fix(notification): enable web smtp test with saved password

Allow Web SMTP egress on TCP 587 and reuse the saved channel password only when connection settings match.

Ref: IT-1601

HrynCo.NotificationService.Web.IntegrationTests/AdminSmtpEditorViewTests.cs

@@ -0,0 +1,34 @@
+using HrynCo.NotificationService.DAL.Abstract.Providers;
+using HrynCo.NotificationService.DAL.Abstract.Repositories;
+using HrynCo.NotificationService.DAL.EF;
+using Microsoft.Extensions.DependencyInjection;
+
+namespace HrynCo.NotificationService.Web.IntegrationTests;
+
+public sealed class AdminSmtpEditorViewTests(TemplateDatabaseFixture fixture) : IClassFixture<TemplateDatabaseFixture>
+{
+    [Fact]
+    public async Task ExistingChannelTestIncludesIdWithoutRenderingSavedPassword()
+    {
+        await using var context = await DefinitionApiTestContext.CreateAsync(fixture);
+        using var scope = context.App.Services.CreateScope();
+        var channel = new EmailChannel
+        {
+            ServiceName = "TestService",
+            EmailChannelType = EmailChannelType.Smtp,
+            Settings = new SmtpChannelSettings
+            {
+                Host = "smtp.example.invalid", Username = "test-user",
+                Password = "saved-secret-must-not-render", FromEmail = "sender@example.invalid"
+            }
+        };
+        await scope.ServiceProvider.GetRequiredService<IEmailChannelRepository>().AddAsync(channel);
+        await scope.ServiceProvider.GetRequiredService<NotificationDbContext>().SaveChangesAsync();
+
+        var html = await context.Client.GetStringAsync($"/admin/channels/{channel.Id}");
+
+        Assert.Contains($"value=\"{channel.Id}\"", html);
+        Assert.Contains("const channelId = form.querySelector('[name=\"Id\"]').value", html);
+        Assert.DoesNotContain("saved-secret-must-not-render", html);
+    }
+}

