fix(connector): allow SMTP login auth without user/pass

[simeng-li]

Summary

Closes #6754.

Context

SMTP relays that authorize by source (IP/VLAN) — and don't take credentials — can't be configured because the connector route calls cleanDeep on the config before persisting, which strips empty-string user/pass from auth. The resulting { "type": "login" } then fails the connector's zod guard on subsequent reads, the UI loses the fields, and the connector stops working.

What changed

• packages/connectors/connector-smtp/src/types.ts — made user and pass optional on loginAuthGuard, and added .strict() so the now-looser shape doesn't silently swallow oauth2 payloads in the authGuard union (zod would otherwise match login first and drop the oauth2-only keys).
• packages/connectors/connector-smtp/src/index.ts — type-assert at the nodemailer boundary. Nodemailer's AuthenticationTypeLogin types user/pass as required strings, but at runtime treats them as optional (skipping auth when absent). Bypass is documented inline.
• packages/connectors/connector-smtp/src/index.test.ts — added one test covering the post-cleanDeep shape (auth: { type: 'login' }).
• .changeset/fix-smtp-auth-empty-credentials.md — patch bump for @logto/connector-smtp.

Expected result

• Existing SMTP configs with real user/pass continue to validate and work unchanged (optional widens, doesn't break).
• New SMTP configs without credentials now validate after the route's cleanDeep pass, and nodemailer skips authentication as it already does for the standalone case shown in bug: empty strings are removed from connector configuration (prevents use of SMTP relay without user/password) #6754.
• The cleanDeep round-trip dropping empty-string user/pass from the UI form is unchanged — it's now harmless rather than fatal.

Reviewer notes

• .strict() is the minimal disambiguation for the union here. A z.discriminatedUnion('type', …) would be cleaner long-term but would require making type non-optional on all three variants, which is a breaking change to stored configs. Happy to revisit as a follow-up.
• The route-layer cleanDeep is left alone — it's shared across all connectors, so changing its empty-string behavior has a much larger blast radius than warranted here.

Testing

Unit tests

Checklist

• .changeset
• unit tests
• integration tests
• necessary TSDoc comments

[github-actions]

COMPARE TO master

Total Size Diff 📈 +1.35 KB

Diff by File

Name	Diff
.changeset/fix-smtp-auth-empty-credentials.md	📈 +190 Bytes
packages/connectors/connector-smtp/src/index.test.ts	📈 +326 Bytes
packages/connectors/connector-smtp/src/index.ts	📈 +277 Bytes
packages/connectors/connector-smtp/src/types.ts	📈 +589 Bytes

[Copilot]

Pull request overview

Fixes SMTP connector configuration for relays that authorize by source (IP/VLAN) and don't require credentials. Previously, the route-layer cleanDeep stripped empty-string user/pass from auth, leaving { type: 'login' }, which then failed the connector's Zod validation on subsequent reads.

Changes:

• Made user and pass optional on loginAuthGuard and added .strict() to prevent the looser shape from incorrectly matching OAuth2 payloads first in the union.
• Added a documented type assertion at the Nodemailer boundary since AuthenticationTypeLogin types user/pass as required strings while runtime treats them as optional.
• Added a unit test covering the post-cleanDeep shape auth: { type: 'login' }.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
packages/connectors/connector-smtp/src/types.ts	Loosen loginAuthGuard (optional user/pass) and add .strict() to disambiguate union with OAuth2 guards.
packages/connectors/connector-smtp/src/index.ts	Type-assert config to SMTPTransport.Options with eslint-disable + rationale comment.
packages/connectors/connector-smtp/src/index.test.ts	New test for login auth missing user/pass.
.changeset/fix-smtp-auth-empty-credentials.md	Patch bump changeset for @logto/connector-smtp.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.