SMTP send has no timeout, a stalled host stops all outbound email #373

Summary

Sending email has no dial or IO timeout, so a SMTP host that accepts the TCP connection but never responds blocks the email worker forever and stops all outbound mail.

Where

internal/mail/mail.go, sendMailWithConfig: neither tls.Dial (port 465 path) nor smtp.SendMail is given a timeout, and neither respects the passed ctx. The email queue is drained by a single consumer goroutine that processes one message at a time (internal/queue/consumer.go, cmd/api/main.go).

Impact

If the configured SMTP host black-holes the connection (a common firewall failure mode), the send blocks indefinitely, the QueueEmails consumer never returns, and every invite, password reset, magic code, and notification email stops until the process is restarted. Context cancellation on shutdown won't unblock it either.

Suggested fix

Dial with a timeout (net.Dialer with a deadline for the TLS path, and a smtp.Client built on a timed net.Dial for the STARTTLS path), and honor ctx.