HrynCo.NotificationService.Web.IntegrationTests/AdminSmtpTestControllerTests.cs

@@ -0,0 +1,112 @@
+using System.Reflection;
+using System.Text.Json;
+using HrynCo.NotificationService.DAL.Abstract.Providers;
+using HrynCo.NotificationService.Web.Controllers.Admin;
+using MediatR;
+using Microsoft.AspNetCore.Mvc;
+
+namespace HrynCo.NotificationService.Web.IntegrationTests;
+
+public sealed class AdminSmtpTestControllerTests
+{
+    private static readonly Guid ChannelId = Guid.NewGuid();
+
+    [Fact]
+    public async Task BlankPasswordUsesSavedSecretAndCurrentUnsavedSender()
+    {
+        var (controller, recorder) = CreateController();
+        var response = await controller.TestSmtp(Request(), CancellationToken.None);
+
+        Assert.True(Succeeded(response));
+        Assert.Equal("saved-test-secret", recorder.SentCommand?.Password);
+        Assert.Equal("changed@example.invalid", recorder.SentCommand?.FromEmail);
+        Assert.Equal("Changed sender", recorder.SentCommand?.FromName);
+        Assert.Equal(1, recorder.LookupCount);
+        Assert.DoesNotContain("saved-test-secret", JsonSerializer.Serialize(((OkObjectResult)response).Value));
+    }
+
+    [Fact]
+    public async Task ExplicitPasswordOverridesSavedWithoutLookup()
+    {
+        var (controller, recorder) = CreateController();
+        var response = await controller.TestSmtp(Request() with { Password = "typed-test-secret" }, CancellationToken.None);
+
+        Assert.True(Succeeded(response));
+        Assert.Equal("typed-test-secret", recorder.SentCommand?.Password);
+        Assert.Equal(0, recorder.LookupCount);
+    }
+
+    [Theory]
+    [InlineData("host")]
+    [InlineData("port")]
+    [InlineData("username")]
+    [InlineData("ssl")]
+    public async Task ChangedConnectionRequiresExplicitPassword(string field)
+    {
+        var (controller, recorder) = CreateController();
+        var request = field switch
+        {
+            "host" => Request() with { Host = "other.example.invalid" },
+            "port" => Request() with { Port = 2525 },
+            "username" => Request() with { Username = "other-user" },
+            _ => Request() with { UseSsl = false }
+        };
+
+        var response = await controller.TestSmtp(request, CancellationToken.None);
+
+        Assert.False(Succeeded(response));
+        Assert.Null(recorder.SentCommand);
+    }
+
+    [Fact]
+    public async Task UnknownChannelDoesNotSend()
+    {
+        var (controller, recorder) = CreateController();
+        recorder.Channel = null;
+
+        var response = await controller.TestSmtp(Request(), CancellationToken.None);
+
+        Assert.False(Succeeded(response));
+        Assert.Null(recorder.SentCommand);
+    }
+
+    [Fact]
+    public async Task NewChannelKeepsAdHocTestBehavior()
+    {
+        var (controller, recorder) = CreateController();
+
+        var response = await controller.TestSmtp(Request() with { ChannelId = null }, CancellationToken.None);
+
+        Assert.True(Succeeded(response));
+        Assert.Equal(string.Empty, recorder.SentCommand?.Password);
+        Assert.Equal(0, recorder.LookupCount);
+    }
+
+    private static (AdminChannelsController Controller, RecordingAdminSmtpMediator Recorder) CreateController()
+    {
+        var mediator = DispatchProxy.Create<IMediator, RecordingAdminSmtpMediator>();
+        var recorder = (RecordingAdminSmtpMediator)mediator;
+        recorder.Channel = new EmailChannel
+        {
+            Id = ChannelId,
+            ServiceName = "TestService",
+            EmailChannelType = EmailChannelType.Smtp,
+            Settings = new SmtpChannelSettings
+            {
+                Host = "smtp.example.invalid", Port = 587,
+                Username = "test-user", Password = "saved-test-secret", UseSsl = true
+            }
+        };
+        return (new AdminChannelsController(mediator), recorder);
+    }
+
+    private static TestSmtpRequest Request() => new(
+        "smtp.example.invalid", 587, "test-user", "", true,
+        "changed@example.invalid", "Changed sender", "recipient@example.invalid", ChannelId);
+
+    private static bool Succeeded(IActionResult response)
+    {
+        var body = JsonSerializer.Serialize(((OkObjectResult)response).Value);
+        return JsonDocument.Parse(body).RootElement.GetProperty("success").GetBoolean();
+    }
+}

HrynCo.NotificationService.Web.IntegrationTests/RecordingAdminSmtpMediator.cs

@@ -0,0 +1,43 @@
+using System.Reflection;
+using HrynCo.NotificationService.DAL.Abstract.Providers;
+using HrynCo.NotificationService.Services.Core;
+using HrynCo.NotificationService.Services.EmailChannels.Get;
+using HrynCo.NotificationService.Services.EmailChannels.TestSmtp;
+using MediatR;
+using ServiceUnit = HrynCo.NotificationService.Services.Core.Unit;
+
+namespace HrynCo.NotificationService.Web.IntegrationTests;
+
+public class RecordingAdminSmtpMediator : DispatchProxy
+{
+    public EmailChannel? Channel { get; set; }
+    public TestSmtpCommand? SentCommand { get; private set; }
+    public int LookupCount { get; private set; }
+
+    protected override object Invoke(MethodInfo? targetMethod, object?[]? args)
+    {
+        if (targetMethod?.Name != nameof(IMediator.Send) || args?.Length is null or 0)
+            throw new NotSupportedException();
+
+        return args[0] switch
+        {
+            GetEmailChannelQuery => RecordLookup(),
+            TestSmtpCommand command => RecordSend(command),
+            _ => throw new NotSupportedException()
+        };
+    }
+
+    private Task<ServiceResult<EmailChannel>> RecordLookup()
+    {
+        LookupCount++;
+        return Task.FromResult(Channel is null
+            ? ServiceResult<EmailChannel>.Failure("Channel not found.")
+            : ServiceResult<EmailChannel>.Success(Channel));
+    }
+
+    private Task<ServiceResult<ServiceUnit>> RecordSend(TestSmtpCommand command)
+    {
+        SentCommand = command;
+        return Task.FromResult(ServiceResult<ServiceUnit>.Success(ServiceUnit.Value));
+    }
+}

