Function resolvePreLoginEmailSetting

backend/api/v1/auth_service.go:1674–1703

resolvePreLoginEmailSetting returns the EMAIL setting to use for unauthenticated flows (email-code sign-in, password reset). Resolution order: 1. If `workspaceID` is provided, use that workspace's EMAIL setting. The frontend resolves the workspace (from the route query or actuator context) and alway

(
	ctx context.Context,
	stores *store.Store,
	workspaceID string,
)

//  2. EMAIL_CONFIG env var — deployment-wide fallback for SaaS brand-new signup, where
//     the caller has no workspace context yet (no pre-invite, no workspace in the URL).
func resolvePreLoginEmailSetting(
	ctx context.Context,
	stores *store.Store,
	workspaceID string,
) (*storepb.EmailSetting, error) {
	if workspaceID != "" {
		emailSettingMsg, err := stores.GetSetting(ctx, workspaceID, storepb.SettingName_EMAIL)
		if err != nil {
			return nil, errors.Wrap(err, "failed to load email setting")
		}
		if emailSettingMsg == nil {
			return nil, nil
		}
		es, ok := emailSettingMsg.Value.(*storepb.EmailSetting)
		if !ok {
			return nil, nil
		}
		return es, nil
	}

	if raw := os.Getenv("EMAIL_CONFIG"); raw != "" {
		emailSetting := &storepb.EmailSetting{}
		if err := common.ProtojsonUnmarshaler.Unmarshal([]byte(raw), emailSetting); err != nil {
			return nil, errors.Wrap(err, "failed to parse EMAIL_CONFIG")
		}
		return emailSetting, nil
	}

	return nil, nil
}

// sendEmailVerificationCode generates a code, atomically stores its hash (subject to cooldown),
// and emails the plain code. Returns nil on a successful send as well as on silent-skip paths