From 853095faef4b321b31e6117c58e4fa8b51f99366 Mon Sep 17 00:00:00 2001
From: Schalli <kschaller@ctl.de>
Date: Sat, 27 Jun 2026 21:04:58 +0200
Subject: [PATCH] fix(07): SMTP test falls back to stored username and adds 10s
 timeouts

Previously only the password fell back to stored value; username could be
missing if form field was cleared. Now both credentials fall back to the
stored config, ensuring auth is always tested when credentials exist.

Also adds explicit 10s timeouts to prevent indefinite hangs on unreachable
SMTP servers.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 apps/api/src/settings/settings.service.ts | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/apps/api/src/settings/settings.service.ts b/apps/api/src/settings/settings.service.ts
index 0e5d76c..de2234f 100644
--- a/apps/api/src/settings/settings.service.ts
+++ b/apps/api/src/settings/settings.service.ts
@@ -124,11 +124,18 @@ export class SettingsService {
    */
   async testSmtpConfig(tenantId: string, dto: SmtpConfigDto): Promise<boolean> {
     let password: string | undefined = dto.password;
+    let username: string | undefined = dto.username;
 
-    // If no password submitted, fall back to the stored password
-    if (!password) {
+    // Fall back to stored credentials for anything not provided in the DTO.
+    // The form never pre-fills the password field (T-07-17), so we always
+    // need to load it from storage. Username may also be absent if the form
+    // field was cleared, so load it too.
+    if (!password || !username) {
       const stored = await this.getDecryptedSmtpConfig(tenantId);
-      password = stored?.decryptedPassword ?? undefined;
+      if (stored) {
+        if (!password) password = stored.decryptedPassword ?? undefined;
+        if (!username) username = stored.username ?? undefined;
+      }
     }
 
     try {
@@ -137,8 +144,11 @@ export class SettingsService {
         port: dto.port,
         secure: dto.encryption === 'ssl-tls',
         requireTLS: dto.encryption === 'starttls',
-        auth: dto.username
-          ? { user: dto.username, pass: password ?? '' }
+        connectionTimeout: 10_000,
+        greetingTimeout: 10_000,
+        socketTimeout: 10_000,
+        auth: username
+          ? { user: username, pass: password ?? '' }
           : undefined,
       });