feat: support plaintext SMTP relays (WI-1106)

Author: stefan-ernst

frontend/src/lib/features/channels/ChannelSMTPConfig.svelte

@@ -90,15 +90,16 @@
   }
 
   export function getConfig() {
+    const plaintext = formData.encryption === 'none';
     return {
       smtp_host: formData.host,
       smtp_port: formData.port || 587,
-      smtp_username: formData.username || '',
-      smtp_password: formData.password || undefined,
+      smtp_username: plaintext ? '' : formData.username || '',
+      smtp_password: plaintext ? '' : formData.password || undefined,
       smtp_from_email: formData.from_email,
       smtp_from_name: formData.from_name || '',
       smtp_encryption: formData.encryption || 'tls',
-      smtp_skip_tls_verify: formData.skip_tls_verify || false
+      smtp_skip_tls_verify: plaintext ? false : formData.skip_tls_verify || false
     };
   }
 
@@ -126,37 +127,54 @@
 
       <div>
         <Label color="default" class="mb-2">{t('channel.smtpEncryption')}</Label>
-        <Select bind:value={formData.encryption} options={[{ value: 'tls', label: 'TLS (Port 587)' }, { value: 'ssl', label: 'SSL (Port 465)' }]} />
+        <Select
+          id="smtp-encryption"
+          bind:value={formData.encryption}
+          ariaLabel={t('channel.smtpEncryption')}
+          options={[
+            { value: 'tls', label: 'STARTTLS (Port 587)' },
+            { value: 'ssl', label: 'Implicit TLS (Port 465)' },
+            { value: 'none', label: t('channel.noEncryption') }
+          ]}
+        />
       </div>
 
-      <div class="flex items-start justify-between gap-4">
-        <div>
-          <div class="text-sm font-medium" style="color: var(--ds-text);">
-            {t('channel.smtpSkipTlsVerify')}
+      {#if formData.encryption === 'none'}
+        <div data-testid="smtp-plaintext-warning">
+          <AlertBox variant="warning" message={t('channel.smtpNoEncryptionWarning')} />
+        </div>
+      {:else}
+        <div class="flex items-start justify-between gap-4">
+          <div>
+            <div class="text-sm font-medium" style="color: var(--ds-text);">
+              {t('channel.smtpSkipTlsVerify')}
+            </div>
+            <DescriptionText>{t('channel.smtpSkipTlsVerifyDescription')}</DescriptionText>
           </div>
-          <DescriptionText>{t('channel.smtpSkipTlsVerifyDescription')}</DescriptionText>
+          <Toggle bind:checked={formData.skip_tls_verify} dataTestid="smtp-skip-tls-verify" />
         </div>
-        <Toggle bind:checked={formData.skip_tls_verify} dataTestid="smtp-skip-tls-verify" />
-      </div>
+      {/if}
     </div>
 
     <!-- Authentication -->
-    <div class="pt-4 border-t" style="border-color: var(--ds-border);">
-      <h5 class="text-sm font-semibold mb-3" style="color: var(--ds-text);">{t('channel.authentication')}</h5>
-      <div class="space-y-4">
-        <div>
-          <Label color="default" class="mb-2">{t('channel.smtpUsername')}</Label>
-          <Input type="text" bind:value={formData.username} placeholder={t('channel.smtpUsernamePlaceholder')} />
-        </div>
-        <div>
-          <Label color="default" class="mb-2">{t('channel.smtpPassword')}</Label>
-          <Input type="password" bind:value={formData.password} placeholder={t('channel.secretPlaceholder')} />
-          <DescriptionText>
-            {t('channel.leaveBlankPassword')}
-          </DescriptionText>
+    {#if formData.encryption !== 'none'}
+      <div class="pt-4 border-t" style="border-color: var(--ds-border);">
+        <h5 class="text-sm font-semibold mb-3" style="color: var(--ds-text);">{t('channel.authentication')}</h5>
+        <div class="space-y-4">
+          <div>
+            <Label color="default" class="mb-2">{t('channel.smtpUsername')}</Label>
+            <Input type="text" bind:value={formData.username} placeholder={t('channel.smtpUsernamePlaceholder')} dataTestid="smtp-username" />
+          </div>
+          <div>
+            <Label color="default" class="mb-2">{t('channel.smtpPassword')}</Label>
+            <Input type="password" bind:value={formData.password} placeholder={t('channel.secretPlaceholder')} dataTestid="smtp-password" />
+            <DescriptionText>
+              {t('channel.leaveBlankPassword')}
+            </DescriptionText>
+          </div>
         </div>
       </div>
-    </div>
+    {/if}
 
