diffs:
Option A — disable MD007 just for this block:
-<div class="grid cards" markdown> +<!-- markdownlint-disable MD007 --> +<div class="grid cards" markdown> @@ </div> +<!-- markdownlint-enable MD007 -->Option B — grammar nit:
- - `messageId`: Carrier generated ID + - `messageId`: Carrier-generated IDAlso applies to: 23-31
196-215: Clarify nullable fields and link retrieval flow in the MMS example.
- Indicate
subjectandcontentClassmay be null.- Add a one‑line pointer that media must be retrieved separately (mirrors the field list note).
"payload": { "messageId": "mms_12345abcde", "phoneNumber": "+1234567890", "simNumber": 1, "transactionId": "T1234567890ABC", - "subject": "Photo attachment", + "subject": "Photo attachment", // may be null "size": 125684, - "contentClass": "IMAGE_BASIC", + "contentClass": "IMAGE_BASIC", // may be null "receivedAt": "2025-08-23T05:15:30.000+07:00" },Optionally append after the code block:
+> Note: MMS media is not included in the webhook payload. See [Reading Messages](../features/reading-messages.md).
153-155: Test instructions read well. Verify hard-coded data-SMS port.Port 53739 looks intentional; confirm it matches the app constant to avoid drift between app and docs.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
docs/features/webhooks.md(5 hunks)
🧰 Additional context used
🪛 LanguageTool
docs/features/webhooks.md
[grammar] ~1-~1: There might be a mistake here.
Context: # 🌐 Webhooks Webhooks offer a powerful mechanism to r...
(QB_NEW_EN)
[grammar] ~5-~5: There might be a mistake here.
Context: ...rom your device. ## 📩 Supported Events
(QB_NEW_EN)
[grammar] ~16-~16: There might be a mistake here.
Context: ... :material-database: sms:data-received - messageId: Content-based ID - data: Base64-...
(QB_NEW_EN)
[grammar] ~17-~17: There might be a mistake here.
Context: ...ed** - messageId: Content-based ID - data: Base64-encoded data message - `pho...
(QB_NEW_EN)
[grammar] ~18-~18: There might be a mistake here.
Context: ... - data: Base64-encoded data message - phoneNumber: Sender's number - simNumber: SIM...
(QB_NEW_EN)
[grammar] ~19-~19: There might be a mistake here.
Context: ...age - phoneNumber: Sender's number - simNumber: SIM index (nullable) - `receivedAt...
(QB_NEW_EN)
[grammar] ~20-~20: There might be a mistake here.
Context: ... - simNumber: SIM index (nullable) - receivedAt: Local timestamp - :material-multimedi...
(QB_NEW_EN)
[grammar] ~23-~23: There might be a mistake here.
Context: ... - :material-multimedia: mms:received - messageId: Carrier generated ID - `transactio...
(QB_NEW_EN)
[grammar] ~24-~24: There might be a mistake here.
Context: ... - messageId: Carrier generated ID - transactionId: Unique MMS transaction identifier ...
(QB_NEW_EN)
[grammar] ~25-~25: There might be a mistake here.
Context: ...onId: Unique MMS transaction identifier - subject`: Message subject line (nullable) - ...
(QB_NEW_EN)
[grammar] ~26-~26: There might be a mistake here.
Context: ...ubject: Message subject line (nullable) - size: Attachment size in bytes - conten...
(QB_NEW_EN)
[grammar] ~27-~27: There might be a mistake here.
Context: ...) - size: Attachment size in bytes - contentClass: MMS content classification (nullable) ...
(QB_NEW_EN)
[grammar] ~28-~28: There might be a mistake here.
Context: ...: MMS content classification (nullable) - phoneNumber: Sender's number - simNumber`: SIM...
(QB_NEW_EN)
[grammar] ~29-~29: There might be a mistake here.
Context: ...le) - phoneNumber: Sender's number - simNumber: SIM index (nullable) - `receivedAt...
(QB_NEW_EN)
[grammar] ~30-~30: There might be a mistake here.
Context: ... - simNumber: SIM index (nullable) - receivedAt: Local timestamp - 📤 **sms...
(QB_NEW_EN)
[style] ~154-~154: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...**: Send a data SMS to port 53739. - **For mms:received`**: Send an MMS message t...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
🪛 markdownlint-cli2 (0.17.2)
docs/features/webhooks.md
17-17: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
18-18: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
19-19: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
20-20: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
21-21: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
24-24: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
25-25: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
26-26: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
27-27: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
28-28: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
29-29: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
30-30: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
31-31: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
🔇 Additional comments (1)
docs/features/webhooks.md (1)
1-1: Consistent, readable headings — good change.Emoji-prefixed H1/H2 maintain consistency with the rest of the docs set.
Also applies to: 5-5
There was a problem hiding this comment.
Actionable comments posted: 0
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
docs/features/webhooks.md (2)
298-318: Go verifier: compare raw bytes and accept hex case-insensitively.Current code compares hex strings; safer to decode the provided signature, check length, and use constant-time byte compare.
