fix(notification): enable web smtp test with saved password

Allow Web SMTP egress on TCP 587 and reuse the saved channel password only when connection settings match. Ref: IT-1601
2026-10-18 00:17:25 +03:00
parent 121ebbfbcd
commit 2dd5e318d7
9 changed files with 260 additions and 5 deletions
@@ -80,6 +80,17 @@ published, accepted by the Gmail SMTP channel, acknowledged as delivery successe
 Invemory Outbox, and confirmed in the recipient's Gmail conversation. Today's channel
 usage increased by two. Both queues ended with zero ready and unacknowledged messages.

+### Administrative SMTP test from Web — 2026-10-18
+
+The channel editor's **Send Test Email** action sends directly from Web through SMTP;
+it does not use the Worker or RabbitMQ. Its TCP 587 connection timed out while the
+production network policy allowed external SMTP only from Worker. The additive
+`web-to-external-smtp` policy in `production-network.yaml` grants Web the same public
+IPv4 TCP 587 egress as Worker, with the same private and cluster address exclusions.
+Apply this production overlay separately from the sandbox-only `notification.py`
+render. No SMTP credentials, channel settings, templates, or workload restart are
+required for this network change.
+
 The activation helper also persists the production user, queue and expanded Worker ACL
 in the `rabbit-definitions` Secret. The private password and matching RabbitMQ hash
 are saved with mode `0600`; updated `notification.py` reproduces that Secret during