update in codenbase Done

Author: backendwithvishal

.env.example

@@ -60,13 +60,19 @@ ALLOWED_ORIGINS=http://localhost:3000,http://localhost:5173
 
 # ─── Email ─────────────────────────────────────────────────────
 # Dev: use Ethereal (https://ethereal.email) — free fake SMTP inbox
-# Prod: use SendGrid, Resend, SES, etc.
-SMTP_HOST=smtp.ethereal.email
+# Prod: use Gmail App Password, SendGrid, Resend, SES, etc.
+SMTP_HOST=smtp.gmail.com
 SMTP_PORT=587
 SMTP_SECURE=false
-SMTP_USER=your-ethereal-user
-SMTP_PASS=your-ethereal-pass
+# REQUIRED: your Gmail address (or SMTP username for other providers)
+SMTP_USER=your-email@gmail.com
+# REQUIRED: Gmail App Password (NOT your regular password)
+# Generate at: myaccount.google.com → Security → 2-Step Verification → App Passwords
+SMTP_PASS=your-gmail-app-password
 EMAIL_FROM=noreply@lexai.io
+# Legacy aliases (optional — SMTP_USER/SMTP_PASS take precedence if both are set)
+# MAIL_USER=your-email@gmail.com
+# MAIL_PASS=your-gmail-app-password
 
 # ─── External APIs ─────────────────────────────────────────────
 REST_COUNTRIES_URL=https://restcountries.com/v3.1

src/config/env.js

@@ -89,12 +89,13 @@ const envSchema = z.object({
   SMTP_HOST: z.string().default('smtp.gmail.com'),
   SMTP_PORT: z.coerce.number().default(587),
   SMTP_SECURE: z.string().transform((v) => v === 'true').default('false'),
+  // Canonical SMTP credentials — set these in your .env
   SMTP_USER: z.string().default(''),
   SMTP_PASS: z.string().default(''),
   EMAIL_FROM: z.string().default('noreply@lexai.io'),
-  // Gmail credentials — used directly by the nodemailer transporter
-  MAIL_USER: z.string().min(1, 'MAIL_USER (Gmail address) is required'),
-  MAIL_PASS: z.string().min(1, 'MAIL_PASS (Gmail App Password) is required'),
+  // Legacy aliases — kept for backwards compatibility; SMTP_USER/SMTP_PASS take precedence
+  MAIL_USER: z.string().default(''),
+  MAIL_PASS: z.string().default(''),
 
   // ─── Redis Token TTLs ─────────────────────────────────────
   // How long password reset tokens live in Redis (seconds)
@@ -129,6 +130,17 @@ if (!parsed.success) {
 // Freeze the config to prevent accidental mutation anywhere in the app
 const env = Object.freeze(parsed.data);
 
+// ─── Email credential check ────────────────────────────────────────────────
+// Ensure at least one SMTP credential pair is configured so emails don't
+// silently fail at runtime. SMTP_USER/SMTP_PASS are preferred; MAIL_USER/MAIL_PASS
+// are accepted as legacy aliases.
+const emailUser = parsed.data.SMTP_USER || parsed.data.MAIL_USER;
+const emailPass = parsed.data.SMTP_PASS || parsed.data.MAIL_PASS;
+if (!emailUser || !emailPass) {
+  console.error('❌ Email configuration missing: set SMTP_USER and SMTP_PASS (or MAIL_USER and MAIL_PASS) in your .env file.');
+  process.exit(1);
+}
+
 // ─── Production Safety Checks ─────────────────────────────────────────────
 // Fail fast if placeholder secrets are used in production
 if (env.NODE_ENV === 'production') {

src/services/email.service.js

@@ -37,17 +37,22 @@ let transporter = null;
  * in server.js.
  */
 function _initTransporter() {
+  // Prefer SMTP_USER/SMTP_PASS (canonical names); fall back to MAIL_USER/MAIL_PASS
+  // for backwards compatibility with existing .env files.
+  const smtpUser = env.SMTP_USER || env.MAIL_USER;
+  const smtpPass = env.SMTP_PASS || env.MAIL_PASS;
+
   transporter = nodemailer.createTransport({
-    host: env.SMTP_HOST,   // smtp.gmail.com
-    port: env.SMTP_PORT,   // 587
-    secure: false,            // false = STARTTLS (upgrades from plain to encrypted)
+    host: env.SMTP_HOST,     // smtp.gmail.com
+    port: env.SMTP_PORT,     // 587
+    secure: env.SMTP_SECURE, // true = TLS (port 465), false = STARTTLS (port 587)
     auth: {
-      user: env.MAIL_USER, // Gmail address (from MAIL_USER in .env)
-      pass: env.MAIL_PASS, // Gmail App Password (from MAIL_PASS in .env)
+      user: smtpUser,        // Gmail address
+      pass: smtpPass,        // Gmail App Password
     },
   });
 
-  logger.info('Email transporter ready (Gmail SMTP)');
+  logger.info(`Email transporter ready (${env.SMTP_HOST}:${env.SMTP_PORT})`);
 }
 
 /**