- import ( - "crypto/hmac" - "crypto/sha256" - "encoding/hex" - ) + import ( + "crypto/hmac" + "crypto/sha256" + "crypto/subtle" + "encoding/hex" + "strings" + ) @@ - func VerifySignature(secretKey, payload, timestamp, signature string) bool { + func VerifySignature(secretKey, payload, timestamp, signature string) bool { message := payload + timestamp mac := hmac.New(sha256.New, []byte(secretKey)) mac.Write([]byte(message)) - expectedMAC := mac.Sum(nil) - expectedSignature := hex.EncodeToString(expectedMAC) - - return hmac.Equal([]byte(expectedSignature), []byte(signature)) + expected := mac.Sum(nil) + sig := strings.TrimSpace(strings.ToLower(signature)) + got, err := hex.DecodeString(sig) + if err != nil || len(got) != len(expected) { + return false + } + return subtle.ConstantTimeCompare(expected, got) == 1 } ``` <!-- review_comment_end --> --- `320-331`: **Python verifier: decode hex and compare bytes; tolerate hex case.** Comparing hex strings is case-sensitive. Decode to bytes and use `compare_digest` on equal-length byte arrays. ```diff - def verify_signature(secret_key: str, payload: str, timestamp: str, signature: str) -> bool: - message = (payload + timestamp).encode() - expected_signature = hmac.new(secret_key.encode(), message, hashlib.sha256).hexdigest() - return hmac.compare_digest(expected_signature, signature) + def verify_signature(secret_key: str, payload: str, timestamp: str, signature: str) -> bool: + message = (payload + timestamp).encode() + expected = hmac.new(secret_key.encode(), message, hashlib.sha256).digest() + try: + got = bytes.fromhex(signature.strip()) + except ValueError: + return False + if len(got) != len(expected): + return False + return hmac.compare_digest(expected, got) ``` <!-- review_comment_end --> </blockquote></details> </blockquote></details>♻️ Duplicate comments (2)
docs/features/webhooks.md (2)
23-31: Clarify that MMS attachments are not delivered via webhook.Readers may assume binary media comes inline. Add an explicit note stating only metadata is included and where to fetch media.
Apply:
- :material-multimedia: **mms:received** - - `messageId`: Carrier-generated ID, if available, same as `transactionId` otherwise - - `transactionId`: Unique MMS transaction identifier - - `subject`: Message subject line (nullable) - - `size`: Attachment size in bytes - - `contentClass`: MMS content classification (nullable) - - `phoneNumber`: Sender's number - - `simNumber`: SIM index (nullable) - - `receivedAt`: Local timestamp + - `messageId`: Carrier-generated ID, if available, same as `transactionId` otherwise + - `transactionId`: Unique MMS transaction identifier + - `subject`: Message subject line (nullable) + - `size`: Total attachment size in bytes (all parts) + - `contentClass`: MMS content classification (nullable) + - `phoneNumber`: Sender's number + - `simNumber`: SIM index (nullable) + - `receivedAt`: Local timestamp + +!!! note "MMS attachments are not included" + The payload contains MMS metadata only. Attachment content is not sent in the webhook; retrieve it via your message/media retrieval flow (see [Reading Messages](../features/reading-messages.md)).Also reduces nested list indentation to satisfy MD007.
345-350: Nice fix: timing-safe compare on decoded hex with length check.This avoids exceptions and compares bytes in constant time.
🧹 Nitpick comments (4)
docs/features/webhooks.md (4)
16-22: Fix nested list indentation to pass markdownlint (MD007).Sub-items are indented by 4 spaces; expected is 2. Adjust for all event sublists for consistency.
Apply (illustrative for one block):
- - `messageId`: Content-based ID + - `messageId`: Content-based IDRepeat for remaining sub-items under each event.
Also applies to: 24-31
196-215: Reinforce MMS metadata-only behavior next to the example.Place a short admonition right after the example so integrators don’t hunt for it.
} ``` + +!!! note + Example shows metadata only. Media bytes are not included in webhook deliveries. ``` <!-- review_comment_end --> --- `216-223`: **Document idempotency and response body handling for retries.** State explicitly that the body is ignored and handlers should be idempotent using `id` as a dedupe key. ```diff !!! important "Timely Response" - Your server **must** respond with a 2xx status within 30 seconds to prevent retries + Your server **must** respond with a 2xx status within 30 seconds to prevent retries. + The response body is ignored. Handlers should be idempotent; use the `id` field to deduplicate retried deliveries. ``` <!-- review_comment_end --> --- `109-117`: **Call out casing differences between API params and payload fields.** `device_id` (snake_case) in registration vs `deviceId` (camelCase) in webhook payloads can trip users. Add a short note. ```diff !!! tip "Device-Specific Webhooks" @@ ``` + +!!! note "Field naming" + API parameters use `snake_case` (e.g., `device_id`), while webhook payload fields use `camelCase` (e.g., `deviceId`). ``` <!-- review_comment_end --> <!-- file_end --> </blockquote></details> </blockquote></details> <details> <summary>📜 Review details</summary> **Configuration used**: CodeRabbit UI **Review profile**: CHILL **Plan**: Pro **💡 Knowledge Base configuration:** - MCP integration is disabled by default for public repositories - Jira integration is disabled by default for public repositories - Linear integration is disabled by default for public repositories You can enable these sources in your CodeRabbit configuration. <details> <summary>📥 Commits</summary> Reviewing files that changed from the base of the PR and between 1ddd726371a99ba353f37e34defdfb57c05bdf6d and c1530e7495128b0c94edc0906fccea7d7ff91239. </details> <details> <summary>📒 Files selected for processing (1)</summary> * `docs/features/webhooks.md` (5 hunks) </details> <details> <summary>🧰 Additional context used</summary> <details> <summary>🪛 LanguageTool</summary> <details> <summary>docs/features/webhooks.md</summary> [grammar] ~1-~1: There might be a mistake here. Context: # 🌐 Webhooks Webhooks offer a powerful mechanism to r... (QB_NEW_EN) --- [grammar] ~5-~5: There might be a mistake here. Context: ...rom your device. ## 📩 Supported Events <div class="grid cards" markdown> - :incoming_envelope: **sms:received** ... (QB_NEW_EN) --- [grammar] ~16-~16: There might be a mistake here. Context: ... :material-database: **sms:data-received** - `messageId`: Content-based ID - `data`: Base64-... (QB_NEW_EN) --- [grammar] ~17-~17: There might be a mistake here. Context: ...ed** - `messageId`: Content-based ID - `data`: Base64-encoded data message - `pho... (QB_NEW_EN) --- [grammar] ~18-~18: There might be a mistake here. Context: ... - `data`: Base64-encoded data message - `phoneNumber`: Sender's number - `simNumber`: SIM... (QB_NEW_EN) --- [grammar] ~19-~19: There might be a mistake here. Context: ...age - `phoneNumber`: Sender's number - `simNumber`: SIM index (nullable) - `receivedAt... (QB_NEW_EN) --- [grammar] ~20-~20: There might be a mistake here. Context: ... - `simNumber`: SIM index (nullable) - `receivedAt`: Local timestamp - :material-multimedi... (QB_NEW_EN) --- [grammar] ~23-~23: There might be a mistake here. Context: ... - :material-multimedia: **mms:received** - `messageId`: Carrier-generated ID, if available, sa... (QB_NEW_EN) --- [grammar] ~24-~24: There might be a mistake here. Context: ...lable, same as `transactionId` otherwise - `transactionId`: Unique MMS transaction identifier ... (QB_NEW_EN) --- [grammar] ~25-~25: There might be a mistake here. Context: ...onId`: Unique MMS transaction identifier - `subject`: Message subject line (nullable) - ... (QB_NEW_EN) --- [grammar] ~26-~26: There might be a mistake here. Context: ...ubject`: Message subject line (nullable) - `size`: Attachment size in bytes - `conten... (QB_NEW_EN) --- [grammar] ~27-~27: There might be a mistake here. Context: ...) - `size`: Attachment size in bytes - `contentClass`: MMS content classification (nullable) ... (QB_NEW_EN) --- [grammar] ~28-~28: There might be a mistake here. Context: ...`: MMS content classification (nullable) - `phoneNumber`: Sender's number - `simNumber`: SIM... (QB_NEW_EN) --- [grammar] ~29-~29: There might be a mistake here. Context: ...le) - `phoneNumber`: Sender's number - `simNumber`: SIM index (nullable) - `receivedAt... (QB_NEW_EN) --- [grammar] ~30-~30: There might be a mistake here. Context: ... - `simNumber`: SIM index (nullable) - `receivedAt`: Local timestamp - :outbox_tray: **sms... (QB_NEW_EN) --- [style] ~154-~154: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym. Context: ...`**: Send a data SMS to port 53739. - **For `mms:received`**: Send an MMS message t... (ENGLISH_WORD_REPEAT_BEGINNING_RULE) </details> </details> <details> <summary>🪛 markdownlint-cli2 (0.17.2)</summary> <details> <summary>docs/features/webhooks.md</summary> 17-17: Unordered list indentation Expected: 2; Actual: 4 (MD007, ul-indent) --- 18-18: Unordered list indentation Expected: 2; Actual: 4 (MD007, ul-indent) --- 19-19: Unordered list indentation Expected: 2; Actual: 4 (MD007, ul-indent) --- 20-20: Unordered list indentation Expected: 2; Actual: 4 (MD007, ul-indent) --- 21-21: Unordered list indentation Expected: 2; Actual: 4 (MD007, ul-indent) --- 24-24: Unordered list indentation Expected: 2; Actual: 4 (MD007, ul-indent) --- 25-25: Unordered list indentation Expected: 2; Actual: 4 (MD007, ul-indent) --- 26-26: Unordered list indentation Expected: 2; Actual: 4 (MD007, ul-indent) --- 27-27: Unordered list indentation Expected: 2; Actual: 4 (MD007, ul-indent) --- 28-28: Unordered list indentation Expected: 2; Actual: 4 (MD007, ul-indent) --- 29-29: Unordered list indentation Expected: 2; Actual: 4 (MD007, ul-indent) --- 30-30: Unordered list indentation Expected: 2; Actual: 4 (MD007, ul-indent) --- 31-31: Unordered list indentation Expected: 2; Actual: 4 (MD007, ul-indent) </details> </details> </details> </details> <!-- This is an auto-generated comment by CodeRabbit for review status -->
capcom6
force-pushed
the
webhooks/include-mms-support
branch
from
c1530e7 to
e989bc6
Compare
There was a problem hiding this comment.
Actionable comments posted: 0
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (3)
docs/features/webhooks.md (3)
270-276: Don’t suggest query‑param secrets; prefer HMAC and header tokens.Query params get logged and cached. Recommend header-based auth plus signature verification.
-- **Secure Your Endpoint**: Protect your webhook endpoint against unauthorized access. For example, you can specify authorization key as query-parameter when registering the webhook. +- **Secure Your Endpoint**: Protect your webhook endpoint against unauthorized access. Prefer HMAC signature verification (below) and header-based tokens (e.g., `Authorization` header). Avoid placing secrets in query parameters.
298-318: Go verifier: normalize and compare bytes in constant time.Decode the provided hex signature and compare byte slices; handle case/whitespace.
@@ - func VerifySignature(secretKey, payload, timestamp, signature string) bool { - message := payload + timestamp - mac := hmac.New(sha256.New, []byte(secretKey)) - mac.Write([]byte(message)) - expectedMAC := mac.Sum(nil) - expectedSignature := hex.EncodeToString(expectedMAC) - - return hmac.Equal([]byte(expectedSignature), []byte(signature)) - } + func VerifySignature(secretKey, payload, timestamp, signature string) bool { + message := payload + timestamp + mac := hmac.New(sha256.New, []byte(secretKey)) + mac.Write([]byte(message)) + expectedMAC := mac.Sum(nil) + // normalize provided signature + sig := strings.ToLower(strings.TrimSpace(signature)) + provided, err := hex.DecodeString(sig) + if err != nil || len(provided) != len(expectedMAC) { + return false + } + return hmac.Equal(expectedMAC, provided) + }Add import:
import ( "crypto/hmac" "crypto/sha256" "encoding/hex" + "strings" )
320-331: Python verifier: compare decoded bytes; normalize input.Avoid string comparison; use bytes and constant‑time compare.
