feat: add CloudMailin webhook for cloud email receiving

- POST /api/email/webhook/cloudmailin receives emails via HTTPS
- Stores emails in memory cache (max 50)
- Emits real-time events on new email
- Removes mock data fallback completely
- Updates status endpoint to show CloudMailin status

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

apps/backend/src/routes/email.ts

@@ -2,9 +2,10 @@
  * Email API - Cloud-compatible email fetching
  *
  * Provides REST endpoints for email retrieval using:
- * 1. Microsoft Graph API (recommended for cloud - uses HTTPS)
- * 2. IMAP with App Passwords (Outlook/Gmail - may be blocked in cloud)
- * 3. Mock data for demo purposes
+ * 1. CloudMailin webhook (recommended for cloud - receives emails via HTTPS POST)
+ * 2. Microsoft Graph API (uses HTTPS)
+ * 3. IMAP with App Passwords (Outlook/Gmail - may be blocked in cloud)
+ * 4. Mock data for demo purposes
  */
 
 import { Router, Request, Response } from 'express';
@@ -16,11 +17,15 @@ import { simpleParser } from 'mailparser';
 const router = Router();
 const log = logger.child({ module: 'email-api' });
 
-// In-memory cache
+// In-memory cache for CloudMailin webhook emails
 let emailCache: any[] = [];
 let lastFetchTime: Date | null = null;
 let lastError: string | null = null;
 const CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes
+const MAX_CACHED_EMAILS = 50; // Keep last 50 emails
+
+// CloudMailin webhook secret for validation
+const CLOUDMAILIN_SECRET = process.env.CLOUDMAILIN_SECRET || '';
 
 interface EmailMessage {
     id: string;
@@ -266,50 +271,22 @@ async function fetchEmails(forceRefresh = false): Promise<{
         }
     }
 
-    // Return mock data as fallback
-    log.info('Using mock email data');
-    const mockEmails: EmailMessage[] = [
-        {
-            id: 'mock-1',
-            subject: 'Quarterly Report Ready',
-            sender: 'analytics@company.dk',
-            content: 'The Q4 analytics report is ready for review...',
-            timestamp: new Date(Date.now() - 2 * 60 * 60 * 1000).toISOString(),
-            metadata: { isRead: false, importance: 'high', provider: 'mock' },
-        },
-        {
-            id: 'mock-2',
-            subject: 'Meeting Reminder: Strategy Session',
-            sender: 'calendar@company.dk',
-            content: 'Reminder: Strategy session tomorrow at 10:00...',
-            timestamp: new Date(Date.now() - 5 * 60 * 60 * 1000).toISOString(),
-            metadata: { isRead: false, importance: 'normal', provider: 'mock' },
-        },
-        {
-            id: 'mock-3',
-            subject: 'Security Alert: New Login',
-            sender: 'security@company.dk',
-            content: 'A new login was detected from Copenhagen...',
-            timestamp: new Date(Date.now() - 12 * 60 * 60 * 1000).toISOString(),
-            metadata: { isRead: true, importance: 'high', provider: 'mock' },
-        },
-        {
-            id: 'mock-4',
-            subject: 'Weekly Newsletter',
-            sender: 'news@industry.com',
-            content: 'This week in technology: AI advances...',
-            timestamp: new Date(Date.now() - 24 * 60 * 60 * 1000).toISOString(),
-            metadata: { isRead: true, importance: 'normal', provider: 'mock' },
-        },
-    ];
-
-    emailCache = mockEmails;
-    lastFetchTime = new Date();
+    // Return CloudMailin emails from cache if available
+    if (emailCache.length > 0) {
+        log.info(`Returning ${emailCache.length} emails from CloudMailin cache`);
+        return {
+            emails: emailCache,
+            source: 'cloudmailin-cache',
+            unreadCount: emailCache.filter(e => !e.metadata?.isRead).length,
+        };
+    }
 
+    // No emails available - CloudMailin webhook not yet received any
+    log.info('No emails in cache. Waiting for CloudMailin webhook.');
     return {
-        emails: mockEmails,
-        source: 'mock',
-        unreadCount: mockEmails.filter(e => !e.metadata?.isRead).length,
+        emails: [],
+        source: 'none',
+        unreadCount: 0,
     };
 }
 
