Re: [PATCH proxmox 6/7] notify (smtp): Add XOAUTH2 authentication support

["Lukas Wagner" <l.wagner@proxmox.com>]

On Fri Feb 13, 2026 at 5:04 PM CET, Arthur Bied-Charreton wrote:
> Extend the transport building logic to authenticate via XOAUTH2 if
> configured, and manage the related state updates.
>
> Signed-off-by: Arthur Bied-Charreton <a.bied-charreton@proxmox.com>
> ---
>  proxmox-notify/src/endpoints/smtp.rs | 81 +++++++++++++++++++++++-----
>  proxmox-notify/src/lib.rs            |  4 +-
>  2 files changed, 70 insertions(+), 15 deletions(-)
>
> diff --git a/proxmox-notify/src/endpoints/smtp.rs b/proxmox-notify/src/endpoints/smtp.rs
> index 244799fd..4364bd11 100644
> --- a/proxmox-notify/src/endpoints/smtp.rs
> +++ b/proxmox-notify/src/endpoints/smtp.rs
> @@ -202,7 +202,7 @@ pub struct SmtpPrivateConfig {
>      pub oauth2_client_secret: Option<String>,
>  }
>  
> -/// A sendmail notification endpoint.
> +/// A SMTP notification endpoint.
>  pub struct SmtpEndpoint {
>      pub config: SmtpConfig,
>      pub private_config: SmtpPrivateConfig,
> @@ -246,22 +246,79 @@ impl SmtpEndpoint {
>          }
>      }
>  
> +    /// Infer the auth method based on the presence of a password field in the private config.
> +    ///
> +    /// This is required for backwards compatibility for configs created before the `auth_method`
> +    /// field was added, i.e., the presence of a password implicitly meant plain authentication
> +    /// was to be used.
> +    fn auth_method(&self) -> Option<SmtpAuthMethod> {
> +        self.config.auth_method.or_else(|| {
> +            if self.private_config.password.is_some() {
> +                Some(SmtpAuthMethod::Plain)
> +            } else {
> +                None
> +            }
> +        })
> +    }
> +
> +    /// Build an [`SmtpTransport`].
> +    ///
> +    /// If OAuth2 authentication is configured, this method will additionally load,
> +    /// update and store the OAuth2-related state for this endpoint.
>      fn build_transport(&self, tls: Tls, port: u16) -> Result<SmtpTransport, Error> {
> -        let mut transport_builder = SmtpTransport::builder_dangerous(&self.config.server)
> +        let transport_builder = SmtpTransport::builder_dangerous(&self.config.server)
>              .tls(tls)
>              .port(port)
>              .timeout(Some(Duration::from_secs(SMTP_TIMEOUT.into())));
>  
> -        if let Some(username) = self.config.username.as_deref() {
> -            if let Some(password) = self.private_config.password.as_deref() {
> -                transport_builder = transport_builder.credentials((username, password).into());
> -            } else {
> -                return Err(Error::NotifyFailed(
> -                    self.name().into(),
> -                    Box::new(Error::Generic(
> -                        "username is set but no password was provided".to_owned(),
> -                    )),
> -                ));
> +        let transport_builder = match &self.auth_method() {
> +            None => transport_builder,
> +            Some(SmtpAuthMethod::Plain) => match (
> +                self.config.username.as_deref(),
> +                self.private_config.password.as_deref(),
> +            ) {
> +                (Some(username), Some(password)) => {
> +                    transport_builder.credentials((username, password).into())
> +                }
> +                (Some(_), None) => {
> +                    return Err(Error::NotifyFailed(
> +                        self.name().into(),
> +                        Box::new(Error::Generic(
> +                            "username is set but no password was provided".to_owned(),
> +                        )),
> +                    ))
> +                }
> +                _ => transport_builder,
> +            },
> +            Some(method) => {
> +                let state = State::load(self.name())?;
> +
> +                let refresh_token =
> +                    state
> +                        .oauth2_refresh_token
> +                        .clone()
> +                        .ok_or(Error::NotifyFailed(
> +                            self.name().into(),
> +                            Box::new(Error::Generic("no refresh token found".into())),
> +                        ))?;
> +                let token_exchange_result = self.get_access_token(&refresh_token, method)?;
> +
> +                state
> +                    .set_oauth2_refresh_token(Some(
> +                        token_exchange_result
> +                            .refresh_token
> +                            .map(|t| t.into_secret())
> +                            .unwrap_or_else(|| refresh_token),
> +                    ))
> +                    .set_last_refreshed(proxmox_time::epoch_i64())
> +                    .store(self.name())?;
> +
> +                transport_builder
> +                    .credentials(Credentials::new(
> +                        self.config.from_address.to_owned(),
> +                        token_exchange_result.access_token.into_secret(),
> +                    ))
> +                    .authentication(vec![Mechanism::Xoauth2])
>              }
>          };
>  
> diff --git a/proxmox-notify/src/lib.rs b/proxmox-notify/src/lib.rs
> index c1a5e535..996393c2 100644
> --- a/proxmox-notify/src/lib.rs
> +++ b/proxmox-notify/src/lib.rs
> @@ -557,9 +557,7 @@ impl Bus {
>                  }
>  
>                  match endpoint.send(notification) {
> -                    Ok(_) => {
> -                        info!("notified via target `{name}`");
> -                    }
> +                    Ok(_) => info!("notified via target `{name}`"),

Unrelated change, if this the result of a `cargo fmt`, maybe move to a
separate commit at the start of the series?

>                      Err(e) => {
>                          // Only log on errors, do not propagate fail to the caller.
>                          error!("could not notify via target `{name}`: {e}");