-def verify_signature(secret_key: str, payload: str, timestamp: str, signature: str) -> bool: - message = (payload + timestamp).encode() - expected_signature = hmac.new(secret_key.encode(), message, hashlib.sha256).hexdigest() - return hmac.compare_digest(expected_signature, signature) +def verify_signature(secret_key: str, payload: str, timestamp: str, signature: str) -> bool: + message = (payload + timestamp).encode() + expected = hmac.new(secret_key.encode(), message, hashlib.sha256).digest() + sig = (signature or "").strip().lower() + try: + provided = bytes.fromhex(sig) + except ValueError: + return False + if len(provided) != len(expected): + return False + return hmac.compare_digest(expected, provided)
♻️ Duplicate comments (4)
docs/index.md (2)
7-7: Clarify MMS webhook payloads: metadata only, no attachments.Avoid implying attachments are delivered via webhooks; point to details.
-SMS Gateway for Android turns your Android smartphone into an SMS and MMS gateway. It's a lightweight application that allows you to send SMS messages programmatically via an API and receive webhooks on incoming SMS and MMS messages. This makes it ideal for integrating messaging functionality into your own applications or services. +SMS Gateway for Android turns your Android smartphone into an SMS and MMS gateway. It's a lightweight application that allows you to send SMS messages programmatically via an API and receive webhooks on incoming SMS and MMS messages. MMS webhooks include message metadata (subject, size, etc.) but not attachment content. See the Webhooks page for details. This makes it ideal for integrating messaging functionality into your own applications or services.
24-25: Nice correction: real-time vs history separation is clear.Webhooks for real-time; Reading Messages for history looks good.
docs/features/webhooks.md (2)
23-31: Add explicit “attachments not included” note under mms:received.Prevents incorrect assumptions; link to Reading Messages.
- :material-multimedia: **mms:received** - `messageId`: Carrier-generated ID, if available, same as `transactionId` otherwise - `transactionId`: Unique MMS transaction identifier - `subject`: Message subject line (nullable) - `size`: Attachment size in bytes - `contentClass`: MMS content classification (nullable) - `phoneNumber`: Sender's number - `simNumber`: SIM index (nullable) - `receivedAt`: Local timestamp + +!!! note "MMS attachments are not included" + The webhook provides MMS metadata only; attachment content (images, video, audio) is not delivered in the payload. + See [Reading Messages](../features/reading-messages.md) for retrieving message content/history.
345-350: Good fix: timingSafeEqual on decoded hex with length check.Prevents exceptions and compares raw bytes. Nice.
🧹 Nitpick comments (5)
docs/features/multi-device.md (2)
49-57: Confirm API casing differences (deviceId vs device_id).Send API uses camelCase
deviceIdwhile webhook registration uses snake_casedevice_id. If intentional, add a short note to reduce confusion.=== ":material-target: Explicit Selection" @@ - "deviceId": "dev_abc123" + "deviceId": "dev_abc123" }' ``` + +!!! note "Parameter naming across APIs" + Message-sending APIs use `deviceId` (camelCase), whereas webhook registration uses `device_id` (snake_case). + This is expected.
80-81: Scope of deletion: clarify server vs device storage and backups.State whether removing a device deletes server-side records only or also wipes messages on the device/SIM. Recommend exporting/backing up before deletion.
-!!! danger "Device Removal Warning" - Deleting a device will remove all associated messages, including pending ones. This action cannot be undone. +!!! danger "Device Removal Warning" + Deleting a device will remove all associated messages (server‑side), including pending ones. This action cannot be undone. + It does not erase messages stored on the physical device/SIM. + Export or back up any required data before removal.docs/features/webhooks.md (1)
152-155: Minor style: reduce repetitive “For …” openers.Optional readability tweak.
-- **For `sms:received`**: Send an SMS to the device. -- **For `sms:data-received`**: Send a data SMS to port 53739. -- **For `mms:received`**: Send an MMS message to the device. +- `sms:received`: Send an SMS to the device. +- `sms:data-received`: Send a data SMS to port 53739. +- `mms:received`: Send an MMS to the device.docs/faq/webhooks.md (2)
49-51: Add ADB reverse snippet for localhost guidance.Concrete example improves DX and matches Webhooks page.
-2. **Localhost with Reverse Port Forwarding** - Use `127.0.0.1` with ADB reverse port forwarding to access local servers +2. **Localhost with Reverse Port Forwarding** + Use `127.0.0.1` with ADB reverse port forwarding to access local servers: + ```bash + adb reverse tcp:9876 tcp:8080 + ``` + Then register the webhook to `http://127.0.0.1:9876/webhook`.
174-177: Link to retrieval docs from MMS attachments answer.Make the next step obvious.
-The webhook system provides MMS metadata but does **not** include actual attachment content. +The webhook system provides MMS metadata but does **not** include actual attachment content. +See [Reading Messages](../features/reading-messages.md) for retrieving message content/history.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (4)
docs/faq/webhooks.md(9 hunks)docs/features/multi-device.md(4 hunks)docs/features/webhooks.md(5 hunks)docs/index.md(2 hunks)
🧰 Additional context used
🪛 LanguageTool
docs/faq/webhooks.md
[grammar] ~30-~30: There might be a mistake here.
