fix(mail): prove SMTP deliverability before saving, and stop losing the relay

	return m.sized(newFelisForm(huh.NewGroup(

		huh.NewNote().

			Title("Email (SMTP)").

			Description("The relay Felis mails one-time codes through — email verification, email login and operator sign-in all need it. The password goes into a Kubernetes Secret; only the other fields are written to felis.toml."),

			Description("The relay Felis mails one-time codes through — email verification, email login and operator sign-in all need it. The password goes into a Kubernetes Secret; only the other fields are written to felis.toml. Saving sends one self-test message to the From address: nothing is written unless it is delivered."),

		huh.NewInput().

			Title("SMTP host").

			Description("Your provider's relay, e.g. smtp.gmail.com or smtp.mailgun.org.").

			Validate(validateSMTPPort),

		huh.NewInput().

			Title("From address").

			Description("The sender codes are mailed as, e.g. felis@your-domain.").

			Description("The sender codes are mailed as, e.g. felis@your-domain. It must be an address this account is allowed to send as — providers reject a From on a domain you have not verified with them, and they usually do it only after the message body, not when you connect.").

			Value(&m.in.from).

			Validate(validateSMTPFrom),

		huh.NewInput().

func (m *smtpModel) View() string {

	switch m.step {

	case esWorking:

		return "  " + m.sp.View() + " " + tuiHint.Render("Verifying the relay, saving email settings and rolling the API…") + "\n"

		return "  " + m.sp.View() + " " + tuiHint.Render("Delivering a self-test message, saving email settings and rolling the API…") + "\n"

	case esDone:

		var b strings.Builder

		b.WriteString(tuiSuccessBanner("Email configured — codes are now mailed.") + "\n\n")

		b.WriteString(tuiInfo("Relay → "+smtpDetail(m.in)) + "\n")

		// Named because it is checkable: the operator can open that inbox and see the

		// proof, rather than taking "configured" on faith.

		b.WriteString(tuiHint.Render("A self-test message was delivered to "+m.in.from+".") + "\n")

		b.WriteString("\n" + tuiAction("enter", "continue"))

		return b.String()

	case esError:

}

// applySMTPConfig proves the relay works, then persists it and rolls felis-api:

// Ping (connect/STARTTLS/AUTH, no mail sent) → [smtp] into both config files →

// the felis-smtp Secret → the config Secret → rollout. A failed Ping leaves the

// install untouched, so a typo dies at the keyboard, not at a player's OTP.

// Ping (a full transaction — connect/STARTTLS/AUTH/MAIL FROM/RCPT/DATA, which

// delivers one self-test message to the From address) → [smtp] into both config

// files → the felis-smtp Secret → the config Secret → rollout. A failed Ping

// leaves the install untouched, so a bad relay dies at the keyboard, not at a

// player's OTP.

//

// Ping really sends, because a cheaper probe cannot answer the question this

// screen exists to answer. Relays that validate sender identity — Fastmail, and

// it is not alone — return an unconditional 250 to MAIL FROM and only refuse at

// end-of-DATA. The earlier connect/AUTH/NOOP check therefore accepted a From on

// a domain the account could not send as, wrote the config, and left every OTP

// failing afterwards with this screen reporting success.

func applySMTPConfig(ctx context.Context, in smtpInputs) error {

	port, err := strconv.Atoi(in.port)

	if err != nil {

  ok "panel TLS certificate ready (${PANEL_TLS_CERT})"

}

# persisted_smtp_block echoes the [smtp] section an earlier run left behind, or

# nothing. Unlike every other value in the generated toml, [smtp] is not derived

# from this script's inputs -- `felis setup`'s SMTP screen writes it, after

# proving the relay works. A wholesale `cat >` therefore erases it on every

# re-run, and since re-running the installer is the documented way to update

# felis-api, an operator who updates loses mail: OTP delivery silently reverts

# to the no-Mailer path and every code is logged instead of sent. Same defect

# family as the root_domain loss fixed in ecbeb20 -- generated file, hand-set

# value, no carry-forward.

#

# Cached on first call because write_felis_toml clobbers felis.host.toml before

# it is called again for felis.pod.toml: by then the file this would read from

# no longer has the block. The pod toml is the fallback for exactly that window.

persisted_smtp_block() {

  if [ -z "${SMTP_BLOCK_CACHED:-}" ]; then

    SMTP_BLOCK_CACHED=1

    SMTP_BLOCK=""

    local f

    for f in "${STATE_DIR}/felis.host.toml" "${STATE_DIR}/felis.pod.toml"; do

      [ -r "$f" ] || continue

      # Print from [smtp] up to (not including) the next section header.

      SMTP_BLOCK="$(awk '/^[[:space:]]*\[smtp\]/ { f=1 }

                         f && /^[[:space:]]*\[/ && !/^[[:space:]]*\[smtp\]/ { exit }

                         f { print }' "$f")"