HrynCo.NotificationService.Web.IntegrationTests/TemplateCatalogPresentationTests.cs

@@ -8,6 +8,37 @@ namespace HrynCo.NotificationService.Web.IntegrationTests;
 
 public sealed class TemplateCatalogPresentationTests(TemplateDatabaseFixture fixture) : IClassFixture<TemplateDatabaseFixture>
 {
+    [Fact]
+    public async Task EditorTabsShowSavedVersionsAfterInvalidUnsavedChanges()
+    {
+        var connection = await fixture.CreateDatabaseAsync();
+        await using var app = new TemplateWebApplicationFactory(connection);
+        using var scope = app.Services.CreateScope();
+        var service = (await scope.ServiceProvider.GetRequiredService<INotificationServiceRepository>().GetAllAsync()).Single();
+        var versions = scope.ServiceProvider.GetRequiredService<IEmailTemplateRepository>();
+        await versions.AddAsync(new EmailTemplate
+        {
+            ServiceName = service.Name, Key = "TabStatus", LanguageCode = "en",
+            Subject = "Saved", HtmlBody = "Saved", TextBody = "Saved"
+        });
+        var definition = (await scope.ServiceProvider.GetRequiredService<IEmailTemplateDefinitionRepository>()
+            .GetDefinitionAsync(service.Name, "TabStatus"))!;
+        using var client = app.CreateClient(new() { AllowAutoRedirect = false });
+        var baseUrl = $"/admin/services/{service.Id}/templates";
+        var html = await client.GetStringAsync($"{baseUrl}/{definition.Id}");
+        Assert.Matches("(?s)<span>en</span>\\s*<span class=\"template-language-status template-language-present\">Present</span>", html);
+        Assert.Matches("(?s)<span>uk</span>\\s*<span class=\"template-language-status template-language-missing\">Missing</span>", html);
+
+        var fields = TemplateEditorTestFields.Read(html);
+        TemplateEditorTestFields.SetLanguage(fields, "uk", "Unsaved", "", "");
+        fields["Languages[0].IsPresent"] = "false";
+        var response = await client.PostAsync(baseUrl + "/save", new FormUrlEncodedContent(fields));
+        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+        var invalidHtml = await response.Content.ReadAsStringAsync();
+        Assert.Matches("(?s)<span>en</span>\\s*<span class=\"template-language-status template-language-present\">Present</span>", invalidHtml);
+        Assert.Matches("(?s)<span>uk</span>\\s*<span class=\"template-language-status template-language-missing\">Missing</span>", invalidHtml);
+    }
+
     [Fact]
     public async Task CatalogStatusesUseExactCodes_AndEmptyDefinitionsShowEveryLanguageMissing()
     {

HrynCo.NotificationService.Web/Controllers/Admin/AdminChannelsController.cs

@@ -138,8 +138,21 @@ public class AdminChannelsController(IMediator mediator) : Controller
     [HttpPost("test-smtp")]
     public async Task<IActionResult> TestSmtp([FromBody] TestSmtpRequest request, CancellationToken ct)
     {
+        var password = request.Password;
+        if (string.IsNullOrEmpty(password) && request.ChannelId is Guid channelId)
+        {
+            var channelResult = await mediator.Send(new GetEmailChannelQuery(channelId), ct);
+            if (!channelResult.IsSuccess || channelResult.Result?.Settings is not SmtpChannelSettings saved)
+                return Ok(new { success = false, message = "SMTP channel not found." });
+
+            if (!MatchesSavedSmtpConnection(request, saved))
+                return Ok(new { success = false, message = "Enter the password to test changed SMTP connection settings." });
+
+            password = saved.Password;
+        }
+
         var result = await mediator.Send(new TestSmtpCommand(
-            request.Host, request.Port, request.Username, request.Password,
+            request.Host, request.Port, request.Username, password ?? string.Empty,
             request.UseSsl, request.FromEmail, request.FromName, request.ToEmail), ct);
 
         if (!result.IsSuccess)
@@ -148,6 +161,12 @@ public class AdminChannelsController(IMediator mediator) : Controller
         return Ok(new { success = true, message = $"Test email sent to {request.ToEmail}." });
     }
 