@@ -352,23 +329,27 @@ router.get('/inbox', async (req: Request, res: Response) => {
  * Get email service status
  */
 router.get('/status', (_req: Request, res: Response) => {
+    const hasCloudMailin = emailCache.some(e => e.metadata?.provider === 'cloudmailin');
     const hasGraph = !!process.env.MS_GRAPH_ACCESS_TOKEN;
     const hasOutlook = !!(process.env.OUTLOOK_EMAIL && process.env.OUTLOOK_APP_PASSWORD);
     const hasGmail = !!(process.env.GMAIL_EMAIL && process.env.GMAIL_APP_PASSWORD);
 
     res.json({
-        configured: hasGraph || hasOutlook || hasGmail,
+        configured: hasCloudMailin || hasGraph || hasOutlook || hasGmail,
         providers: {
+            cloudmailin: hasCloudMailin,
             microsoftGraph: hasGraph,
             outlook: hasOutlook,
             gmail: hasGmail,
         },
+        webhookUrl: '/api/email/webhook/cloudmailin',
         cacheStatus: {
             count: emailCache.length,
             lastFetch: lastFetchTime?.toISOString() || null,
             ttlMs: CACHE_TTL_MS,
         },
         debug: {
+            cloudmailinEmails: emailCache.filter(e => e.metadata?.provider === 'cloudmailin').length,
             graphToken: hasGraph ? 'configured' : null,
             outlookEmail: process.env.OUTLOOK_EMAIL ? `${process.env.OUTLOOK_EMAIL.substring(0, 3)}***` : null,
             lastError: lastError,
@@ -397,4 +378,94 @@ router.post('/refresh', async (_req: Request, res: Response) => {
     }
 });
 
+/**
+ * POST /api/email/webhook/cloudmailin
+ * CloudMailin webhook - receives emails via HTTPS POST
+ * Set this URL in CloudMailin dashboard as your webhook target
+ */
+router.post('/webhook/cloudmailin', (req: Request, res: Response) => {
+    try {
+        // Optional: Validate webhook secret via Basic Auth or header
+        const authHeader = req.headers.authorization;
+        if (CLOUDMAILIN_SECRET && authHeader) {
+            const expectedAuth = `Basic ${Buffer.from(`:${CLOUDMAILIN_SECRET}`).toString('base64')}`;
+            if (authHeader !== expectedAuth) {
+                log.warn('CloudMailin webhook: Invalid authorization');
+                return res.status(401).json({ error: 'Unauthorized' });
+            }
+        }
+
+        const payload = req.body;
+        log.info('CloudMailin webhook received email', {
+            subject: payload.headers?.subject,
+            from: payload.envelope?.from
+        });
+
+        // Parse CloudMailin JSON normalized format
+        const email: EmailMessage = {
+            id: `cloudmailin-${Date.now()}-${Math.random().toString(36).substr(2, 9)}`,
+            subject: payload.headers?.subject || '(No Subject)',
+            sender: payload.headers?.from || payload.envelope?.from || 'Unknown',
+            content: payload.plain || payload.html?.replace(/<[^>]*>/g, '').substring(0, 500) || '',
+            timestamp: payload.headers?.date ? new Date(payload.headers.date).toISOString() : new Date().toISOString(),
+            metadata: {
+                isRead: false,
+                importance: 'normal',
+                provider: 'cloudmailin',
+            },
+        };
+
+        // Add to cache (newest first)
+        emailCache.unshift(email);
+
+        // Limit cache size
+        if (emailCache.length > MAX_CACHED_EMAILS) {
+            emailCache = emailCache.slice(0, MAX_CACHED_EMAILS);
+        }
+
+        lastFetchTime = new Date();
+        lastError = null;
+
+        // Emit event for real-time updates
+        eventBus.emit('email:new', {
+            type: 'email:new',
+            timestamp: new Date().toISOString(),
+            source: 'cloudmailin',
+            payload: {
+                id: email.id,
+                subject: email.subject,
+                sender: email.sender,
+                count: emailCache.length
+            },
+        });
+
+        log.info(`CloudMailin: Email stored. Cache now has ${emailCache.length} emails`);
+
+        // CloudMailin expects 2xx response
+        res.status(200).json({
+            success: true,
+            message: 'Email received',
+            id: email.id
+        });
+    } catch (error: any) {
+        log.error('CloudMailin webhook error:', error);
+        res.status(500).json({
+            success: false,
+            error: error.message || 'Failed to process email',
+        });
+    }
+});
+
+/**
+ * DELETE /api/email/cache
+ * Clear email cache (for testing)
+ */
+router.delete('/cache', (_req: Request, res: Response) => {
+    const count = emailCache.length;
+    emailCache = [];
+    lastFetchTime = null;
+    log.info(`Email cache cleared. Removed ${count} emails`);
+    res.json({ success: true, message: `Cleared ${count} emails from cache` });
+});
+
 export default router;