Merge commit from fork

SCA-138: validate migration source identity

Author: Git-on-my-level

.github/scripts/product_file_line_count_ratchet_baseline/backend-routers.json

@@ -1,13 +1,14 @@
 {
   "files": {
-    "backend/routers/apps.py": 2335,
+    "backend/routers/apps.py": 2373,
     "backend/routers/chat.py": 1588,
     "backend/routers/developer.py": 2263,
     "backend/routers/mcp_sse.py": 1858,
     "backend/routers/sync.py": 2058,
     "backend/routers/users.py": 2046
   },
   "raise_justifications": {
+    "backend/routers/apps.py": "The owner-migration route validates a source-bound Firebase anonymous-token proof before its existing database write and tracked background work, keeping the authorization decision at the HTTP mutation boundary.",
     "backend/routers/chat.py": "Merging the Windows-port chat surface with main combined the stream-error fallback (answered guard) with mains journey/attempt observability in the same SSE generators; +11 lines of combined guard flow, no new route.",
     "backend/routers/developer.py": "GET /v1/dev/user/memories and /vector/search both serve the authoritative legacy memories collection for legacy-cohort accounts with no rollout state (#9892/#10203), keeping the narrow deny/legacy-fallback decision in the route that owns the read contract.",
     "backend/routers/mcp_sse.py": "MCP SSE memory reads route their legacy-fallback decision through the shared mcp_legacy_read_authorized helper (#9892); one import line.",

app/lib/backend/http/api/apps.dart

@@ -686,11 +686,11 @@ Future<bool> deleteApiKeyServer(String appId, String keyId) async {
   }
 }
 
-Future<bool> migrateAppOwnerId(String oldId) async {
+Future<bool> migrateAppOwnerId(String oldId, String sourceToken) async {
   var response = await makeApiCall(
     url: '${Env.apiBaseUrl}v1/apps/migrate-owner?old_id=$oldId',
-    headers: {},
-    body: '',
+    headers: {'Content-Type': 'application/json'},
+    body: jsonEncode({'source_token': sourceToken}),
     method: 'POST',
   );
   try {

app/lib/providers/auth_provider.dart

@@ -19,6 +19,21 @@ import 'package:omi/utils/logger.dart';
 import 'package:omi/utils/platform/platform_manager.dart';
 import 'package:omi/utils/platform/platform_service.dart';
 
+/// Runs a provider-link helper, then migrates only the anonymous source proof
+/// it returned after the destination account has been established.
+Future<ProviderLinkResult?> completeProviderLinkAndMigrate({
+  required Future<ProviderLinkResult?> Function() linkProvider,
+  required Future<bool> Function(String sourceUid, String sourceToken) migrate,
+}) async {
+  final result = await linkProvider();
+  final source = result?.anonymousSourceMigration;
+  final destinationUid = result?.destinationUid;
+  if (source != null && destinationUid != null && destinationUid != source.uid) {
+    await migrate(source.uid, source.token);
+  }
+  return result;
+}
+
 class AuthenticationProvider extends BaseProvider {
   FirebaseAuth get _auth => FirebaseAuth.instance;
 
@@ -255,22 +270,15 @@ class AuthenticationProvider extends BaseProvider {
   Future<void> linkWithGoogle() async {
     setLoading(true);
     try {
-      final result = await AuthService.instance.linkWithGoogle();
+      final result = await completeProviderLinkAndMigrate(
+        linkProvider: AuthService.instance.linkWithGoogle,
+        migrate: migrateAppOwnerId,
+      );
       if (result == null) {
         setLoading(false);
         return;
       }
     } catch (e) {
-      if (e is FirebaseAuthException && e.code == 'credential-already-in-use') {
-        final oldUserId = FirebaseAuth.instance.currentUser?.uid;
-        if (oldUserId != null) {
-          final newUserId = FirebaseAuth.instance.currentUser?.uid;
-          if (newUserId != null) {
-            await migrateAppOwnerId(oldUserId);
-          }
-        }
-        return;
-      }
       AppSnackbar.showSnackbarError(
         globalNavigatorKey.currentContext?.l10n.authFailedToLinkGoogle ??
             'Failed to link with Google, please try again.',
@@ -294,6 +302,7 @@ class AuthenticationProvider extends BaseProvider {
           // Get existing user credentials
           final existingCred = e.credential;
           final oldUserId = FirebaseAuth.instance.currentUser?.uid;
+          final sourceToken = await FirebaseAuth.instance.currentUser?.getIdToken();
 