+    private static bool MatchesSavedSmtpConnection(TestSmtpRequest request, SmtpChannelSettings saved) =>
+        string.Equals(request.Host, saved.Host, StringComparison.OrdinalIgnoreCase)
+        && request.Port == saved.Port
+        && string.Equals(request.Username, saved.Username, StringComparison.Ordinal)
+        && request.UseSsl == saved.UseSsl;
+
     // POST /admin/channels/{id}/test
     [HttpPost("{id:guid}/test")]
     public async Task<IActionResult> Test(Guid id, [FromBody] TestChannelRequest request, CancellationToken ct)
@@ -180,6 +199,3 @@ public class AdminChannelsController(IMediator mediator) : Controller
 }
 
 public record TestChannelRequest(string ToEmail);
-public record TestSmtpRequest(
-    string Host, int Port, string Username, string Password,
-    bool UseSsl, string FromEmail, string FromName, string ToEmail);

HrynCo.NotificationService.Web/Controllers/Admin/AdminTemplatesController.cs

@@ -69,8 +69,12 @@ public sealed class AdminTemplatesController(IMediator mediator, IEmailTemplateD
         var service = await services.GetAsync(serviceId, ct);
         if (service is null || model.ServiceId != serviceId || model.ServiceName != service.Name)
             return NotFound();
-        if (model.Id is Guid definitionId && await OwnedDefinitionAsync(service, definitionId, ct) is null)
+        var persisted = model.Id is Guid definitionId ? await OwnedDefinitionAsync(service, definitionId, ct) : null;
+        if (model.Id is not null && persisted is null)
             return NotFound();
+        var presentCodes = persisted?.Languages.Select(l => l.LanguageCode).ToHashSet(StringComparer.Ordinal);
+        foreach (var language in model.Languages)
+            language.IsPresent = presentCodes?.Contains(language.LanguageCode) == true;
         ValidateLanguageCatalog(model, service);
         if (!ModelState.IsValid)
             return EditorView(model, service);
@@ -226,7 +230,8 @@ public sealed class AdminTemplatesController(IMediator mediator, IEmailTemplateD
         VariablesJson = JsonSerializer.Serialize(definition.Variables, JsonOptions),
         Languages = definition.Languages.Select(l => new EmailTemplateLanguageEditViewModel
         {
-            LanguageCode = l.LanguageCode, Subject = l.Subject, HtmlBody = l.HtmlBody, TextBody = l.TextBody
+            LanguageCode = l.LanguageCode, Subject = l.Subject, HtmlBody = l.HtmlBody, TextBody = l.TextBody,
+            IsPresent = true
         }).ToList()
     };
 }

HrynCo.NotificationService.Web/Controllers/Admin/TestSmtpRequest.cs

@@ -0,0 +1,6 @@
+namespace HrynCo.NotificationService.Web.Controllers.Admin;
+
+public record TestSmtpRequest(
+    string Host, int Port, string Username, string Password,
+    bool UseSsl, string FromEmail, string FromName, string ToEmail,
+    Guid? ChannelId = null);

HrynCo.NotificationService.Web/Controllers/Admin/ViewModels/EmailTemplateLanguageEditViewModel.cs

@@ -1,4 +1,5 @@
 using System.ComponentModel.DataAnnotations;
+using Microsoft.AspNetCore.Mvc.ModelBinding;
 
 namespace HrynCo.NotificationService.Web.Controllers.Admin.ViewModels;
 
@@ -12,6 +13,8 @@ public sealed class EmailTemplateLanguageEditViewModel : IValidatableObject
     public string HtmlBody { get; set; } = "";
     [DisplayFormat(ConvertEmptyStringToNull = false)]
     public string TextBody { get; set; } = "";
+    [BindNever]
+    public bool IsPresent { get; set; }
     public bool HasContent => !string.IsNullOrWhiteSpace(Subject) || !string.IsNullOrWhiteSpace(HtmlBody) || !string.IsNullOrWhiteSpace(TextBody);
 
     public IEnumerable<ValidationResult> Validate(ValidationContext validationContext)

