fix(notification-service): resolve NotificationService-005..009 — explicit TLS modes, per-credential token cache, timeout/throttle, address validation, credential redaction

src/ScadaLink.NotificationService/SmtpTlsMode.cs

@@ -0,0 +1,49 @@
+namespace ScadaLink.NotificationService;
+
+/// <summary>
+/// NS-005: The three TLS modes the design doc defines for SMTP connections.
+/// A single boolean cannot represent the requirement, so the configured
+/// <c>SmtpConfiguration.TlsMode</c> string is parsed into this three-state enum.
+/// </summary>
+public enum SmtpTlsMode
+{
+    /// <summary>No transport security — plain SMTP. Maps to <c>SecureSocketOptions.None</c>.</summary>
+    None,
+
+    /// <summary>Opportunistic STARTTLS upgrade (typically port 587). Maps to <c>SecureSocketOptions.StartTls</c>.</summary>
+    StartTls,
+
+    /// <summary>Implicit TLS / SSL-on-connect (typically port 465). Maps to <c>SecureSocketOptions.SslOnConnect</c>.</summary>
+    Ssl,
+}
+
+/// <summary>
+/// NS-005: Parses the free-text <c>SmtpConfiguration.TlsMode</c> value into a
+/// <see cref="SmtpTlsMode"/>, rejecting unknown values rather than silently
+/// falling back to opportunistic negotiation.
+/// </summary>
+public static class SmtpTlsModeParser
+{
+    /// <summary>
+    /// Parses a configured TLS mode string. A null or empty value defaults to
+    /// <see cref="SmtpTlsMode.StartTls"/> (the design-doc default for port 587).
+    /// </summary>
+    /// <exception cref="ArgumentException">The value is not one of None/StartTLS/SSL.</exception>
+    public static SmtpTlsMode Parse(string? tlsMode)
+    {
+        if (string.IsNullOrWhiteSpace(tlsMode))
+        {
+            return SmtpTlsMode.StartTls;
+        }
+
+        return tlsMode.Trim().ToLowerInvariant() switch
+        {
+            "none" => SmtpTlsMode.None,
+            "starttls" => SmtpTlsMode.StartTls,
+            "ssl" => SmtpTlsMode.Ssl,
+            _ => throw new ArgumentException(
+                $"Unknown SMTP TLS mode '{tlsMode}'. Expected one of: None, StartTLS, SSL.",
+                nameof(tlsMode)),
+        };
+    }
+}