Merge pull request 'fix(ses): sign in to the SMTP relay with the password, not as an OAuth token' (#8) from fix/ses-smtp-password-auth into main

Reviewed-on: #8

docker-compose.yml

@@ -12,6 +12,11 @@ services:
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       - ./data:/app/data
+    # Optional SES SMTP relay settings (FLOCI_SERVICES_SES_SMTP_*), kept outside the repo
+    # because they hold a password. Without the file, sent emails stay in the SES mailbox.
+    env_file:
+      - path: ${HOME}/.config/thecloud/ses-smtp.env
+        required: false
     environment:
       FLOCI_SERVICES_DOCKER_NETWORK: floci_default
       FLOCI_SERVICES_RDS_PROXY_BASE_PORT: "7001"

src/main/java/io/github/hectorvent/floci/services/ses/SmtpRelay.java

@@ -57,6 +57,8 @@ public class SmtpRelay {
 
     private static final Logger LOG = Logger.getLogger(SmtpRelay.class);
     private static final long RELAY_TIMEOUT_SECONDS = 30;
+    /** Every SASL method the mail client supports except XOAUTH2, which expects a token. */
+    static final String PASSWORD_AUTH_METHODS = "CRAM-SHA256 CRAM-SHA1 CRAM-MD5 DIGEST-MD5 LOGIN PLAIN";
 
     /** SES control header naming the configuration set to apply to a raw send. */
     public static final String HEADER_CONFIGURATION_SET = "X-SES-CONFIGURATION-SET";
@@ -118,6 +120,9 @@ public class SmtpRelay {
                 .filter(u -> !u.isBlank())
                 .ifPresent(u -> {
                     mailConfig.setUsername(u);
+                    // smtp-pass is a password, never an OAuth token: without this the client prefers
+                    // XOAUTH2 whenever the server offers it (Gmail does) and the login is refused.
+                    mailConfig.setAuthMethods(PASSWORD_AUTH_METHODS);
                     config.services().ses().smtpPass()
                             .filter(p -> !p.isBlank())
                             .ifPresent(mailConfig::setPassword);

src/test/java/io/github/hectorvent/floci/services/ses/SmtpRelayServerTest.java

@@ -287,7 +287,8 @@ class SmtpRelayServerTest {
                 String command = line.toUpperCase(Locale.ROOT);
                 if (command.startsWith("EHLO")) {
                     reply(out, "250-floci-stub");
-                    reply(out, "250 AUTH PLAIN");
+                    // Gmail also offers OAuth sign-in, which a password must never be sent as.
+                    reply(out, "250 AUTH PLAIN XOAUTH2 OAUTHBEARER");
                 } else if (command.startsWith("HELO")) {
                     reply(out, "250 floci-stub");
                 } else if (command.startsWith("AUTH")) {