fix(email): test saved SMTP config and add TLS modes (#3388)

packages/config/src/MasterConfig.ts

@@ -13,6 +13,7 @@ export const ACCOUNT_IDENTITY_MODE_NAMES = ['email', 'username'] as const;
 type AccountIdentityModeName = (typeof ACCOUNT_IDENTITY_MODE_NAMES)[number];
 export const TAG_STYLE_NAMES = ['none', 'random'] as const;
 type TagStyleName = (typeof TAG_STYLE_NAMES)[number];
+type SmtpTlsModeName = 'implicit' | 'starttls' | 'opportunistic' | 'none';
 
 interface InstanceBrandingConfig {
 	product_name: string;
@@ -189,7 +190,8 @@ export interface MasterConfig {
 				port: number;
 				username: string;
 				password: string;
-				secure: boolean;
+				tls_mode?: SmtpTlsModeName;
+				secure?: boolean;
 			};
 		};
 		voice: {

packages/config/src/__tests__/ConfigLoader.test.ts

@@ -474,6 +474,25 @@ describe('ConfigLoader', () => {
 		expect(config.instance.tag_style).toBe(expected);
 	});
 
+	test.each([
+		['implicit', 'implicit'],
+		[' StartTLS ', 'starttls'],
+		['opportunistic', 'opportunistic'],
+		['none', 'none'],
+		['', undefined],
+	])('parses FLUXER_EMAIL_SMTP_TLS_MODE=%j', async (raw, expected) => {
+		stubMinimalEnv({FLUXER_EMAIL_SMTP_HOST: 'smtp.example.com', FLUXER_EMAIL_SMTP_TLS_MODE: raw});
+		const config = await loadConfig();
+		expect(config.integrations.email.smtp?.tls_mode).toBe(expected);
+	});
+
+	test.each(['tls', 'true'])('rejects the SMTP TLS mode %j', async (raw) => {
+		stubMinimalEnv({FLUXER_EMAIL_SMTP_TLS_MODE: raw});
+		await expect(loadConfig()).rejects.toThrow(
+			'FLUXER_EMAIL_SMTP_TLS_MODE must be implicit, starttls, opportunistic or none',
+		);
+	});
+
 	test.each(['sequential', 'zero_first'])('rejects the tag style %j', async (raw) => {
 		stubMinimalEnv({FLUXER_TAG_STYLE: raw});
 		await expect(loadConfig()).rejects.toThrow('FLUXER_TAG_STYLE must be none or random');

packages/config/src/config_loader/EnvironmentOverrides.ts

@@ -163,6 +163,7 @@ const NAMED_FLUXER_ENV_OVERRIDES: Record<string, NamedEnvOverride> = {
 	FLUXER_EMAIL_SMTP_PORT: {path: ['integrations', 'email', 'smtp', 'port'], parse: parseInteger},
 	FLUXER_EMAIL_SMTP_USERNAME: {path: ['integrations', 'email', 'smtp', 'username']},
 	FLUXER_EMAIL_SMTP_PASSWORD: {path: ['integrations', 'email', 'smtp', 'password']},
+	FLUXER_EMAIL_SMTP_TLS_MODE: {path: ['integrations', 'email', 'smtp', 'tls_mode'], parse: parseSmtpTlsMode},
 	FLUXER_EMAIL_SMTP_SECURE: {path: ['integrations', 'email', 'smtp', 'secure'], parse: parseBoolean},
 	FLUXER_LIVEKIT_ENABLED: {path: ['integrations', 'voice', 'enabled'], parse: parseBoolean},
 	FLUXER_LIVEKIT_API_KEY: {path: ['integrations', 'voice', 'api_key']},
@@ -350,6 +351,12 @@ function parseTagStyle(raw: string): string {
 	throw new Error('must be none or random');
 }
 
+function parseSmtpTlsMode(raw: string): string {
+	const value = raw.trim().toLowerCase();
+	if (value === 'implicit' || value === 'starttls' || value === 'opportunistic' || value === 'none') return value;
+	throw new Error('must be implicit, starttls, opportunistic or none');
+}
+
 function parseJson(raw: string): unknown {
 	try {
 		return JSON.parse(raw);