Context: ... with an HTTP server without encryption? Due to Android OS security requirements ...
(QB_NEW_EN)
[grammar] ~128-~128: There might be a mistake here.
Context: ...e delivery reports for a single message? When sending SMS messages longer than th...
(QB_NEW_EN)
[grammar] ~154-~154: There might be a mistake here.
Context: ...dio) ``` Verification Steps: - [ ] Check if message has multimedia atta...
(QB_NEW_EN)
[grammar] ~164-~164: There might be a mistake here.
Context: ...ed ``` Required Permissions: - [ ] SMS permission - [ ] MMS permiss...
(QB_NEW_EN)
[grammar] ~165-~165: There might be a mistake here.
Context: ... Permissions**: - [ ] SMS permission - [ ] MMS permission 3. **Webhook Registr...
(QB_NEW_EN)
docs/features/webhooks.md
[grammar] ~1-~1: There might be a mistake here.
Context: # 🌐 Webhooks Webhooks offer a powerful mechanism to r...
(QB_NEW_EN)
[grammar] ~5-~5: There might be a mistake here.
Context: ...rom your device. ## 📩 Supported Events
(QB_NEW_EN)
[grammar] ~16-~16: There might be a mistake here.
Context: ... :material-database: sms:data-received - messageId: Content-based ID - data: Base64-...
(QB_NEW_EN)
[grammar] ~17-~17: There might be a mistake here.
Context: ...ed** - messageId: Content-based ID - data: Base64-encoded data message - `pho...
(QB_NEW_EN)
[grammar] ~18-~18: There might be a mistake here.
Context: ... - data: Base64-encoded data message - phoneNumber: Sender's number - simNumber: SIM...
(QB_NEW_EN)
[grammar] ~19-~19: There might be a mistake here.
Context: ...age - phoneNumber: Sender's number - simNumber: SIM index (nullable) - `receivedAt...
(QB_NEW_EN)
[grammar] ~20-~20: There might be a mistake here.
Context: ... - simNumber: SIM index (nullable) - receivedAt: Local timestamp - :material-multimedi...
(QB_NEW_EN)
[grammar] ~23-~23: There might be a mistake here.
Context: ... - :material-multimedia: mms:received - messageId: Carrier-generated ID, if available, sa...
(QB_NEW_EN)
[grammar] ~24-~24: There might be a mistake here.
Context: ...lable, same as transactionId otherwise - transactionId: Unique MMS transaction identifier ...
(QB_NEW_EN)
[grammar] ~25-~25: There might be a mistake here.
Context: ...onId: Unique MMS transaction identifier - subject`: Message subject line (nullable) - ...
(QB_NEW_EN)
[grammar] ~26-~26: There might be a mistake here.
Context: ...ubject: Message subject line (nullable) - size: Attachment size in bytes - conten...
(QB_NEW_EN)
[grammar] ~27-~27: There might be a mistake here.
Context: ...) - size: Attachment size in bytes - contentClass: MMS content classification (nullable) ...
(QB_NEW_EN)
[grammar] ~28-~28: There might be a mistake here.
Context: ...: MMS content classification (nullable) - phoneNumber: Sender's number - simNumber`: SIM...
(QB_NEW_EN)
[grammar] ~29-~29: There might be a mistake here.
Context: ...le) - phoneNumber: Sender's number - simNumber: SIM index (nullable) - `receivedAt...
(QB_NEW_EN)
[grammar] ~30-~30: There might be a mistake here.
Context: ... - simNumber: SIM index (nullable) - receivedAt: Local timestamp - 📤 **sms...
(QB_NEW_EN)
[style] ~154-~154: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...**: Send a data SMS to port 53739. - **For mms:received`**: Send an MMS message t...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
docs/features/multi-device.md
[grammar] ~1-~1: There might be a mistake here.
Context: # 📱📱 Multi-Device Support The app supports multiple devices for a ...
(QB_NEW_EN)
[grammar] ~37-~37: There might be a mistake here.
Context: ...h "Continue" ## 📨 Message Distribution === ":fontawesome-solid-dice: Random Sel...
(QB_NEW_EN)
docs/index.md
[grammar] ~1-~1: There might be a mistake here.
Context: # 🚀 SMS Gateway for Android™
(QB_NEW_EN)
[grammar] ~25-~25: There might be a mistake here.
Context: ...Messages](./features/reading-messages/). 🔒 Security and Privacy: - 🔐 **End-to-...
(QB_NEW_EN)
🪛 markdownlint-cli2 (0.17.2)
docs/features/webhooks.md
17-17: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
18-18: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
19-19: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
20-20: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
21-21: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
24-24: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
25-25: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
26-26: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
27-27: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
28-28: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
29-29: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
30-30: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
31-31: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Cloudflare Pages
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
docs/features/webhooks.md (2)
298-318: Harden Go verification: compare bytes, decode hex, check lengthCompare raw MAC bytes to decoded hex signature and guard against decoding errors/length mismatches.
import ( "crypto/hmac" "crypto/sha256" "encoding/hex" + "strings" ) @@ - expectedMAC := mac.Sum(nil) - expectedSignature := hex.EncodeToString(expectedMAC) - - return hmac.Equal([]byte(expectedSignature), []byte(signature)) + expectedMAC := mac.Sum(nil) + sig, err := hex.DecodeString(strings.TrimSpace(signature)) + if err != nil || len(sig) != len(expectedMAC) { + return false + } + return hmac.Equal(expectedMAC, sig)
322-331: Harden Python verification: compare bytes, decode hex, check lengthCompare byte arrays, normalize input, and handle bad hex safely.