     <!-- Sender Settings -->
     <div class="pt-4 border-t" style="border-color: var(--ds-border);">

frontend/src/lib/locales/ar/channels.js

@@ -258,6 +258,7 @@ export default {
     smtpEncryption: 'التشفير',
     smtpSkipTlsVerify: 'تخطي التحقق من الشهادة',
     smtpSkipTlsVerifyDescription: 'السماح بالشهادات الموقعة ذاتيًا أو غير الموثوقة لخادم SMTP هذا فقط. يؤدي ذلك إلى إضعاف أمان الاتصال.',
+    smtpNoEncryptionWarning: 'سيتم إرسال محتوى البريد الإلكتروني وبيانات التسليم الوصفية دون تشفير. استخدم هذا الخيار فقط مع مرحل SMTP محلي موثوق.',
     noEncryption: 'بدون تشفير (غير مستحسن)',
     authentication: 'المصادقة',
     senderSettings: 'إعدادات المرسل',

frontend/src/lib/locales/de/channels.js

@@ -245,6 +245,7 @@ export default {
     smtpEncryption: 'Verschlüsselung',
     smtpSkipTlsVerify: 'Zertifikatsprüfung überspringen',
     smtpSkipTlsVerifyDescription: 'Selbstsignierte oder nicht vertrauenswürdige Zertifikate nur für diesen SMTP-Server zulassen. Dies schwächt die Verbindungssicherheit.',
+    smtpNoEncryptionWarning: 'E-Mail-Inhalte und Zustellungsmetadaten werden unverschlüsselt übertragen. Verwenden Sie dies nur mit einem vertrauenswürdigen lokalen SMTP-Relay.',
     noEncryption: 'Keine (nicht empfohlen)',
     authentication: 'Authentifizierung',
     senderSettings: 'Absendereinstellungen',

frontend/src/lib/locales/en/channels.js

@@ -283,6 +283,7 @@ export default {
     smtpEncryption: 'Encryption',
     smtpSkipTlsVerify: 'Skip certificate verification',
     smtpSkipTlsVerifyDescription: 'Allow self-signed or untrusted certificates for this SMTP server only. This weakens connection security.',
+    smtpNoEncryptionWarning: 'Email contents and delivery metadata will be sent without encryption. Use this only with a trusted local SMTP relay.',
     noEncryption: 'None (not recommended)',
     authentication: 'Authentication',
     senderSettings: 'Sender Settings',

frontend/src/lib/locales/es/channels.js

@@ -261,6 +261,7 @@ export default {
     smtpEncryption: 'Cifrado',
     smtpSkipTlsVerify: 'Omitir la verificación del certificado',
     smtpSkipTlsVerifyDescription: 'Permite certificados autofirmados o no confiables solo para este servidor SMTP. Esto reduce la seguridad de la conexión.',
+    smtpNoEncryptionWarning: 'El contenido del correo y los metadatos de entrega se enviarán sin cifrar. Use esta opción solo con un relé SMTP local de confianza.',
     noEncryption: 'Ninguno (no recomendado)',
     authentication: 'Autenticación',
     senderSettings: 'Configuración del remitente',