      [ -n "$SMTP_BLOCK" ] && break

    done

  fi

  printf '%s' "$SMTP_BLOCK"

}

write_felis_toml() {

  local target="$1" db_host="$2"

  local target="$1" db_host="$2" smtp_block

  smtp_block="$(persisted_smtp_block)"

  if [ -n "$smtp_block" ]; then

    log "carrying forward the configured [smtp] relay"

    smtp_block="${smtp_block}"$'\n' # keep a blank line before the next section

  fi

  cat > "$target" <<EOF

# Generated by deploy/bootstrap.sh — do not edit by hand; rerun the installer.

[server]

admin_hostname = "op.console.${FELIS_ROOT_DOMAIN}"

panel_hostname = "console.${FELIS_ROOT_DOMAIN}"

${smtp_block}

# Third-party Yggdrasil sources federated by the hasJoined multiplexer. Mojang is

# always the code-owned identity anchor (premium-first), prepended in Go; sources here

# append as namespace-rewritten guests. Shipping LittleSkin by default lets Mojang and

      content:

        application/json:

          schema: { $ref: '#/components/schemas/Error' }

    MailUndeliverable:

      description: >

        The configured SMTP relay refused the message (code mail_undeliverable), so no

        code was delivered. Distinct from 500 because the fault is in the install's

        [smtp] settings, not in the request or the platform — most often a From address

        the relay will not let this account send as. The relay's own text is deliberately

        withheld (it names the SMTP account) and written to the felis-api log instead,

        keyed by the same request_id this response carries. Retrying the same address

        changes nothing until an operator fixes the relay.

      content:

        application/json:

          schema: { $ref: '#/components/schemas/Error' }

    AccessResult:

      description: The structured access mutation succeeded; the raw RCON reply is in output.

      content:

          content:

            application/json:

              schema: { $ref: '#/components/schemas/Error' }

        '502':

          $ref: '#/components/responses/MailUndeliverable'

  /api/v1/auth/email/verify:

    post:

          content:

            application/json:

              schema: { $ref: '#/components/schemas/Error' }

        '502':

          $ref: '#/components/responses/MailUndeliverable'

  /api/v1/auth/op-login/status/{id}:

    get:

              schema: { $ref: '#/components/schemas/Error' }

        '401':

          $ref: '#/components/responses/Unauthorized'

        '502':

          $ref: '#/components/responses/MailUndeliverable'

  /api/v1/account/email/verify:

    post:

          content:

            application/json:

              schema: { $ref: '#/components/schemas/Error' }

        '502':

          $ref: '#/components/responses/MailUndeliverable'

  /api/v1/account/migrate/confirm/otp/verify:

    post:

	"encoding/json"

	"errors"

	"fmt"

	"log"

	"net/http"

)

// writeError renders err as the standard error envelope. Non-apiError values

// collapse to a 500 so driver/internal details never reach the client.

//

// That collapse is deliberately lossy on the wire and deliberately NOT lossy in

// the log. Everything the client is denied — the driver message, the wrapped

// chain, the handler that produced it — is written to stderr first, keyed by the

// same request_id the caller is shown. Without that line an operator holding a

// "internal error" has nothing to grep for, and diagnosis degrades into guessing

// against a live install; it cost a full debugging session to learn that once.

func writeError(w http.ResponseWriter, r *http.Request, err error) {

	var ae *apiError

	if !errors.As(err, &ae) {

		log.Printf("api: %s %s: unmapped error (request_id=%s): %v",

			r.Method, r.URL.Path, requestIDFromContext(r.Context()), err)

		ae = newError(http.StatusInternalServerError, "internal", "internal error")

	}

	body := map[string]any{

		log.Printf("email-otp: no Mailer configured; code for %s is %s (KNOWN-LIMITATION: demo has no SMTP)", email, code)

		return nil

	}

	return a.Mailer.SendOTP(ctx, email, code)

	if err := a.Mailer.SendOTP(ctx, email, code); err != nil {

		// Mapped here rather than at each of the four call sites, so every door that

		// mails a code answers the same way. A relay refusal is neither the caller's

		// fault nor a bug in Felis, and a bare 500 says neither — it reads as "the

		// panel is broken" and sends the operator hunting through handler code

		// instead of their [smtp] block.

		//

		// The relay's own text stays in the log: it can name the SMTP account and the

		// sending identity ("smtp: auth as [email protected]: 535 …"), and these routes

		// are reachable by any signed-in player.

		log.Printf("api: OTP delivery failed (request_id=%s): %v", requestIDFromContext(ctx), err)

		return newError(http.StatusBadGateway, "mail_undeliverable",

			"the mail relay refused this message; ask the server operator to check the SMTP settings")

	}

	return nil

}

// setEmailRequest is the record-email body: the address to bind to the caller's