HrynCo.NotificationService.Web/Views/AdminChannels/Edit.cshtml

@@ -138,7 +138,7 @@
                 <button type="button" class="btn-close" data-bs-dismiss="modal"></button>
             </div>
             <div class="modal-body">
-                <p class="text-muted small">Tests the current form settings — no need to save first.</p>
+                <p class="text-muted small">Tests the current form settings — no need to save first. For an existing channel, a blank password uses the saved password only when the SMTP connection settings are unchanged.</p>
                 <label for="testToEmail" class="form-label fw-semibold">Recipient Email</label>
                 <input type="email" id="testToEmail" class="form-control" placeholder="you@example.com" />
                 <div id="testResult" class="mt-3" style="display:none"></div>
@@ -173,7 +173,9 @@
         }
 
         const form = document.getElementById('channelForm');
+        const channelId = form.querySelector('[name="Id"]').value;
         const payload = {
+            channelId: channelId === '00000000-0000-0000-0000-000000000000' ? null : channelId,
             host: form.querySelector('[name="Host"]').value,
             port: parseInt(form.querySelector('[name="Port"]').value, 10),
             username: form.querySelector('[name="Username"]').value,

HrynCo.NotificationService.Web/Views/AdminTemplates/Edit.cshtml

@@ -34,18 +34,22 @@
     </div>
     <div class="mb-3">
         <label asp-for="VariablesJson" class="form-label fw-semibold">Shared variables (JSON)</label>
-        <textarea asp-for="VariablesJson" class="form-control font-monospace" rows="4"></textarea>
+        <textarea asp-for="VariablesJson" class="form-control font-monospace" rows="14"></textarea>
         <div class="form-text">One contract for every language: <code>[{"name":"UserName","required":true}]</code></div>
     </div>
-    <p class="text-muted">Every configured service language has a tab. Leave all three content fields blank for an unused language; clear them to remove an existing version. Shared variables and the template remain.</p>
+    <p class="text-muted">Every configured service language has a tab. Present and Missing show saved versions. Leave all three content fields blank for an unused language; clear them to remove an existing version. Shared variables and the template remain.</p>
     @if (Model.Languages.Count == 0) { <p>No service languages configured. You can save the key and shared variables now, then add language codes in Edit Service.</p> }
     <div class="template-language-sheet mb-3" hidden="@(Model.Languages.Count == 0)">
         <div class="nav nav-tabs" role="tablist" aria-label="Template languages" id="languageTabs">
             @for (var i = 0; i < Model.Languages.Count; i++)
             {
+                var language = Model.Languages[i];
                 <button type="button" role="tab" id="language-tab-@i" aria-controls="language-pane-@i"
                         aria-selected="@(i == active ? "true" : "false")" tabindex="@(i == active ? 0 : -1)"
-                        class="nav-link @(i == active ? "active" : "")" data-pane="language-pane-@i">@Model.Languages[i].LanguageCode</button>
+                        class="nav-link @(i == active ? "active" : "")" data-pane="language-pane-@i">
+                    <span>@language.LanguageCode</span>
+                    <span class="template-language-status @(language.IsPresent ? "template-language-present" : "template-language-missing")">@(language.IsPresent ? "Present" : "Missing")</span>
+                </button>
             }
         </div>
         <div id="languagePanes">
@@ -59,11 +63,11 @@
                     </div>
                     <div class="mb-3">
                         <label asp-for="Languages[i].HtmlBody" class="form-label fw-semibold">HTML Body</label>
-                        <textarea asp-for="Languages[i].HtmlBody" class="form-control font-monospace" rows="10" data-content="html"></textarea>
+                        <textarea asp-for="Languages[i].HtmlBody" class="form-control font-monospace" rows="15" data-content="html"></textarea>
                     </div>
                     <div class="mb-3">
                         <label asp-for="Languages[i].TextBody" class="form-label fw-semibold">Text Body</label>
-                        <textarea asp-for="Languages[i].TextBody" class="form-control font-monospace" rows="5" data-content="text"></textarea>
+                        <textarea asp-for="Languages[i].TextBody" class="form-control font-monospace" rows="8" data-content="text"></textarea>
                     </div>
                 </section>
             }

