fix: go-live audit — Gmail/Outlook import, scope bugs, sidebar 404s, auth refresh #4047

Originally written by @ccantynz-alt on GitHub.
Imported from https://github.com/ccantynz-alt/AlecRae.com/pull/84

Summary

Full go-live audit with 5 concrete fixes + MTA documentation for port-25 direct delivery.

What was broken and is now fixed

1. Gmail/Outlook history backfill was completely broken (routes/import.ts)

• startGmailImport and startOutlookImport immediately set job status to failed with a "not available" message
• The comment blamed the sync engine not persisting — but that was fixed in PR #72 (issue #41) and never updated
• Fix: both functions now load the connected account from DB (verifying ownership + provider), call syncGmailMessages / syncOutlookMessages from the real sync engine, and update job progress with actual results (up to 2000 messages)
• Craig's work emails can now be imported

2. Scope mismatch blocked IMAP connect/disconnect/list/sync (routes/connect.ts)

• requireScope("accounts:write") and requireScope("accounts:read") (with 's') — scopes that scopesForRole() in jwt.ts never issued
• Session tokens carry account:manage and account:read (no 's') → every IMAP route 403'd
• Fix: corrected to account:manage / account:read

3. Two sidebar links 404'd (layout.tsx)

• /delegation → no page exists (delegation is a tab inside /shared-inboxes)
• /developer → page lives at /settings/developer
• Fix: hrefs corrected

4. Auth token refresh missing on agent and notifications pages

• Same bug class as issue #50 (fixed for contacts/billing/voice in a prior PR)
• Both pages had local apiFetch that read the token once without 401→refresh→retry logic
• Sessions silently broke after 15 minutes
• Fix: wired refreshSession() + retry pattern from auth-token.ts

5. Gmail/Outlook import UI added to Workspace → Import tab (workspace/page.tsx, api.ts)

• Import tab only showed MBOX/EML file upload
• Fix: connectApi.listAccounts() loads connected Gmail/Outlook accounts on mount; "Import now" button per account triggers POST /v1/import/gmail or /outlook; importApi.gmail() + importApi.outlook() added to api.ts

6. MTA runbook updated for port-25 direct delivery (docs/infra/mta-box-setup.md)

• Port 25 is now open on the production box (149.28.119.158)
• Runbook now documents both paths: direct port-25 (fastest, no relay account needed, requires PTR record in Vultr) and Resend relay
• alecrae-mta systemd service still needs to be created on the box by Craig

Craig's remaining tasks to go live with email

1. Run the MTA setup runbook on the box: docs/infra/mta-box-setup.md
2. Choose delivery mode:
   • Direct (simplest now port 25 is open): Set PTR record 149.28.119.158 → mail.alecrae.com in Vultr control panel. Start MTA with no RELAY_PROVIDER env.
   • Relay: Verify alecrae.com in Resend dashboard + set RELAY_PROVIDER=smtp + SMTP_RELAY_* vars in .env
3. Sign out and sign back in to get fresh JWT with corrected scopes (fixes any lingering 403s)
4. Go to Workspace → Import tab to import work emails from connected Gmail account

Test plan

• Connect a Gmail account via Onboarding or Settings
• Go to Workspace → Import tab — connected account appears with "Import now" button
• Click "Import now" — job appears in Import Jobs list with running/completed status
• Check inbox — imported emails appear
• Sidebar: click Delegation → lands on Shared Inboxes page (not 404)
• Sidebar: click Developer → lands on Settings → Developer page (not 404)
• Wait 16+ minutes after login — Agent and Notifications pages still work (token refresh fires)

🤖 Generated with Claude Code

https://claude.ai/code/session_01GYakKc6rtYKmTgknsK1AiY

Generated by Claude Code