frontend/src/lib/locales/pt-BR/channels.js

@@ -260,6 +260,7 @@ export default {
     smtpEncryption: 'Criptografia',
     smtpSkipTlsVerify: 'Ignorar verificação do certificado',
     smtpSkipTlsVerifyDescription: 'Permite certificados autoassinados ou não confiáveis somente para este servidor SMTP. Isso reduz a segurança da conexão.',
+    smtpNoEncryptionWarning: 'O conteúdo do e-mail e os metadados de entrega serão enviados sem criptografia. Use esta opção apenas com um relay SMTP local confiável.',
     noEncryption: 'Nenhuma (não recomendado)',
     authentication: 'Autenticação',
     senderSettings: 'Configurações do Remetente',

frontend/src/lib/locales/zh-CN/channels.js

@@ -243,6 +243,7 @@ export default {
     smtpEncryption: '加密',
     smtpSkipTlsVerify: '跳过证书验证',
     smtpSkipTlsVerifyDescription: '仅允许此 SMTP 服务器使用自签名或不受信任的证书。这会降低连接安全性。',
+    smtpNoEncryptionWarning: '邮件内容和投递元数据将不加密发送。仅可将此选项用于受信任的本地 SMTP 中继。',
     noEncryption: '无（不推荐）',
     authentication: '认证',
     senderSettings: '发件人设置',

internal/models/portal.go

@@ -43,7 +43,7 @@ type ChannelConfig struct {
 	SMTPPassword      string `json:"smtp_password,omitempty"`
 	SMTPFromEmail     string `json:"smtp_from_email,omitempty"`
 	SMTPFromName      string `json:"smtp_from_name,omitempty"`
-	SMTPEncryption    string `json:"smtp_encryption,omitempty"` // tls, ssl, none
+	SMTPEncryption    string `json:"smtp_encryption,omitempty"` // tls/starttls, ssl, none
 	SMTPSkipTLSVerify bool   `json:"smtp_skip_tls_verify,omitempty"`
 
 	// Webhook Configuration

internal/services/channel_config_update_service.go

@@ -325,16 +325,16 @@ func (s *ChannelConfigUpdateService) prepareWebhookEnable(config *models.Channel
 }
 
 // prepareSMTPEnable validates an outbound SMTP channel before activation:
-// host, port, from address (as a bare mailbox), and an allowed TLS mode.
+// host, port, from address, transport mode, and authentication policy.
 func (s *ChannelConfigUpdateService) prepareSMTPEnable(config *models.ChannelConfig) error {
 	if strings.TrimSpace(config.SMTPHost) == "" || config.SMTPPort <= 0 || config.SMTPPort > 65535 || strings.TrimSpace(config.SMTPFromEmail) == "" {
 		return channelConfigInvalid("SMTP host, port, and from address are required before enabling this channel")
 	}
 	if !validBareEmail(strings.TrimSpace(config.SMTPFromEmail)) {
 		return channelConfigInvalid("SMTP from address must be a valid bare email address")
 	}
-	if !windshiftsmtp.EncryptionModeAllowed(config.SMTPEncryption) {
-		return channelConfigInvalid("SMTP encryption must be tls, starttls, or ssl")
+	if err := windshiftsmtp.ValidateTransport(config); err != nil {
+		return channelConfigInvalid(err.Error())
 	}
 	return nil
 }
@@ -714,8 +714,11 @@ func validateEnabledChannel(channel *models.Channel, config *models.ChannelConfi
 		}
 	case "smtp":
 		from := strings.TrimSpace(config.SMTPFromEmail)
-		if strings.TrimSpace(config.SMTPHost) == "" || config.SMTPPort <= 0 || config.SMTPPort > 65535 || from == "" || !validBareEmail(from) || !windshiftsmtp.EncryptionModeAllowed(config.SMTPEncryption) {
-			return channelConfigInvalid("Enabled SMTP channels require a valid host, port, from address, and TLS mode")
+		if strings.TrimSpace(config.SMTPHost) == "" || config.SMTPPort <= 0 || config.SMTPPort > 65535 || from == "" || !validBareEmail(from) {
+			return channelConfigInvalid("Enabled SMTP channels require a valid host, port, from address, and transport mode")
+		}
+		if err := windshiftsmtp.ValidateTransport(config); err != nil {
+			return channelConfigInvalid(err.Error())
 		}
 	}
 	return nil

internal/smtp/notification_sender.go

@@ -12,7 +12,6 @@ import (
 	"net"
 	"net/mail"
 	"net/smtp"
-	"os"
 	"strings"
 	"time"
 
