feat: Adding option for insecure mail servers

[RayaneB75]

What kind of change does this PR introduce?

This feature allows user to use insecure mail servers (i.e. invalid TLS certificate)

What is the current behavior?

Currently, mailme doesn't send email triggering "x509: certificate signed by unknown authority" in logs.

What is the new behavior?

The mail should now be sent if the user sets the boolean parameter Insecure to TRUE

Additional context

This PR depends on mailme following PR : supabase/mailme#7

[kangmingtay]

hi @RayaneB75, thanks for contributing but i don't think this is something we want to add - emails sent by gotrue contain the user's email confirmation link or a one-time password (OTP) and we wouldn't want them to be sent through an insecure mail server.

[RayaneB75]

Hi, I understand your concern, however, I know that some environments might not be able to implement TLS certificates verifications for mails, and that's my case.
That's why this setting should be set as FALSE by default, still, letting users choose to enable it or keep it secure.

[kangmingtay]

might not be able to implement TLS certificates verifications for mails, and that's my case.

@RayaneB75 hmm can you elaborate more on why this is not possible? are you using a SMTP service like AWS SES / SendGrid / Resend or are you using an in-house implementation?

[RayaneB75]

might not be able to implement TLS certificates verifications for mails, and that's my case.

@RayaneB75 hmm can you elaborate more on why this is not possible? are you using a SMTP service like AWS SES / SendGrid / Resend or are you using an in-house implementation?

In our in-house mail implementation, for several reasons I can't elaborate here, we need to contact our mail server with it's mail.intra.example.com name, but this mail server provides a mail.example.com x509 certificate (for external queries). Thus, GOTRUE sends a failure when I try to send the OTP mail because the domain name on the certificate doesn't mach the domain name we use.

[kangmingtay]

@RayaneB75 unfortunately, i don't see a compelling reason why this change (which makes it insecure by default) should go in - if you really need to use an insecure mail server, you can do it by creating a "send email" hook (https://supabase.com/docs/guides/auth/auth-hooks/send-email-hook?queryGroups=language&language=http) and making a request to your SMTP server directly