           // Sign out current anonymous user
           AuthService.instance.handleAuthUserChanged(null);
@@ -309,8 +318,8 @@ class AuthenticationProvider extends BaseProvider {
           SharedPreferencesUtil().uid = newUserId ?? '';
           SharedPreferencesUtil().email = FirebaseAuth.instance.currentUser?.email ?? '';
           SharedPreferencesUtil().givenName = FirebaseAuth.instance.currentUser?.displayName?.split(' ')[0] ?? '';
-          if (oldUserId != null && newUserId != null) {
-            await migrateAppOwnerId(oldUserId);
+          if (oldUserId != null && newUserId != null && sourceToken != null) {
+            await migrateAppOwnerId(oldUserId, sourceToken);
           }
           return;
         }
@@ -331,7 +340,7 @@ class AuthenticationProvider extends BaseProvider {
     }
   }
 
-  Future<bool> migrateAppOwnerId(String oldId) async {
-    return await apps_api.migrateAppOwnerId(oldId);
+  Future<bool> migrateAppOwnerId(String oldId, String sourceToken) async {
+    return await apps_api.migrateAppOwnerId(oldId, sourceToken);
   }
 }

app/lib/services/auth_service.dart

@@ -40,6 +40,47 @@ final class _FirebaseAuthTokenGateway implements AuthTokenGateway {
   Future<void> signOut() => FirebaseAuth.instance.signOut();
 }
 
+/// Source-bound proof captured before a credential-collision sign-in replaces
+/// the anonymous Firebase user.
+final class AnonymousSourceMigration {
+  const AnonymousSourceMigration({required this.uid, required this.token});
+
+  final String uid;
+  final String token;
+}
+
+/// The outcome of linking an external provider.
+///
+/// A credential collision signs in to the already-linked destination account
+/// inside [AuthService]. The caller must use [anonymousSourceMigration], rather
+/// than inspecting FirebaseAuth.currentUser after that switch, to migrate the
+/// anonymous source data.
+final class ProviderLinkResult {
+  const ProviderLinkResult({required this.destinationUid, this.anonymousSourceMigration});
+
+  final String? destinationUid;
+  final AnonymousSourceMigration? anonymousSourceMigration;
+}
+
+/// Captures an anonymous source proof before [establishDestination] can replace
+/// FirebaseAuth.currentUser, then returns both sides of the completed collision.
+@visibleForTesting
+Future<ProviderLinkResult> resolveProviderCredentialCollision({
+  required String sourceUid,
+  required bool sourceIsAnonymous,
+  required Future<String?> Function() captureSourceToken,
+  required Future<String?> Function() establishDestination,
+}) async {
+  final sourceToken = sourceIsAnonymous ? await captureSourceToken() : null;
+  final anonymousSourceMigration =
+      sourceToken == null ? null : AnonymousSourceMigration(uid: sourceUid, token: sourceToken);
+  final destinationUid = await establishDestination();
+  return ProviderLinkResult(
+    destinationUid: destinationUid,
+    anonymousSourceMigration: anonymousSourceMigration,
+  );
+}
+
 class AuthService {
   static final AuthService _instance = AuthService._internal();
   static AuthService get instance => _instance;
@@ -767,7 +808,7 @@ class AuthService {
     return base64Url.encode(digest.bytes).replaceAll('=', '');
   }
 
-  Future<UserCredential?> linkWithProvider(String provider) async {
+  Future<ProviderLinkResult?> linkWithProvider(String provider) async {
     try {
       final currentUser = FirebaseAuth.instance.currentUser;
       if (currentUser == null) {
@@ -857,11 +898,15 @@ class AuthService {
         await _updateUserPreferences(result, provider);
 
         Logger.debug('Firebase account linking successful');
-        return result;
+        return ProviderLinkResult(destinationUid: result.user?.uid);
       } catch (e) {
         if (e is FirebaseAuthException && e.code == 'credential-already-in-use') {
-          // Handle existing credential case
-          return await _handleExistingCredential(e);
+          return await resolveProviderCredentialCollision(
+            sourceUid: currentUser.uid,
+            sourceIsAnonymous: currentUser.isAnonymous,
+            captureSourceToken: currentUser.getIdToken,
+            establishDestination: () async => (await _handleExistingCredential(e)).user?.uid,
+          );
         }
         rethrow;
       }
@@ -887,7 +932,7 @@ class AuthService {
   }
 
   /// Handle the case when credential is already in use
-  Future<UserCredential?> _handleExistingCredential(FirebaseAuthException e) async {
+  Future<UserCredential> _handleExistingCredential(FirebaseAuthException e) async {
     // Get existing user credentials
     final existingCred = e.credential;
 
@@ -909,11 +954,11 @@ class AuthService {
     return result;
   }
 
-  Future<UserCredential?> linkWithGoogle() async {
+  Future<ProviderLinkResult?> linkWithGoogle() async {
     return await linkWithProvider('google');
   }
 
