Release 3 follow-up: activate canonical production reset-email delivery

[support371]

Objective

Complete the final operational gap in Release 3 by activating canonical password-reset email delivery for the production Vercel project support371-gem-enterprise.

Verified production state

• Production deployment: dpl_4ZtNKaskxFELrYdNFFBE4NXinRfu
• Production SHA: 8eee118d5c815fbb04ddc0370df3a801761a9e80
• Git branch: main
• /api/auth/recovery-readiness returns 200 and confirms the canonical GEM reset origin, URL-fragment token transport, database-trigger session revocation, gateway recovery disabled, and legacy gateway sessions rejected.
• The same endpoint currently reports emailDeliveryConfigured: false.
• Production error/fatal runtime logs were empty for the inspected 24-hour period.

Current blocker

src/lib/mail/send.ts requires all four of the following production variables:

• SMTP_HOST
• SMTP_PORT
• SMTP_USER
• SMTP_PASS

The canonical forgot-password route intentionally fails closed with 503 until those variables exist.

A historical Twilio SendGrid API key associated with the account was deleted by SendGrid after public exposure. It must never be reused. Provision a new restricted credential and keep it only in the Vercel encrypted environment.

Legacy recovery retirement completed

The obsolete Supabase gem-password-recovery function was replaced in production with version 10. It remains JWT-protected and now returns 410 RECOVERY_GATEWAY_DISABLED, with the only recovery URL set to:

https://www.gemcybersecurityassist.com/forgot-password

The retired function can no longer create tokens, send email, mutate passwords, or direct users to the prior external recovery page.

Required configuration

Configure the following only in the Vercel Production environment for project support371-gem-enterprise:

• SMTP_HOST
• SMTP_PORT
• SMTP_USER
• SMTP_PASS
• SMTP_SECURE
• SMTP_FROM=GEM Enterprise <no-reply@gemcybersecurityassist.com>
• REPLY_TO_EMAIL=admin@gemcybersecurityassist.com
• NEXT_PUBLIC_APP_URL=https://www.gemcybersecurityassist.com

The sending domain/address must be verified with the chosen provider before live testing.

Acceptance criteria

• A new restricted mail-provider credential is created; no historical or exposed credential is reused.
• Sender/domain verification passes for gemcybersecurityassist.com.
• Vercel Production receives the required encrypted variables.
• A new production deployment from current main reaches READY.
• /api/auth/recovery-readiness reports emailDeliveryConfigured: true.
• Unknown-email recovery remains non-enumerating.
• One controlled recovery request for admin@gemcybersecurityassist.com is accepted by the provider and delivers a canonical GEM reset link.
• The reset link uses https://www.gemcybersecurityassist.com/reset-password#token=... and expires after 15 minutes.
• No password is changed during delivery validation.
• Production error/fatal runtime logs remain clean.
• Supabase sessionVersion, password-change revocation triggers, and revoked direct trigger-function privileges remain intact.

[support371]

Additional recovery hardening completed on 2026-07-17.

The obsolete public Supabase Edge Function gem-password-reset-page was still active at version 2 and retained legacy token validation plus direct password mutation through the service role. Edge-function logs showed no calls to that function during the inspected 24-hour period.

It has now been replaced in production with version 3. The function:

• no longer validates reset tokens;
• no longer reads or writes users;
• no longer hashes or changes passwords;
• no longer emits password-change audit events;
• returns HTTP 410 with RESET_PAGE_DISABLED;
• exposes only the canonical destinations https://www.gemcybersecurityassist.com/reset-password and https://www.gemcybersecurityassist.com/forgot-password;
• preserves Cache-Control: no-store, restrictive CSP, no-referrer, frame denial, and content-type protections.

The canonical Next.js password-recovery flow remains unchanged. No user account, password, token, session, or database record was modified.

Current production deployment is dpl_EMXsQJDpto9skoudshUW1C6mtwxn, SHA fd2a985896e19c64fb4cb1cb6c1b940fe2e2d03a, from GitHub main. Both Release 3 commits remain ancestors. /api/auth/recovery-readiness still reports emailDeliveryConfigured: false, so issue #200 remains open.

[support371]

Production baseline advanced on 2026-07-17 after administrator-recovery stage-one hardening.