-def verify_signature(secret_key: str, payload: str, timestamp: str, signature: str) -> bool: - message = (payload + timestamp).encode() - expected_signature = hmac.new(secret_key.encode(), message, hashlib.sha256).hexdigest() - return hmac.compare_digest(expected_signature, signature) +def verify_signature(secret_key: str, payload: str, timestamp: str, signature: str) -> bool: + message = (payload + timestamp).encode() + expected = hmac.new(secret_key.encode(), message, hashlib.sha256).digest() + try: + sig = bytes.fromhex(signature.strip()) + except ValueError: + return False + if len(sig) != len(expected): + return False + return hmac.compare_digest(expected, sig)
♻️ Duplicate comments (1)
docs/features/webhooks.md (1)
345-350: Good fix: constant‑time compare uses hex bytes with length checkThis resolves exceptions from
timingSafeEqualon unequal lengths and avoids UTF‑8 string comparisons.
🧹 Nitpick comments (3)
docs/features/webhooks.md (3)
16-31: Fix list indentation to satisfy markdownlint (MD007)Nested field bullets are indented by 4 spaces under the event list; linter expects 2. Apply consistently to all event field lists.
Example for the
mms:receivedblock:- - `messageId`: ... - - `transactionId`: ... - - `subject`: ... - - `size`: ... - - `contentClass`: ... - - `phoneNumber`: ... - - `simNumber`: ... - - `receivedAt`: ... + - `messageId`: ... + - `transactionId`: ... + - `subject`: ... + - `size`: ... + - `contentClass`: ... + - `phoneNumber`: ... + - `simNumber`: ... + - `receivedAt`: ...
196-215: Align MMS example with the field contract and phone number formatThe example mixes national format (“6505551212”) in SMS examples and E.164 (“+123…”) here. Pick one format (recommend E.164) and state it. Also confirm whether
simNumbercan be null and reflect that in at least one example.Suggested minimal additions after the example:
} ``` + +!!! tip "Phone number format" + Examples use E.164 format (`+<countrycode><number>`). Normalize incoming numbers to E.164 in your handlers. + +!!! note "Nullable fields" + `simNumber` may be `null` if a SIM index is not available on the device.
216-222: Add idempotency guidance for retriesMake handlers safe against duplicates and retries by keying on stable identifiers.
#### Retry Policy @@ The app implements an exponential backoff retry strategy: it waits 10 seconds before the first retry, then 20 seconds, 40 seconds, and so on, doubling the interval each time. By default, the app will retry 14 times (approximately 2 days) before giving up. You can specify a custom retry count in the app's **Settings > Webhooks**. + +#### Idempotency +- Treat `id` as the unique event delivery identifier and store it to deduplicate retries. +- Use `messageId` to group related deliveries for the same message.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
docs/features/webhooks.md(6 hunks)
🧰 Additional context used
🪛 LanguageTool
docs/features/webhooks.md
[grammar] ~1-~1: There might be a mistake here.
Context: # 🌐 Webhooks Webhooks offer a powerful mechanism to r...
(QB_NEW_EN)
[grammar] ~5-~5: There might be a mistake here.
Context: ...rom your device. ## 📩 Supported Events
(QB_NEW_EN)
[grammar] ~16-~16: There might be a mistake here.
Context: ... :material-database: sms:data-received - messageId: Content-based ID - data: Base64-...
(QB_NEW_EN)
[grammar] ~17-~17: There might be a mistake here.
Context: ...ed** - messageId: Content-based ID - data: Base64-encoded data message - `pho...
(QB_NEW_EN)
[grammar] ~18-~18: There might be a mistake here.
Context: ... - data: Base64-encoded data message - phoneNumber: Sender's number - simNumber: SIM...
(QB_NEW_EN)
[grammar] ~19-~19: There might be a mistake here.
Context: ...age - phoneNumber: Sender's number - simNumber: SIM index (nullable) - `receivedAt...
(QB_NEW_EN)
[grammar] ~20-~20: There might be a mistake here.
Context: ... - simNumber: SIM index (nullable) - receivedAt: Local timestamp - :material-multimedi...
(QB_NEW_EN)
[grammar] ~23-~23: There might be a mistake here.
Context: ... - :material-multimedia: mms:received - messageId: Carrier-generated ID, if available, sa...
(QB_NEW_EN)
[grammar] ~24-~24: There might be a mistake here.
Context: ...lable, same as transactionId otherwise - transactionId: Unique MMS transaction identifier ...
(QB_NEW_EN)
[grammar] ~25-~25: There might be a mistake here.
Context: ...onId: Unique MMS transaction identifier - subject`: Message subject line (nullable) - ...
(QB_NEW_EN)
[grammar] ~26-~26: There might be a mistake here.
Context: ...ubject: Message subject line (nullable) - size: Attachment size in bytes - conten...
(QB_NEW_EN)
[grammar] ~27-~27: There might be a mistake here.
Context: ...) - size: Attachment size in bytes - contentClass: MMS content classification (nullable) ...
(QB_NEW_EN)
[grammar] ~28-~28: There might be a mistake here.
Context: ...: MMS content classification (nullable) - phoneNumber: Sender's number - simNumber`: SIM...
(QB_NEW_EN)
[grammar] ~29-~29: There might be a mistake here.
Context: ...le) - phoneNumber: Sender's number - simNumber: SIM index (nullable) - `receivedAt...
(QB_NEW_EN)
[grammar] ~30-~30: There might be a mistake here.
Context: ... - simNumber: SIM index (nullable) - receivedAt: Local timestamp - 📤 **sms...
(QB_NEW_EN)
[grammar] ~154-~154: There might be a mistake here.
