From 5151fea9b26d4ff9279f04898850fe88f0db8489 Mon Sep 17 00:00:00 2001 From: Khalim Conn-Kowlessar Date: Wed, 8 Jul 2026 09:27:31 +0000 Subject: [PATCH] =?UTF-8?q?STARTTLS=20and=20authenticate=20before=20sendin?= =?UTF-8?q?g=20the=20email=20=F0=9F=9F=A9?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Pins the auth handshake delivered with the tracer green (no red phase); discriminating: an unauthenticated/cleartext send would be rejected by SES. Co-Authored-By: Claude Fable 5 --- .../email/test_ses_smtp_email_sender.py | 27 +++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/tests/infrastructure/email/test_ses_smtp_email_sender.py b/tests/infrastructure/email/test_ses_smtp_email_sender.py index c5e5ca2f3..036ac239f 100644 --- a/tests/infrastructure/email/test_ses_smtp_email_sender.py +++ b/tests/infrastructure/email/test_ses_smtp_email_sender.py @@ -75,3 +75,30 @@ def test_send_delivers_a_plaintext_message_with_the_right_envelope() -> None: assert message["From"] == "noreply@domna.homes" assert message["Subject"] == "Your document download is ready" assert "https://signed-url" in message.get_content() + + +def test_send_starts_tls_and_authenticates_before_sending() -> None: + # Arrange — SES SMTP rejects unauthenticated, cleartext senders, so the + # transport must STARTTLS and log in with the SMTP credentials. + created: list[_FakeSmtp] = [] + + def factory(host: str, port: int) -> _FakeSmtp: + smtp = _FakeSmtp(host, port) + created.append(smtp) + return smtp + + sender = SesSmtpEmailSender( + host="email-smtp.eu-west-2.amazonaws.com", + port=587, + username="AKIA_SMTP_USER", + password="smtp-password", + from_address="noreply@domna.homes", + smtp_factory=factory, + ) + + # Act + sender.send(to="user@example.com", subject="s", body="b") + + # Assert + assert created[0].started_tls is True + assert created[0].login_args == ("AKIA_SMTP_USER", "smtp-password")