toiljs 0.0.96 → 0.0.98

package/src/devserver/email/config.ts

@@ -80,16 +80,20 @@ export function resolveEmailConfig(
     if (!validFrom(from)) {
         return { config: null, warning: 'email `from` is not a valid address (CRLF or no `@`)' };
     }
-    if (apiKey === undefined) {
-        return {
-            config: null,
-            warning: 'email config present but TOIL_EMAIL_API_KEY is not set (in .env.secrets)',
-        };
-    }
-
+    // The API-key requirement is PER PROVIDER: Resend authenticates with a key, and
+    // Gmail SMTP needs an app password (also carried in the key), but a plain SMTP
+    // relay (a local dev catch-all like Mailpit/MailHog on 127.0.0.1, or an internal
+    // open relay) needs NO credential. Requiring a key for plain SMTP silently
+    // disabled a perfectly good local-SMTP dev setup.
     let provider: ResolvedProvider;
     let smtp: ResolvedSmtp | undefined;
     if (providerId === 'resend') {
+        if (apiKey === undefined) {
+            return {
+                config: null,
+                warning: 'provider `resend` requires TOIL_EMAIL_API_KEY (in .env.secrets)',
+            };
+        }
         provider = 'resend';
     } else if (providerId === 'gmail' || providerId === 'smtp') {
         provider = 'smtp';
@@ -101,6 +105,14 @@ export function resolveEmailConfig(
         if (!host) {
             return { config: null, warning: 'provider `smtp` requires TOIL_EMAIL_SMTP_HOST' };
         }
+        // Gmail always needs an app password; plain SMTP may be auth-less (the send
+        // path omits `auth` when the key is empty). See providers.ts sendSmtp.
+        if (isGmail && apiKey === undefined) {
+            return {
+                config: null,
+                warning: 'provider `gmail` requires TOIL_EMAIL_API_KEY (a Gmail app password)',
+            };
+        }
         const port = parseInt0(envOf(reserved, 'SMTP_PORT'), c.smtp?.port ?? 0) || 587;
         const user = envOf(reserved, 'SMTP_USER') ?? c.smtp?.user?.trim() ?? from;
         smtp = { host, port, user };
@@ -115,7 +127,7 @@ export function resolveEmailConfig(
         config: {
             provider,
             from,
-            apiKey,
+            apiKey: apiKey ?? '',
             maxPerMin: parseInt0(envOf(reserved, 'MAX_PER_MIN'), c.maxPerMin ?? 60),
             maxPerDay: parseInt0(envOf(reserved, 'MAX_PER_DAY'), c.maxPerDay ?? 0),
             maxPerRecipientPerHour: parseInt0(

package/src/devserver/email/providers.ts

@@ -91,7 +91,8 @@ export async function sendSmtp(
             host: smtp.host,
             port: smtp.port,
             secure: smtp.port === 465, // 465 = implicit TLS; else STARTTLS
-            auth: { user: smtp.user, pass: cfg.apiKey },
+            // Auth only when there is a credential; a local/auth-less relay takes none.
+            auth: cfg.apiKey.length > 0 ? { user: smtp.user, pass: cfg.apiKey } : undefined,
             connectionTimeout: POST_TIMEOUT_MS,
             greetingTimeout: POST_TIMEOUT_MS,
         });

package/src/devserver/runtime/host.ts

@@ -228,6 +228,11 @@ function devEmailSend(ref: MemoryRef, reqPtr: number, reqLen: number): number {
     const { status, parsed } = svc.prepare(raw);
     if (parsed === null) {
         process.stdout.write(`  ✉ dev email_send -> ${EmailStatus[status]}\n`);
+        // The real send was skipped (bad recipient / deduped / budget / cap), but in
+        // DEV still draw the email so its link/code stays testable. Not recorded to
+        // the test seam (that tracks accepted sends only).
+        const skipped = parseEmailBlob(raw);
+        if (skipped !== null) previewDevEmail(skipped, EmailStatus[status]);
         return status;
     }
     recordSentEmail(parsed); // dev test seam

package/test/devserver-email.test.ts

@@ -154,6 +154,24 @@ describe('config resolution', () => {
             resolveEmailConfig({ from: 'a@b.com' }, reserved({ TOIL_EMAIL_API_KEY: 'k', TOIL_EMAIL_PROVIDER: 'mailgun' }))
                 .warning,
         ).toMatch(/unknown/);
+        // gmail still needs an app password
+        expect(
+            resolveEmailConfig({ provider: 'gmail', from: 'me@gmail.com' }, reserved({})).warning,
+        ).toMatch(/gmail/);
+    });
+
+    it('plain SMTP needs NO api key (a local / auth-less relay)', () => {
+        const { config, warning } = resolveEmailConfig(
+            { provider: 'smtp', from: 'dev@dacely.local' },
+            reserved({ TOIL_EMAIL_SMTP_HOST: '127.0.0.1' }),
+        );
+        expect(warning).toBeNull();
+        expect(config).toMatchObject({
+            provider: 'smtp',
+            from: 'dev@dacely.local',
+            apiKey: '', // no credential -> the send path omits SMTP auth
+            smtp: { host: '127.0.0.1', port: 587 },
+        });
     });
 
     it('TOIL_EMAIL_ENABLED=false disables silently', () => {