Context: ...ved: Send an MMS message to the device. - sms:sent/delivered/failed`: Send an SMS *from...
(QB_NEW_EN)
🪛 markdownlint-cli2 (0.17.2)
docs/features/webhooks.md
17-17: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
18-18: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
19-19: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
20-20: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
21-21: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
24-24: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
25-25: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
26-26: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
27-27: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
28-28: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
29-29: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
30-30: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
31-31: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
🔇 Additional comments (1)
docs/features/webhooks.md (1)
106-118: Confirm API parameter naming for device-specific webhooksPayload uses
deviceId(camelCase) while registration usesdevice_id(snake_case). If intentional, add a short note; otherwise, align the API docs.!!! tip "Device-Specific Webhooks" To register a webhook for a specific device, include the `device_id` parameter in the API request. If the `device_id` is not provided, the webhook will be applied to all devices associated with the account. + + Note: API parameters use `snake_case` (e.g., `device_id`) while JSON payload fields use `camelCase` (e.g., `deviceId`).
capcom6
force-pushed
the
webhooks/include-mms-support
branch
from
00f6508 to
51d3f8f
Compare
There was a problem hiding this comment.
Actionable comments posted: 0
♻️ Duplicate comments (4)
docs/features/webhooks.md (3)
345-350: Good fix: timing‑safe hex comparison in NodeLength check + hex decoding +
timingSafeEqualis correct and avoids exceptions.
23-31: Fix MMS messageId semantics and add “attachments not included” noteCurrent bullets imply
messageIdmirrorstransactionId; the JSON shows distinct IDs. Also make attachment policy explicit.- - `messageId`: Carrier-generated ID, if available, same as `transactionId` otherwise + - `messageId`: Gateway-generated stable ID. If a carrier `transactionId` is available, both may be present and differ. @@ - `receivedAt`: Local timestamp + +!!! note "MMS attachments are not included" + The webhook payload contains MMS metadata only; attachment content (images, video, audio, etc.) is not included. + See [Reading Messages](../features/reading-messages.md) for retrieving message content/history.
196-215: Reinforce MMS attachment policy under the payload exampleAdd a short note right below the example to prevent integrators from expecting media bytes in the webhook.
} ``` + +!!! note + MMS webhooks include metadata only; attachment files are not sent in the webhook. Retrieve media via your message history workflow.docs/index.md (1)
7-7: Clarify MMS webhook contents (metadata only, no attachments)Avoid implying that media bytes are delivered via webhook.
-SMS Gateway for Android turns your Android smartphone into an SMS and MMS gateway. It's a lightweight application that allows you to send SMS messages programmatically via an API and receive webhooks on incoming SMS and MMS messages. This makes it ideal for integrating messaging functionality into your own applications or services. +SMS Gateway for Android turns your Android smartphone into an SMS and MMS gateway. It's a lightweight application that allows you to send SMS messages programmatically via an API and receive webhooks on incoming SMS and MMS messages. MMS webhooks include message metadata (subject, size, etc.) but not attachment files. This makes it ideal for integrating messaging functionality into your own applications or services.
🧹 Nitpick comments (8)
docs/features/multi-device.md (3)
39-47: Add API docs link for Send Message endpointProvide a quick link to the Send Message API for consistency with the Device Management section.
=== ":fontawesome-solid-dice: Random Selection (Default)" ```bash curl https://api.sms-gate.app/3rdparty/v1/messages \ -u "username:password" \ --json '{ "textMessage": {"text": "Test message"}, "phoneNumbers": ["+19162255887"] }'--- `80-82`: **Clarify scope of deletion and retention** State whether deletion removes the device only from Cloud/Private lists or also purges server-side history; mention any retention/backups if applicable. --- `62-79`: **Document pagination/filters for List Devices** If the API paginates or supports filters, add flags and response shape to prevent client-side guesswork. </blockquote></details> <details> <summary>docs/features/webhooks.md (4)</summary><blockquote> `219-221`: **Call out idempotency for retries** Mention that handlers should dedupe using the top-level `id` to remain idempotent across retries. ```diff The app implements an exponential backoff retry strategy: it waits 10 seconds before the first retry, then 20 seconds, 40 seconds, and so on, doubling the interval each time. By default, the app will retry 14 times (approximately 2 days) before giving up. You can specify a custom retry count in the app's **Settings > Webhooks**. + +!!! tip "Idempotency" + Make your handler idempotent. Use the event `id` to deduplicate retried deliveries.
109-117: Clarifydevice_idvsdeviceIdnamingPayloads use
deviceIdwhile registration usesdevice_id. Add a one‑liner to avoid confusion.!!! tip "Device-Specific Webhooks" To register a webhook for a specific device, include the `device_id` parameter in the API request. If the `device_id` is not provided, the webhook will be applied to all devices associated with the account. + Note: API parameters use `snake_case` (e.g., `device_id`), while payload fields use `camelCase` (e.g., `deviceId`).
10-22: Verify “Content-based ID” terminologyConfirm whether
messageIdis a content hash or a gateway-generated ID; if not content-derived, rename to “Gateway-generated stable ID” for accuracy.- - `messageId`: Content-based ID + - `messageId`: Gateway-generated stable ID
5-31: Fix list indentation to satisfy MD007Adjust nested list indentation under “Supported Events” to the expected 2 spaces to appease markdownlint.
docs/faq/webhooks.md (1)
174-177: Link to retrieval docs for MMS attachmentsAdd a direct pointer to the Reading Messages guide so users know how to get media.