-  Future<UserCredential?> linkWithApple() async {
+  Future<ProviderLinkResult?> linkWithApple() async {
     return await linkWithProvider('apple');
   }
 }

app/test/unit/auth_provider_google_collision_test.dart

@@ -0,0 +1,37 @@
+import 'package:flutter_test/flutter_test.dart';
+import 'package:omi/providers/auth_provider.dart';
+import 'package:omi/services/auth_service.dart';
+
+void main() {
+  test('Google credential collision propagates the pre-switch source proof to migration after destination sign-in',
+      () async {
+    var destinationEstablished = false;
+    final migrations = <(String, String)>[];
+
+    Future<ProviderLinkResult?> googleCollisionHelper() async {
+      return resolveProviderCredentialCollision(
+        sourceUid: 'anonymous-source',
+        sourceIsAnonymous: true,
+        captureSourceToken: () async {
+          expect(destinationEstablished, isFalse);
+          return 'source-id-token';
+        },
+        establishDestination: () async {
+          destinationEstablished = true;
+          return 'linked-destination';
+        },
+      );
+    }
+
+    await completeProviderLinkAndMigrate(
+      linkProvider: googleCollisionHelper,
+      migrate: (sourceUid, sourceToken) async {
+        expect(destinationEstablished, isTrue);
+        migrations.add((sourceUid, sourceToken));
+        return true;
+      },
+    );
+
+    expect(migrations, [('anonymous-source', 'source-id-token')]);
+  });
+}

backend/routers/apps.py

@@ -10,12 +10,19 @@
 from urllib.parse import urlparse
 from pydantic import BaseModel as PydanticBaseModel, ConfigDict, Field, ValidationError
 from ulid import ULID
-from fastapi import APIRouter, Depends, Form, UploadFile, File, HTTPException, Header, Query
+from fastapi import APIRouter, Body, Depends, Form, UploadFile, File, HTTPException, Header, Query
 from fastapi.responses import HTMLResponse
 
 from langchain_core.messages import SystemMessage, HumanMessage
 from utils.apps import fetch_app_chat_tools_from_manifest
-from utils.executors import db_executor, llm_executor, storage_executor, run_blocking, start_background_task
+from utils.executors import (
+    critical_executor,
+    db_executor,
+    llm_executor,
+    storage_executor,
+    run_blocking,
+    start_background_task,
+)
 from utils.http_client import get_webhook_client
 from utils.multipart import APP_IMAGE_MAX_PART_SIZE, MultipartMaxPartSizeRoute, max_part_size
 from utils.mcp_client import (
@@ -1680,7 +1687,38 @@ def get_twitter_initial_message(username: str, uid: str = Depends(auth.get_curre
 
 
 @router.post('/v1/apps/migrate-owner', tags=['v1'], response_model=AppMigrationResponse)
-async def migrate_app_owner(old_id, uid: str = Depends(auth.get_current_user_uid)):
+async def migrate_app_owner(
+    old_id,
+    source_token: Optional[str] = Body(default=None, embed=True),
+    uid: str = Depends(auth.get_current_user_uid),
+):
+    # The client captures this token while it still owns the anonymous Firebase
+    # session, then calls this route after signing into the destination account.
+    # A providerless UserRecord is not affirmative proof of anonymity (for example,
+    # custom-token accounts can be providerless), so a bare ``old_id`` never grants
+    # access.  The source token must be a currently valid Firebase credential for
+    # that exact uid and attest to the anonymous sign-in provider.
+    if old_id == uid:
+        raise HTTPException(status_code=400, detail='Source identity must differ from the authenticated identity')
+    if not source_token:
+        raise HTTPException(status_code=403, detail='Source identity is not eligible for migration')
+
+    try:
+        source_claims = await run_blocking(
+            critical_executor, auth.auth.verify_id_token, source_token, check_revoked=True
+        )
+        source_user = await run_blocking(critical_executor, auth.get_user, old_id)
+    except Exception:
+        # Invalid/revoked tokens, missing/deleted users, and Admin lookup failures
+        # are deliberately indistinguishable to callers. Neither may mutate state.
+        raise HTTPException(status_code=403, detail='Source identity is not eligible for migration')
+
+    source_uid = source_claims.get('uid')
+    firebase_claims = source_claims.get('firebase')
+    source_provider = firebase_claims.get('sign_in_provider') if isinstance(firebase_claims, dict) else None
+    if source_uid != old_id or source_provider != 'anonymous' or source_user.disabled or source_user.provider_data:
+        raise HTTPException(status_code=403, detail='Source identity is not eligible for migration')
+
     await run_blocking(db_executor, migrate_app_owner_id_db, uid, old_id)
 
     # Tracked background tasks (not bare asyncio.create_task): keeps a live reference