Change "Email: yes" behavior to make more sense

server/server.go

@@ -746,7 +746,6 @@ func (s *Server) configResponse() *apiConfigResponse {
 		EnablePayments:      s.config.StripeSecretKey != "",
 		EnableCalls:         s.config.TwilioAccount != "",
 		EnableEmails:        s.config.SMTPSenderFrom != "",
-		EnableEmailVerify:   s.config.SMTPSenderVerify,
 		EnableResetPassword: s.config.SMTPSenderFrom != "" && s.config.BaseURL != "", // Reset links need SMTP + an absolute base-url
 		EnableReservations:  s.config.EnableReservations,
 		EnableWebPush:       s.config.WebPushPublicKey != "",

server/server_account.go

@@ -863,16 +863,39 @@ func (s *Server) handleAccountPasswordReset(w http.ResponseWriter, r *http.Reque
 	return s.writeJSON(w, newSuccessResponse())
 }
 
-// convertEmailAddress checks the email address against the user's verified email list.
-// If smtp-sender-verify is false (default), the email is passed through as-is for
-// backwards compatibility. If true, the user must be authenticated and the email must be
-// in their verified list. "yes"/"true"/"1" resolves to the user's primary email (falling
-// back to the first verified email if no primary is designated).
+// convertEmailAddress resolves the X-Email value to the address ntfy should send to.
+//
+// "yes"/"true"/"1" resolves to the user's primary verified address -- or, if no primary is
+// designated (e.g. a provisioned user), the first verified address (alphabetically). This is
+// independent of smtp-sender-verify: it only requires an authenticated user with a verified
+// address, since it means "send to my own email".
+//
+// A literal address is sent as-is when smtp-sender-verify is false (the default, backwards
+// compatible); when true, the address must be one the user has verified.
 func (s *Server) convertEmailAddress(u *user.User, email string) (string, *errHTTP) {
-	if !s.config.SMTPSenderVerify {
-		if toBool(email) {
-			return "", errHTTPBadRequestEmailAddressInvalid
+	if toBool(email) {
+		if u == nil {
+			return "", errHTTPBadRequestAnonymousEmailNotAllowed
+		} else if s.userManager == nil {
+			return "", errHTTPBadRequestEmailAddressNotVerified
 		}
+		primary, err := s.userManager.PrimaryEmail(u.ID)
+		if err != nil {
+			return "", errHTTPInternalError
+		} else if primary != "" {
+			return primary, nil
+		}
+		// No primary designated -> fall back to the first verified address, if any
+		emails, err := s.userManager.Emails(u.ID)
+		if err != nil {
+			return "", errHTTPInternalError
+		} else if len(emails) > 0 {
+			return emails[0], nil
+		}
+		return "", errHTTPBadRequestEmailAddressNotVerified
+	}
+	// A literal address
+	if !s.config.SMTPSenderVerify {
 		return email, nil
 	} else if u == nil {
 		return "", errHTTPBadRequestAnonymousEmailNotAllowed
@@ -882,17 +905,6 @@ func (s *Server) convertEmailAddress(u *user.User, email string) (string, *errHT
 	emails, err := s.userManager.Emails(u.ID)
 	if err != nil {
 		return "", errHTTPInternalError
-	} else if len(emails) == 0 {
-		return "", errHTTPBadRequestEmailAddressNotVerified
-	}
-	if toBool(email) {
-		primary, err := s.userManager.PrimaryEmail(u.ID)
-		if err != nil {
-			return "", errHTTPInternalError
-		} else if primary != "" {
-			return primary, nil
-		}
-		return emails[0], nil // No primary designated (e.g. provisioned user); fall back to first verified
 	} else if util.Contains(emails, email) {
 		return email, nil
 	}

server/server_test.go

@@ -1688,17 +1688,43 @@ func TestServer_PublishEmailVerify_BoolValueUsesPrimary(t *testing.T) {
 	})
 }
 
-func TestServer_PublishEmailVerify_BoolValue_NoVerify(t *testing.T) {
+func TestServer_PublishEmailVerify_BoolValueNoVerifyUsesPrimary(t *testing.T) {
+	forEachBackend(t, func(t *testing.T, databaseURL string) {
+		conf := newTestConfigWithAuthFile(t, databaseURL)
+		// smtp-sender-verify intentionally left false (the default)
+		s := newTestServer(t, conf)
+		mailer := &testMailer{}
+		s.mailer = mailer
+		defer s.closeDatabases()
+
+		require.Nil(t, s.userManager.AddUser("phil", "phil", user.RoleUser, false))
+		u, err := s.userManager.User("phil")
+		require.Nil(t, err)
+		require.Nil(t, s.userManager.AddEmail(u.ID, "aaa@example.com"))
+		require.Nil(t, s.userManager.AddEmail(u.ID, "zzz@example.com"))
+		require.Nil(t, s.userManager.SetPrimaryEmail(u.ID, "zzz@example.com"))
+
+		// Even with smtp-sender-verify off, "yes" resolves to the user's primary verified address
+		response := request(t, s, "PUT", "/mytopic", "hi", map[string]string{
+			"Email":         "yes",
+			"Authorization": util.BasicAuth("phil", "phil"),
+		})
+		require.Equal(t, 200, response.Code)
+		require.Equal(t, "zzz@example.com", mailer.LastTo())
+	})
+}
+
+func TestServer_PublishEmailVerify_BoolValueAnonymousRejected(t *testing.T) {
 	forEachBackend(t, func(t *testing.T, databaseURL string) {
 		s := newTestServer(t, newTestConfig(t, databaseURL))
 		s.mailer = &testMailer{}
 
-		// "yes" without smtp-sender-verify should fail with invalid address
+		// "yes" requires an authenticated user (it means "my primary"); anonymous is rejected
 		response := request(t, s, "PUT", "/mytopic", "hi", map[string]string{
 			"Email": "yes",
 		})
 		require.Equal(t, 400, response.Code)
-		require.Equal(t, 40050, toHTTPError(t, response.Body.String()).Code)
+		require.Equal(t, 40053, toHTTPError(t, response.Body.String()).Code)
 	})
 }
 

server/types.go

@@ -338,7 +338,6 @@ type apiConfigResponse struct {
 	EnablePayments      bool     `json:"enable_payments"`
 	EnableCalls         bool     `json:"enable_calls"`
 	EnableEmails        bool     `json:"enable_emails"`
-	EnableEmailVerify   bool     `json:"enable_email_verify"`
 	EnableResetPassword bool     `json:"enable_reset_password"`
 	EnableReservations  bool     `json:"enable_reservations"`
 	EnableWebPush       bool     `json:"enable_web_push"`