-The webhook system provides MMS metadata but does **not** include actual attachment content. +The webhook system provides MMS metadata but does **not** include actual attachment content. +See [Reading Messages](../features/reading-messages.md) for retrieving message history and media.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (4)
docs/faq/webhooks.md(9 hunks)docs/features/multi-device.md(4 hunks)docs/features/webhooks.md(6 hunks)docs/index.md(2 hunks)
🧰 Additional context used
🪛 LanguageTool
docs/features/multi-device.md
[grammar] ~1-~1: There might be a mistake here.
Context: # 📱📱 Multi-Device Support The app supports multiple devices for a ...
(QB_NEW_EN)
[grammar] ~37-~37: There might be a mistake here.
Context: ...h "Continue" ## 📨 Message Distribution === ":fontawesome-solid-dice: Random Sel...
(QB_NEW_EN)
docs/features/webhooks.md
[grammar] ~1-~1: There might be a mistake here.
Context: # 🌐 Webhooks Webhooks offer a powerful mechanism to r...
(QB_NEW_EN)
[grammar] ~5-~5: There might be a mistake here.
Context: ...rom your device. ## 📩 Supported Events
(QB_NEW_EN)
[grammar] ~16-~16: There might be a mistake here.
Context: ... :material-database: sms:data-received - messageId: Content-based ID - data: Base64-...
(QB_NEW_EN)
[grammar] ~17-~17: There might be a mistake here.
Context: ...ed** - messageId: Content-based ID - data: Base64-encoded data message - `pho...
(QB_NEW_EN)
[grammar] ~18-~18: There might be a mistake here.
Context: ... - data: Base64-encoded data message - phoneNumber: Sender's number - simNumber: SIM...
(QB_NEW_EN)
[grammar] ~19-~19: There might be a mistake here.
Context: ...age - phoneNumber: Sender's number - simNumber: SIM index (nullable) - `receivedAt...
(QB_NEW_EN)
[grammar] ~20-~20: There might be a mistake here.
Context: ... - simNumber: SIM index (nullable) - receivedAt: Local timestamp - :material-multimedi...
(QB_NEW_EN)
[grammar] ~23-~23: There might be a mistake here.
Context: ... - :material-multimedia: mms:received - messageId: Carrier-generated ID, if available, sa...
(QB_NEW_EN)
[grammar] ~24-~24: There might be a mistake here.
Context: ...lable, same as transactionId otherwise - transactionId: Unique MMS transaction identifier ...
(QB_NEW_EN)
[grammar] ~25-~25: There might be a mistake here.
Context: ...onId: Unique MMS transaction identifier - subject`: Message subject line (nullable) - ...
(QB_NEW_EN)
[grammar] ~26-~26: There might be a mistake here.
Context: ...ubject: Message subject line (nullable) - size: Attachment size in bytes - conten...
(QB_NEW_EN)
[grammar] ~27-~27: There might be a mistake here.
Context: ...) - size: Attachment size in bytes - contentClass: MMS content classification (nullable) ...
(QB_NEW_EN)
[grammar] ~28-~28: There might be a mistake here.
Context: ...: MMS content classification (nullable) - phoneNumber: Sender's number - simNumber`: SIM...
(QB_NEW_EN)
[grammar] ~29-~29: There might be a mistake here.
Context: ...le) - phoneNumber: Sender's number - simNumber: SIM index (nullable) - `receivedAt...
(QB_NEW_EN)
[grammar] ~30-~30: There might be a mistake here.
Context: ... - simNumber: SIM index (nullable) - receivedAt: Local timestamp - 📤 **sms...
(QB_NEW_EN)
[grammar] ~154-~154: There might be a mistake here.
Context: ...ved: Send an MMS message to the device. - sms:sent/delivered/failed`: Send an SMS *from...
(QB_NEW_EN)
docs/faq/webhooks.md
[grammar] ~30-~30: There might be a mistake here.
Context: ... with an HTTP server without encryption? Due to Android OS security requirements ...
(QB_NEW_EN)
[grammar] ~128-~128: There might be a mistake here.
Context: ...e delivery reports for a single message? When sending SMS messages longer than th...
(QB_NEW_EN)
[grammar] ~154-~154: There might be a mistake here.
Context: ...dio) ``` Verification Steps: - [ ] Check if message has multimedia atta...
(QB_NEW_EN)
[grammar] ~164-~164: There might be a mistake here.
Context: ...ed ``` Required Permissions: - [ ] SMS permission - [ ] MMS permiss...
(QB_NEW_EN)
[grammar] ~165-~165: There might be a mistake here.
Context: ... Permissions**: - [ ] SMS permission - [ ] MMS permission 3. **Webhook Registr...
(QB_NEW_EN)
docs/index.md
[grammar] ~1-~1: There might be a mistake here.
Context: # 🚀 SMS Gateway for Android™
(QB_NEW_EN)
[grammar] ~25-~25: There might be a mistake here.
Context: ...Messages](./features/reading-messages/). 🔒 Security and Privacy: - 🔐 **End-to-...
(QB_NEW_EN)
🪛 markdownlint-cli2 (0.17.2)
docs/features/webhooks.md
17-17: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
18-18: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
19-19: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
20-20: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
21-21: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
24-24: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
25-25: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
26-26: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
27-27: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
28-28: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
29-29: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
30-30: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
31-31: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
🔇 Additional comments (3)
docs/index.md (1)
24-25: LGTM: “Retrieve previously received messages” wordingClearer phrasing and correct linkage to Reading Messages.
docs/faq/webhooks.md (2)
128-144: LGTM: Multipart delivery explanationAccurate overview and cross-link to the feature page.
30-57: LGTM: HTTPS/Local-network guidanceLoopback exception and private-IP HTTPS requirements are stated clearly with workable options.
1 participant
Summary by CodeRabbit
New Features
Documentation
Security
Style