HrynCo.NotificationService.Web/wwwroot/css/admin.css

@@ -160,7 +160,13 @@ body {
 .admin-data-table .channel-actions {
     width: 1%;
     white-space: nowrap;
-    text-align: right;
+}
+
+.admin-data-table .template-actions,
+.admin-data-table .service-actions,
+.admin-data-table .channel-actions,
+.admin-data-table .service-language-actions {
+    text-align: center;
 }
 
 .page-header .service-template-service-name {
@@ -243,12 +249,11 @@ body {
 /* ── Service language actions ─────────────────────────── */
 .service-language-table .service-language-actions {
     width: 1%;
-    text-align: right;
 }
 
 .service-language-table .service-language-action-buttons {
     display: flex;
-    justify-content: flex-end;
+    justify-content: center;
     gap: .5rem;
 }
 
@@ -263,7 +268,7 @@ body {
 @media (max-width: 575.98px) {
     .service-language-table .service-language-action-buttons {
         flex-direction: column;
-        align-items: flex-end;
+        align-items: center;
     }
 
     .service-language-table .service-language-action-buttons > .btn {
@@ -405,6 +410,9 @@ body {
 
 .template-language-sheet > .nav-tabs .nav-link {
     flex: 0 0 auto;
+    display: inline-flex;
+    align-items: center;
+    gap: .375rem;
     margin-bottom: 0;
     white-space: nowrap;
 }

docker/kubernetes/shared-notification/README.md

@@ -80,6 +80,17 @@ published, accepted by the Gmail SMTP channel, acknowledged as delivery successe
 Invemory Outbox, and confirmed in the recipient's Gmail conversation. Today's channel
 usage increased by two. Both queues ended with zero ready and unacknowledged messages.
 
+### Administrative SMTP test from Web — 2026-10-18
+
+The channel editor's **Send Test Email** action sends directly from Web through SMTP;
+it does not use the Worker or RabbitMQ. Its TCP 587 connection timed out while the
+production network policy allowed external SMTP only from Worker. The additive
+`web-to-external-smtp` policy in `production-network.yaml` grants Web the same public
+IPv4 TCP 587 egress as Worker, with the same private and cluster address exclusions.
+Apply this production overlay separately from the sandbox-only `notification.py`
+render. No SMTP credentials, channel settings, templates, or workload restart are
+required for this network change.
+
 The activation helper also persists the production user, queue and expanded Worker ACL
 in the `rabbit-definitions` Secret. The private password and matching RabbitMQ hash
 are saved with mode `0600`; updated `notification.py` reproduces that Secret during

docker/kubernetes/shared-notification/production-network.yaml

@@ -83,3 +83,32 @@ spec:
       ports:
         - protocol: TCP
           port: 587
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: web-to-external-smtp
+  namespace: shared-notification
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/component: web
+      app.kubernetes.io/name: hrynco-shared-notification
+      app.kubernetes.io/managed-by: hrynco-shared-notification
+  policyTypes: [Egress]
+  egress:
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except:
+              - 10.0.0.0/8
+              - 100.64.0.0/10
+              - 127.0.0.0/8
+              - 169.254.0.0/16
+              - 172.16.0.0/12
+              - 192.168.0.0/16
+              - 224.0.0.0/4
+              - 240.0.0.0/4
+      ports:
+        - protocol: TCP
+          port: 587

docs/email-template-definition-api.md

@@ -73,6 +73,8 @@ The service/catalog lookup, validation, revision check, explicit removals, trans
 
