Email auth not required - #3890
Conversation
Google Workspace and other providers that use IP allowlisting instead of SMTP auth don't need a password, but the settings form blocked sending a test email or enabling the send button unless one was entered. Backend already treats systemEmailPassword as optional. Fixes bluewave-labs#3866 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013JWcKM6uh6S9VnVmTEpNNi
…email The test-email button no longer requires a password, but the form's systemEmailPassword default is always "" when a password is already saved (the backend never echoes it back, only an emailPasswordSet flag). Sending it unconditionally meant clicking "Send Test Email" without re-entering credentials silently posted an empty password, overriding a working authenticated config for that test. Only include systemEmailPassword in the test-email payload when the user actually typed one, matching the existing conditional pattern for the other optional email fields. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013JWcKM6uh6S9VnVmTEpNNi
sanmaxdev
left a comment
sanmaxdev
left a comment
There was a problem hiding this comment.
Blocking: this removes the client-side password requirement, but EmailService still always passes an auth object with user: systemEmailUser || systemEmailAddress and the optional password. Nodemailer treats that shape as LOGIN even when the password is absent, so an IP-allowlisted relay still attempts SMTP authentication.
Please omit auth from the transport configuration when no credentials are configured, and add a unit test for the no-auth transport shape in emailService.test.ts.
nodemailer treats the presence of an `auth` object as a request for LOGIN authentication, even when `pass` is empty/undefined, so relays that use IP allowlisting instead of SMTP auth (e.g. Google Workspace) would still have authentication attempted against them and fail. Only attach `auth` to the transport config when systemEmailPassword is actually set, and add unit tests covering both the no-auth and with-auth transport shapes. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013JWcKM6uh6S9VnVmTEpNNi
|
@sanmaxdev Thanks for the catch - fixed in 46a822d. |
3 participants
Describe your changes
The email settings form required an SMTP password before a test email could be sent or the "Send Test Email" button enabled, even though the backend already treats
systemEmailPasswordas optional. Providers like Google Workspace that use IP allowlisting instead of SMTP auth have no password to enter, so the form blocked a valid configuration.handleSendTestEmailand from the "Send Test Email" button'sdisabledcondition — only host, port, and address remain required."", so the test-email request would silently send an empty password and could break a working authenticated config.systemEmailPasswordis now only included in the payload when the user actually enters one, matching the existing pattern used for the other optional email fields.Write your issue number after "Fixes "
Fixes #3866
<div>Add</div>, use): n/a — no new UI strings addednpm run formatin server and client directories, which automatically formats your code.