From 88c7cdedd039f91e19f6846171dca560b74e0f52 Mon Sep 17 00:00:00 2001
From: xhon-pelushi <xhon@pelushi.com>
Date: Wed, 12 Aug 2026 00:41:50 -0400
Subject: [PATCH] Ignore reset-password auto-enroll when mail is disabled

Account recovery requires SMTP. When mail is off, treat the organization
reset-password auto-enroll policy as inactive so invite/accept flows are
not forced to supply a reset-password key.

Fixes #7459
---
 src/db/models/org_policy.rs | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/db/models/org_policy.rs b/src/db/models/org_policy.rs
index 88b7872c..4c3d7d5a 100644
--- a/src/db/models/org_policy.rs
+++ b/src/db/models/org_policy.rs
@@ -317,6 +317,13 @@ impl OrgPolicy {
     }
 
     pub async fn org_is_reset_password_auto_enroll(org_uuid: &OrganizationId, conn: &DbConn) -> bool {
+        // Account recovery depends on outbound mail. When SMTP is disabled, treat the
+        // auto-enroll policy as inactive so invites/registration are not forced to
+        // supply a reset-password key (see check_reset_password_applicable).
+        if !CONFIG.mail_enabled() {
+            return false;
+        }
+
         match OrgPolicy::find_by_org_and_type(org_uuid, OrgPolicyType::ResetPassword, conn).await {
             Some(policy) => match serde_json::from_str::<ResetPasswordDataModel>(&policy.data) {
                 Ok(opts) => {