• Current production deployment: dpl_7X4VLFz6AAT2k8hZ2w5gbQ2A4XLZ
• Current production SHA: f4c0a4ea5ee03dec5bda690ac445e0ebc35399f4
• Branch: main
• State: READY
• /api/auth/recovery-readiness: HTTP 200, canonical GEM configuration intact
• emailDeliveryConfigured: still false
• Production error/fatal runtime logs: none in the inspected period
• Release 3 users.sessionVersion: integer, non-null, default 0
• All three password-change/session-revocation triggers: enabled
• Administrator access tokens: 0 total / 0 active

Issue #200 remains open because no approved replacement SMTP credential has been provisioned. The previously exposed/deleted SendGrid key must not be reused.

[support371]

Mailbox verification on 2026-07-17 found no replacement SendGrid, Resend, Postmark, Mailgun, Brevo, or Mailjet account/setup message after the historical SendGrid credential was deleted for public exposure. The only provider record is the 2025-09-27 SendGrid deletion notice. Therefore no existing credential can be safely promoted into Vercel Production. Issue remains externally blocked until a new restricted provider credential is created and gemcybersecurityassist.com sender/domain verification is completed. No credential was read, copied, created, or exposed during this check.

[support371]

SMTP readiness diagnostics have been merged in PR #214 as main commit 401dc9745dedb7599b8a2ebf41fba887bad07079.

Exact-head evidence:

• Preview deployment dpl_CnSTiL9pVhUBvCt34epB5mqNzPPw reached READY at 9b9968bda32f9a5629beb933d2b0e80bf94a8ab7.
• Prisma checks, public claims, ESLint, TypeScript, 55 test files / 399 tests, and optimized Next.js build passed.
• The exact preview readiness endpoint returns emailDeliveryConfigured=false, lists only missing variable names, reports transport verification as on-demand, and requires administrator authorization for verification.
• The live production domain still serves the earlier readiness contract, confirming the merged production deployment has not yet been registered by the canonical Vercel project.

Issue remains open. No provider credential was configured and no email was sent. Production verification will continue when the exact main deployment appears.

[support371]

Production SMTP diagnostics verification completed on 2026-07-21. Issue remains OPEN; no credentials were configured and no email was sent.

Qualified production deployment

• Project: support371-gem-enterprise
• Deployment ID: dpl_5reafpqPHeNJuCMSsw8XDwTBwEQv
• State/target: READY / production
• Git branch: main
• Deployed SHA: bb906c8e828b6a98bee8287f8633790450feb965
• Ancestry: GitHub compare reports this SHA is 9 commits ahead of 401dc9745dedb7599b8a2ebf41fba887bad07079, with that PR feat: add SMTP readiness diagnostics #214 merge commit as the merge base.

Public readiness route

GET https://www.gemcybersecurityassist.com/api/auth/recovery-readiness

• HTTP 200
• emailDeliveryConfigured: false
• Missing variables: SMTP_HOST, SMTP_PORT, SMTP_USER, SMTP_PASS, SMTP_FROM, REPLY_TO_EMAIL
• transportVerification: on_demand
• verificationRequiresAdmin: true
• gatewayRecoveryDisabled: true
• legacyGatewaySessionsAccepted: false
• Cache-Control: no-store
• Response exposes names/status booleans only; no credential values or provider response text.

Protected verification endpoint

• Unauthenticated GET /api/auth/recovery-readiness/verify returned HTTP 405 with Cache-Control: no-store.
• The deployed PR feat: add SMTP readiness diagnostics #214 contract calls requireAdmin() before verifyMailTransport() and its regression test requires unauthenticated POST to return 401 while the transport verifier is not called.
• The route contains no sendMail() call and reports sentMessage: false / credentialsExposed: false for authorized verification.
• No SMTP verification or message send was initiated during this production check.

Runtime logs

• Production deployment error/fatal logs over the inspected 24-hour window: none.

Supabase controls

• Current public.users.sessionVersion: integer, default 0, non-null (column has no nullable option in the live schema inventory).
• Current migration history retains:
  • password_recovery_session_revocation
  • revoke_password_trigger_rpc_execute
  • audit_all_password_hash_changes
  • revoke_legacy_admin_access_validation_anon
  • revoke_legacy_admin_access_consumer_execution
• Security advisor reports no anonymous SECURITY DEFINER warnings for either administrator recovery RPC.
• public.admin_access_tokens remains RLS-enabled with 0 rows.

Result: PR #214 diagnostics are verified in canonical production. SMTP activation is still externally blocked because provider credentials/domain configuration are absent. Issue #200 must remain open.