 ## Email channels
 
+In the admin channel editor, **Send Test Email** tests the form's current values without saving them. An explicitly entered password takes precedence. When the password field is blank for an existing channel, the Web server reads its saved password only if host, port, username, and SSL/TLS mode still match the saved SMTP connection. Changed connection settings require an explicit password. The saved password is not placed in the page or test response. A new channel keeps the ad-hoc test behavior, including unauthenticated SMTP when username and password are empty.
+
 - `GET /api/v1/email-channels/all` enumerates **all** channels, including channels whose exact `serviceName` has no service row.
 - Existing `GET /api/v1/email-channels?serviceName={exactName}`, GET by ID, POST, PUT by ID and DELETE by ID remain available. Create returns 201/Location and its existing GUID response; update/delete return 200/Unit.
 - Create supports SMTP (`channelType: 1`). Request/response `settings` explicitly maps `host`, `port`, `username`, `password`, `useSsl`, `fromEmail`, and `fromName`; reads no longer lose derived SMTP fields through an abstract JSON type. Host/fromEmail and a valid port are required. The optional empty username/password support unauthenticated development SMTP.

docs/email-template-localizations.md

@@ -27,7 +27,7 @@ The separate **Delete language and versions…** confirmation shows the current
 
 The administration starts at `/admin/services` (also the root redirect). A service name opens `/admin/services/{serviceId}`, which lists only that service's Email Templates, including definitions without translations. **Edit Service** is a separate action at `/admin/services/{id}/edit` for Name and the inline language table. There is no independent global Email Templates menu or extra page for a key: Template Key identifies the template edited directly from this service list. Create/edit/save/delete routes live under `/admin/services/{serviceId}/templates`; breadcrumbs, cancel and successful saves/deletes return to the selected service and retain its exact Key filter. Route IDs are bound explicitly from the route and cannot be replaced by form/query values. GET/POST validate definition ownership, and the mutation transaction also checks the selected service ID. Legacy global GET links redirect to the canonical service/template when identifiable, otherwise to Services; old global template POST routes are not retained. The language-specific API is unchanged.
 
-The service's exact configured language codes appear near its heading. Each template row lists every catalog language with a text-and-color **Present** or **Missing** status, comparing exact ordinal codes (`en` and `EN`, or `ru` and `ru-RU`, remain distinct). A definition with no versions shows all configured languages as Missing; a service with no catalog has an explicit no-languages state. Status display never creates translations. The GET Key filter, Filter and Clear controls live in the Template Key column header, which stays visible for an empty service or filter miss; the scoped header strip has a contrasting blue background. Clear returns to the same service without a key filter, while create/edit/save/cancel retain the selected key filter.
+The service's exact configured language codes appear near its heading. Each template row lists every catalog language with a text-and-color **Present** or **Missing** status, comparing exact ordinal codes (`en` and `EN`, or `ru` and `ru-RU`, remain distinct). The editor repeats these statuses on its language tabs. They show saved versions, including after a failed form submission; unsaved field changes do not alter the status. A definition with no versions shows all configured languages as Missing; a service with no catalog has an explicit no-languages state. Status display never creates translations. The GET Key filter, Filter and Clear controls live in the Template Key column header, which stays visible for an empty service or filter miss; the scoped header strip has a contrasting blue background. Clear returns to the same service without a key filter, while create/edit/save/cancel retain the selected key filter. The Action header and controls are centered in all four administration grids; their column widths are unchanged. The editor initially shows fourteen rows for Shared variables, fifteen for HTML Body and eight for Text Body, without changing their content or contracts.
 
 A template belongs to the selected service; its create/edit form shows Template Key and a tab for **every** language configured in that service. Languages are added, renamed and removed only through Edit Service. A tab with Subject, HTML Body and Text Body all blank does not persist a version; clearing all three removes an existing version while retaining the definition. A partially populated tab requires all three fields and prevents the entire save if incomplete. All tabs may be blank, and a service with no configured languages may still have a key/shared-variables definition. Submitted tabs must match the current service catalog exactly, including uniqueness. Tabs retain unsaved content and support Left/Right/Home/End keyboard navigation. Shared variables appear once as a camelCase JSON array: `[{"name":"RecipientName","required":true}]`. Each variable has a unique nonblank name and a boolean `required`; unknown JSON properties and malformed shapes are rejected. Variable contracts compare Name and Required semantically, independent of variable order.