[BUG] SMTP AUTH always attempted

[tristansgray]

Pre-submission checks

• I have searched existing issues and this is not a duplicate.
• I am using the latest main or the most recent release.
• This is not a security vulnerability (those go to SECURITY.md).

Affected component

Email / SMTP

Severity

Medium — feature broken with a workaround

Summary

The SMTP sender always attempts AUTH, even when Username/Password are left blank, despite the settings page describing authentication as optional. This makes it impossible to use any SMTP relay that doesn't support or require AUTH (e.g. an internal relay trusted by network position).

Steps to reproduce

1. Go to Instance Admin → Email.
2. Configure Host/Port for a relay that does not advertise the AUTH extension. Leave Username and Password blank.
3. Save changes.
4. Trigger any outbound email (e.g. "Forgot password" or a workspace invite).

Expected behavior

With no username configured, the app should connect and send without attempting AUTH, per the settings page's own description ("This is optional, but we recommend setting up a username and a password").

Actual behavior

Send fails every time with smtp: server doesn't support AUTH.

Devlane version or commit

7719dca

Environment

Alpine 3.21 (container), Go 1.26.4

Deployment mode

Self-hosted production

Database state

Fresh — migrations applied cleanly on startup

API logs

{"level":"ERROR","msg":"mail send failed","to":"[redacted]","subject":"Reset your Devlane password","error":"smtp: server doesn't support AUTH"}
{"level":"WARN","msg":"task failed, retrying","queue":"devlane.emails","retry":1,"error":"smtp: server doesn't support AUTH"}
{"level":"ERROR","msg":"task permanently failed, discarding","queue":"devlane.emails","retries":3,"error":"smtp: server doesn't support AUTH"}

Browser console / network output

Additional context

Root cause is in api/internal/mail/mail.go:

go
auth := smtp.PlainAuth("", cfg.Username, cfg.Password, cfg.Host)

smtp.PlainAuth(...) never returns nil, even with empty strings, so this non-nil Auth is unconditionally passed into sendMailWithConfig → Go's stdlib smtp.SendMail, which then requires the server to support AUTH. Suggested fix:

go
var auth smtp.Auth
if cfg.Username != "" {
auth = smtp.PlainAuth("", cfg.Username, cfg.Password, cfg.Host)
}

AI assistance

• This issue was created or substantially drafted with AI assistance.