@@ -23,37 +22,44 @@ import (
 	"windshift/internal/utils"
 )
 
-// e2eInsecureSMTPEnv, when set to "1", unlocks plaintext SMTP over loopback.
-// Used solely by the e2e harness (run-e2e.sh exports it) so Mailpit can
-// capture transactional sends without a TLS dance. Production deployments
-// must never set this — leaving it unset preserves the dispatch() rejection
-// of encryption="none" and SafeNetDialer's loopback block.
-const e2eInsecureSMTPEnv = "WINDSHIFT_E2E_INSECURE_SMTP"
-
-func e2eInsecureSMTPEnabled() bool {
-	return os.Getenv(e2eInsecureSMTPEnv) == "1"
-}
-
 // EncryptionModeAllowed reports whether the sender can dispatch with the
-// configured mode. Plaintext is deliberately available only to the local E2E
-// harness; channel validation and dispatch must use the same policy so a test
-// configuration cannot be accepted by one layer and rejected by the other.
+// configured mode. Unknown and empty modes are rejected so a typo can never
+// silently downgrade a connection to plaintext.
 func EncryptionModeAllowed(mode string) bool {
 	switch strings.ToLower(strings.TrimSpace(mode)) {
-	case "tls", "starttls", "ssl":
+	case "tls", "starttls", "ssl", "none":
 		return true
-	case "none":
-		return e2eInsecureSMTPEnabled()
 	default:
 		return false
 	}
 }
 
+// ValidateTransport rejects unsupported modes and authentication without TLS.
+// Plaintext SMTP is intended for trusted relays that authorize by network;
+// credentials must never be exposed on the connection.
+func ValidateTransport(config *models.ChannelConfig) error {
+	if config == nil {
+		return fmt.Errorf("SMTP config is required")
+	}
+	mode := strings.ToLower(strings.TrimSpace(config.SMTPEncryption))
+	if !EncryptionModeAllowed(mode) {
+		return fmt.Errorf("SMTP encryption %q not allowed; use \"tls\", \"starttls\", \"ssl\", or \"none\"", config.SMTPEncryption)
+	}
+	if mode == "none" && (strings.TrimSpace(config.SMTPUsername) != "" || config.SMTPPassword != "") {
+		return ErrSMTPAuthenticationRequiresTLS
+	}
+	return nil
+}
+
 // ErrSMTPNotConfigured is returned when a transactional send is attempted but
 // SMTP isn't configured. Re-exported by `internal/services` so existing
 // callers (e.g. internal/handlers/auth.go) keep working.
 var ErrSMTPNotConfigured = errors.New("SMTP is not configured")
 
+// ErrSMTPAuthenticationRequiresTLS is returned when a plaintext channel
+// contains credentials that would otherwise be exposed on the connection.
+var ErrSMTPAuthenticationRequiresTLS = errors.New("SMTP authentication requires TLS")
+
 // Encryptor mirrors email.Encryptor — duplicated here to avoid an
 // smtp→email→services→smtp import cycle. *sso.SecretEncryption (the same
 // concrete type passed to email.NewCredentialManager) satisfies both
@@ -422,13 +428,10 @@ func formatMessageIDHeader(value string) string {
 	return "<" + value + ">"
 }
 
