Code audit: fix Gmail sync persistence, remove Vercel, clean up for Vapron-only #4059

Originally written by @ccantynz-alt on GitHub.
Imported from https://github.com/ccantynz-alt/AlecRae.com/pull/72

$(cat <<'EOF'

Summary

Full codebase audit across 6 parallel agents covering infrastructure, Google auth, business email, API routes, frontend, and database. Three code fixes applied from audit findings:

• Fix Issue #41 — Gmail/Outlook sync engine now actually persists emails to the database. fetchAndStoreGmailMessage() previously only did console.log; it now calls storeReceivedEmail() with proper base64url decoding and recursive MIME-part walking for Gmail payloads. Connecting Gmail will now populate the inbox.
• Remove Vercel — Deleted vercel.json (root, apps/web, apps/admin). Vapron is the only deployment target.
• Clean CI/CD — Removed the Vercel deploy job and all vercel env pull steps from standalone-deploy.yml. The deploy-vapron job now uses VAPRON_API_KEY secret directly with no Vercel fallback.
• Update .env.example — Added Google OAuth vars (GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, GOOGLE_AUTH_REDIRECT_URI, GOOGLE_REDIRECT_URI, MICROSOFT_*); added Vapron section; removed SES/MailChannels relay and S3/MinIO examples.
• Update CLAUDE.md — Infrastructure stack table updated: Vapron replaces Cloudflare Pages/R2 and Fly.io.

Audit Findings (for Craig — action required on box)

🔴 Blocking — must set these env vars on 149.28.119.158

# API won't boot in production without all 4:
DATABASE_URL=postgresql://...
JWT_SECRET=$(openssl rand -base64 48)   # must be ≥32 chars, stable
WEBAUTHN_RP_ID=alecrae.com
WEBAUTHN_ORIGIN=https://mail.alecrae.com

# Google login (silent fail if missing):
GOOGLE_CLIENT_ID=<from Google Cloud Console>
GOOGLE_CLIENT_SECRET=<from Google Cloud Console>
GOOGLE_AUTH_REDIRECT_URI=https://api.alecrae.com/v1/auth/callback/google
GOOGLE_REDIRECT_URI=https://api.alecrae.com/v1/connect/callback/gmail

# Vapron (transactional email, AI, storage):
VAPRON_API_KEY=vpk_...
VAPRON_WELCOME_EMAIL=true

🔴 Google Cloud Console (one-time setup)

1. Create OAuth 2.0 Client ID (Web application type)
2. Add both Authorized Redirect URIs:
   • https://api.alecrae.com/v1/auth/callback/google
   • https://api.alecrae.com/v1/connect/callback/gmail
3. Set GOOGLE_CLIENT_ID + GOOGLE_CLIENT_SECRET from downloaded JSON

🔴 DNS (for business email)

• alecrae.com A → 149.28.119.158 (apex still points to Vercel legacy)
• mx1.alecrae.com A → 149.28.119.158
• mx2.alecrae.com A → 149.28.119.158
• PTR for 149.28.119.158 → mail.alecrae.com (set via Vultr panel)
• Verify port 25 is open (Vultr blocks it by default)

🔴 Run DB migrations after pulling

bun run -C packages/db build
bun run db:migrate    # creates 149 tables

Test plan

• Pull this branch to box, run migrations, restart alecrae-api
• Set all env vars listed above
• Visit mail.alecrae.com/login → click "Sign in with Google" → should complete without error
• In onboarding, connect Gmail → inbox should populate with real emails (Issue #41 fix)
• In Workspace → Add Domain → register a domain → get DNS records
• Add DNS records to your domain registrar → Verify domain → Create mailbox
• Send test email to new mailbox → should appear in inbox

https://claude.ai/code/session_017mhAkS4qhMjcvVnyFi61xp EOF

Generated by Claude Code