fix: allow empty mailer password (#6066)

fix #6046
smtp relay may allow empty password, although this is usually not safe

packages/backend/server/src/fundamentals/mailer/index.ts

@@ -8,7 +8,7 @@ import { MAILER } from './mailer';
 @OptionalModule({
   providers: [MAILER],
   exports: [MAILER],
-  requires: ['mailer.auth.user', 'mailer.auth.pass'],
+  requires: ['mailer.auth.user'],
 })
 class MailerModule {}
 

packages/backend/server/src/fundamentals/mailer/mailer.ts

@@ -1,4 +1,4 @@
-import { FactoryProvider } from '@nestjs/common';
+import { FactoryProvider, Logger } from '@nestjs/common';
 import { createTransport, Transporter } from 'nodemailer';
 import SMTPTransport from 'nodemailer/lib/smtp-transport';
 
@@ -15,7 +15,19 @@ export const MAILER: FactoryProvider<
 > = {
   provide: MAILER_SERVICE,
   useFactory: (config: Config) => {
-    return config.mailer ? createTransport(config.mailer) : undefined;
+    if (config.mailer) {
+      const logger = new Logger('Mailer');
+      const auth = config.mailer.auth;
+      if (auth && auth.user && !('pass' in auth)) {
+        logger.warn(
+          'Mailer service has not configured password, please make sure your mailer service allow empty password.'
+        );
+      }
+
+      return createTransport(config.mailer);
+    } else {
+      return undefined;
+    }
   },
   inject: [Config],
 };