-// dispatch picks the encryption path (TLS/SSL) and sends the assembled MIME
+// dispatch picks the configured transport and sends the assembled MIME
 // message. Shared by sendEmail and SendThreadedEmail so the encryption switch
-// lives in exactly one place. Plaintext SMTP is refused — it ships AUTH PLAIN
-// credentials in the clear and bypasses the server-identity check, mirroring
-// how email/imap_client.go rejects plaintext IMAP. Misconfigurations (empty
-// or typo'd SMTPEncryption) are surfaced as errors instead of silently
-// downgrading.
+// lives in exactly one place. Plaintext SMTP is allowed only without
+// authentication; empty or unknown modes are errors rather than downgrades.
 //
 // dispatch is a method (rather than a free function) so it can decrypt the
 // at-rest SMTPPassword before passing it to AUTH PLAIN — every caller goes
@@ -449,6 +452,9 @@ func (s *NotificationSMTPSender) dispatch(config *models.ChannelConfig, toEmail,
 	if strings.TrimSpace(config.SMTPHost) == "" || config.SMTPPort <= 0 || config.SMTPPort > 65535 {
 		return fmt.Errorf("invalid SMTP host or port")
 	}
+	if err := ValidateTransport(config); err != nil {
+		return err
+	}
 	password, err := decryptOrLegacy(s.encryption, config.SMTPPassword)
 	if err != nil {
 		return err
@@ -461,18 +467,15 @@ func (s *NotificationSMTPSender) dispatch(config *models.ChannelConfig, toEmail,
 
 	addr := fmt.Sprintf("%s:%d", config.SMTPHost, config.SMTPPort)
 
-	switch strings.ToLower(config.SMTPEncryption) {
+	switch strings.ToLower(strings.TrimSpace(config.SMTPEncryption)) {
 	case "tls", "starttls":
 		return sendWithStartTLS(addr, auth, fromEmail, toEmail, message, config.SMTPSkipTLSVerify)
 	case "ssl":
 		return sendWithSSL(addr, auth, fromEmail, toEmail, message, config.SMTPSkipTLSVerify)
 	case "none":
-		if EncryptionModeAllowed(config.SMTPEncryption) {
-			return sendPlaintext(addr, auth, fromEmail, toEmail, message)
-		}
-		fallthrough
+		return sendPlaintext(addr, fromEmail, toEmail, message)
 	default:
-		return fmt.Errorf("SMTP encryption %q not allowed; use \"tls\", \"starttls\", or \"ssl\"", config.SMTPEncryption)
+		return fmt.Errorf("SMTP encryption %q not allowed", config.SMTPEncryption)
 	}
 }
 
@@ -546,12 +549,11 @@ func smtpTLSConfig(addr string, skipTLSVerify bool) *tls.Config {
 	return config
 }
 
-// sendPlaintext sends email over an unencrypted SMTP connection. Gated by
-// WINDSHIFT_E2E_INSECURE_SMTP=1 (set only by the e2e harness so Mailpit on
-// loopback can capture transactional sends). Uses a plain net.Dialer rather
-// than utils.SafeNetDialer so 127.0.0.1 is reachable.
-func sendPlaintext(addr string, auth smtp.Auth, from, to, message string) error {
-	conn, err := (&net.Dialer{Timeout: smtpDialTimeout}).Dial("tcp", addr)
+// sendPlaintext sends unauthenticated email over an unencrypted connection.
+// SafeNetDialer keeps the process-wide local-connection policy effective for
+// this transport just as it is for TLS SMTP.
+func sendPlaintext(addr, from, to, message string) error {
+	conn, err := utils.SafeNetDialer(smtpDialTimeout).Dial("tcp", addr)
 	if err != nil {
 		return err
 	}
@@ -566,7 +568,7 @@ func sendPlaintext(addr string, auth smtp.Auth, from, to, message string) error
 	}
 	defer func() { _ = client.Close() }()
 
-	return sendWithClient(client, auth, from, to, message)
+	return sendWithClient(client, nil, from, to, message)
 }
 
 // sendWithClient performs authentication, addressing, and message delivery on an established SMTP client.