{"nodes": [{"id": "tests_note_authentication_order_fix_authentication_order_fix", "label": "SMTP Authentication Order Fix (June 2025)", "file_type": "rationale", "source_file": "tests/note_authentication_order_fix.md", "source_location": "Summary of Fixes", "source_url": null, "captured_at": null, "author": null, "contributor": null, "rationale": "Server previously hung the SMTP session on bad credentials. Fixed by having the authenticator return AuthResult(success=False, handled=False, message='535 Authentication failed') so aiosmtpd immediately relays the error to the client instead of the connection hanging; the server also no longer force-closes the connection after failed auth (lets the client retry/quit per SMTP protocol), and AUTH LOGIN/PLAIN plus IP-whitelist fallback are advertised on both the plain SMTP port and the TLS port. STARTTLS is deliberately not advertised since only direct TLS is desired. Rationale: correctness/UX (no hanging clients) and defense-in-depth (auth first, IP whitelist as fallback, full audit logging of every attempt)."}, {"id": "tests_note_authentication_order_fix_auth_call", "label": "AuthResult / email_server/auth.py __call__ (code snippet)", "file_type": "code", "source_file": "tests/note_authentication_order_fix.md", "source_location": "Code Snippet for Immediate Authentication Failure Response", "source_url": null, "captured_at": null, "author": null, "contributor": null}, {"id": "tests_note_authentication_order_fix_ip_whitelisting_fallback", "label": "IP Whitelisting as Secondary/Fallback Authentication", "file_type": "concept", "source_file": "tests/note_authentication_order_fix.md", "source_location": "Authentication Order and Logic", "source_url": null, "captured_at": null, "author": null, "contributor": null}, {"id": "tests_note_authentication_order_fix_auth_ports", "label": "AUTH Advertised on Both Plain SMTP and TLS Ports", "file_type": "concept", "source_file": "tests/note_authentication_order_fix.md", "source_location": "What Was Fixed", "source_url": null, "captured_at": null, "author": null, "contributor": null}, {"id": "tests_note_authentication_order_fix_no_starttls", "label": "STARTTLS Not Advertised (direct TLS only)", "file_type": "rationale", "source_file": "tests/note_authentication_order_fix.md", "source_location": "Best Practices for Future Development", "source_url": null, "captured_at": null, "author": null, "contributor": null, "rationale": "STARTTLS is deliberately not used/advertised on any port because the design intent is direct TLS only (a fixed TLS port) rather than opportunistic upgrade, simplifying the security model and avoiding STARTTLS downgrade-style ambiguity."}], "edges": [{"source": "tests_note_authentication_order_fix_authentication_order_fix", "target": "tests_note_authentication_order_fix_auth_call", "relation": "references", "confidence": "EXTRACTED", "confidence_score": 1.0, "source_file": "tests/note_authentication_order_fix.md", "source_location": "Code Snippet for Immediate Authentication Failure Response", "weight": 1.0}, {"source": "tests_note_authentication_order_fix_authentication_order_fix", "target": "tests_note_authentication_order_fix_ip_whitelisting_fallback", "relation": "references", "confidence": "EXTRACTED", "confidence_score": 1.0, "source_file": "tests/note_authentication_order_fix.md", "source_location": "Authentication Order and Logic", "weight": 1.0}, {"source": "tests_note_authentication_order_fix_authentication_order_fix", "target": "tests_note_authentication_order_fix_auth_ports", "relation": "references", "confidence": "EXTRACTED", "confidence_score": 1.0, "source_file": "tests/note_authentication_order_fix.md", "source_location": "What Was Fixed / AUTH on Both Ports", "weight": 1.0}, {"source": "tests_note_authentication_order_fix_authentication_order_fix", "target": "tests_note_authentication_order_fix_no_starttls", "relation": "references", "confidence": "EXTRACTED", "confidence_score": 1.0, "source_file": "tests/note_authentication_order_fix.md", "source_location": "Best Practices for Future Development", "weight": 1.0}], "hyperedges": [{"id": "smtp_auth_ip_whitelist_flow", "label": "SMTP Authentication & IP Whitelist Flow", "nodes": ["tests_note_authentication_order_fix_authentication_order_fix", "tests_note_authentication_order_fix_ip_whitelisting_fallback", "readme_unified_user_authentication", "readme_unified_ip_whitelisting"], "relation": "participate_in", "confidence": "INFERRED", "confidence_score": 0.85, "source_file": "tests/note_authentication_order_fix.md"}]}