fix: skip email verification entirely when no mail transport exists

SMTP-less self-hosted instances still marked every account
emailVerified=false and attempted a verification mail that could
never arrive. Now: no transport → accounts are created verified,
the send is skipped, and existing unverified rows are backfilled
on startup. .env.example stops defaulting SMTP_HOST to the
dev-only mailpit service.

Verified live: fresh signup returns emailVerified=true, legacy
unverified users flip on restart, sign-in unaffected.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

apps/auth/src/index.ts

@@ -5,7 +5,7 @@ import { requestId } from "hono/request-id";
 import { HTTPException } from "hono/http-exception";
 import { createClient } from "redis";
 
-import { auth, promoteAdminEmails, runAuthMigrations } from "./lib/auth.js";
+import { auth, promoteAdminEmails, runAuthMigrations, verifyUsersWithoutMailTransport } from "./lib/auth.js";
 import { authPool } from "./lib/db.js";
 import { env } from "./lib/env.js";
 
@@ -20,6 +20,7 @@ try {
 }
 
 await retry("auth_migrations", runAuthMigrations);
+await verifyUsersWithoutMailTransport();
 await promoteAdminEmails();
 
 const app = new Hono();

apps/auth/src/lib/auth.ts

@@ -4,7 +4,7 @@ import { admin, jwt } from "better-auth/plugins";
 import { getMigrations } from "better-auth/db/migration";
 
 import { authPool } from "./db.js";
-import { sendTransactionalEmail } from "./mail.js";
+import { hasMailTransport, sendTransactionalEmail } from "./mail.js";
 import { getBoolSetting } from "./settings.js";
 import { env } from "./env.js";
 
@@ -72,20 +72,29 @@ export const auth = betterAuth({
         // Gates only the public sign-up endpoint. Users created through the
         // admin plugin or OAuth callbacks take different paths and pass.
         async before(user, ctx) {
-          if (ctx?.path !== "/sign-up/email") return;
-          const { rows } = await authPool.query<{ n: number }>(
-            `select count(*)::int as n from "user"`,
-          );
-          if (rows[0].n === 0) {
-            // Bootstrap: the first public signup becomes the instance admin.
-            return { data: { ...user, role: "admin" } };
+          const data = { ...user };
+          // Without a mail transport the verification mail can never arrive —
+          // mark every created account verified so nothing downstream nags
+          // "unverified" on users nobody can verify.
+          if (!(await hasMailTransport())) {
+            data.emailVerified = true;
           }
-          const enabled = await getBoolSetting("auth.signup_enabled", env.SIGNUP_ENABLED);
-          if (!enabled) {
-            throw new APIError("FORBIDDEN", {
-              message: "Sign-up is disabled on this instance.",
-            });
+          if (ctx?.path === "/sign-up/email") {
+            const { rows } = await authPool.query<{ n: number }>(
+              `select count(*)::int as n from "user"`,
+            );
+            if (rows[0].n === 0) {
+              // Bootstrap: the first public signup becomes the instance admin.
+              return { data: { ...data, role: "admin" } };
+            }
+            const enabled = await getBoolSetting("auth.signup_enabled", env.SIGNUP_ENABLED);
+            if (!enabled) {
+              throw new APIError("FORBIDDEN", {
+                message: "Sign-up is disabled on this instance.",
+              });
+            }
           }
+          return data.emailVerified === user.emailVerified ? undefined : { data };
         },
       },
     },
@@ -94,6 +103,9 @@ export const auth = betterAuth({
     sendOnSignUp: true,
     autoSignInAfterVerification: true,
     async sendVerificationEmail({ user, url }) {
+      // No transport at all → the mail can never arrive; the user was already
+      // marked verified at creation.
+      if (!(await hasMailTransport())) return;
       // Verification is optional — a misconfigured transport must not fail
       // sign-up or sign-in.
       try {
@@ -143,6 +155,12 @@ export async function runAuthMigrations() {
   await migrations.runMigrations();
 }
 
+/** No transport → existing unverified users can never resolve that state. */
+export async function verifyUsersWithoutMailTransport() {
+  if (await hasMailTransport()) return;
+  await authPool.query(`update "user" set "emailVerified" = true where "emailVerified" = false`);
+}
+
 /** Bootstrap admins by email — run after migrations so the role column exists. */
 export async function promoteAdminEmails() {
   const emails = (env.AUTH_ADMIN_EMAILS ?? "")

apps/auth/src/lib/mail.ts

@@ -30,6 +30,14 @@ async function resolveMailConfig() {
   } as const;
 }
 
+// True when a mail transport exists (Resend key or SMTP host). Verification
+// and reset mails only make sense when mail can actually leave the box.
+export async function hasMailTransport(): Promise<boolean> {
+  const cfg = await resolveMailConfig();
+  if ("resendApiKey" in cfg && cfg.resendApiKey) return true;
+  return "smtp" in cfg && Boolean(cfg.smtp);
+}
+
 export async function sendTransactionalEmail(input: {
   to: string;
   subject: string;