From e98aa10892840d8d6c51d57f7b1d2f32dad39df6 Mon Sep 17 00:00:00 2001
From: Wim Van Laer <wim+github@zitadel.com>
Date: Wed, 11 Feb 2026 11:48:41 +0100
Subject: [PATCH] fix: return auth `none` when no auth is configured for smtp +
 scopes in grpc response (#11554)

# Which Problems Are Solved

- When no auth was present on a smtp configuration, the `auth` field was
`nil` on the response while it should be `none`.
- Scopes were not properly retrieved from the database resulting in all
scopes being combined in one scope when retrieving the configuration.

# How the Problems Are Solved

- Set `auth` to `none` when no auth is configured
- Use `database.TextArray[string]` as type to get the scopes from the
database

# Additional Changes

# Additional Context
---
 internal/api/grpc/admin/email_converters.go      |  6 ++++++
 internal/api/grpc/admin/email_converters_test.go | 13 +++++++++++++
 internal/query/smtp.go                           | 10 +++-------
 3 files changed, 22 insertions(+), 7 deletions(-)

diff --git a/internal/api/grpc/admin/email_converters.go b/internal/api/grpc/admin/email_converters.go
index e7b5d2465..a3bb03eaa 100644
--- a/internal/api/grpc/admin/email_converters.go
+++ b/internal/api/grpc/admin/email_converters.go
@@ -108,6 +108,12 @@ func smtpToPb(config *query.SMTP) *settings_pb.EmailProvider_Smtp {
 		ret.Smtp.Auth = xoauth2
 	}
 
+	if config.XOAuth2Auth == nil && config.PlainAuth == nil {
+		ret.Smtp.Auth = &settings_pb.EmailProviderSMTP_None{
+			None: &settings_pb.SMTPNoAuth{},
+		}
+	}
+
 	return ret
 }
 
diff --git a/internal/api/grpc/admin/email_converters_test.go b/internal/api/grpc/admin/email_converters_test.go
index 480c40d04..e2d89fe35 100644
--- a/internal/api/grpc/admin/email_converters_test.go
+++ b/internal/api/grpc/admin/email_converters_test.go
@@ -407,6 +407,19 @@ func Test_smtpToPb(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "no auth must map to none",
+			args: args{
+				req: &query.SMTP{},
+			},
+			res: &settings_pb.EmailProvider_Smtp{
+				Smtp: &settings_pb.EmailProviderSMTP{
+					Auth: &settings_pb.EmailProviderSMTP_None{
+						None: &settings_pb.SMTPNoAuth{},
+					},
+				},
+			},
+		},
 		{
 			name: "plain auth must map to plain",
 			args: args{
diff --git a/internal/query/smtp.go b/internal/query/smtp.go
index 7e215cc10..70ca4a74c 100644
--- a/internal/query/smtp.go
+++ b/internal/query/smtp.go
@@ -4,13 +4,13 @@ import (
 	"context"
 	"database/sql"
 	"errors"
-	"strings"
 	"time"
 
 	sq "github.com/Masterminds/squirrel"
 
 	"github.com/zitadel/zitadel/internal/api/authz"
 	"github.com/zitadel/zitadel/internal/crypto"
+	"github.com/zitadel/zitadel/internal/database"
 	"github.com/zitadel/zitadel/internal/domain"
 	"github.com/zitadel/zitadel/internal/query/projection"
 	"github.com/zitadel/zitadel/internal/telemetry/tracing"
@@ -451,7 +451,7 @@ type sqlSmtpConfig struct {
 	xoauth2AuthClientCredentialsClientId     sql.NullString
 	xoauth2AuthClientClientCredentialsSecret *crypto.CryptoValue
 	xoauth2AuthTokenEndpoint                 sql.NullString
-	xoauth2AuthScope                         sql.NullString
+	xoauth2AuthScope                         database.TextArray[string]
 }
 
 func (c sqlSmtpConfig) set(smtpConfig *SMTPConfig) {
@@ -466,13 +466,9 @@ func (c sqlSmtpConfig) set(smtpConfig *SMTPConfig) {
 		plainAuth = nil
 	}
 
-	scopes := strings.Split(c.xoauth2AuthScope.String, " ")
-	if len(scopes) == 1 && scopes[0] == "" {
-		scopes = nil
-	}
 	xoauth2Auth := &XOAuth2Auth{
 		TokenEndpoint: c.xoauth2AuthTokenEndpoint.String,
-		Scopes:        scopes,
+		Scopes:        []string(c.xoauth2AuthScope),
 		ClientCredentials: &XOAuthClientCredentials{
 			ClientId:     c.xoauth2AuthClientCredentialsClientId.String,
 			ClientSecret: c.xoauth2AuthClientClientCredentialsSecret,