[thomasluizon]

Successful email and Google sign-ins did an extra user insert/commit and signup work only for new accounts. Both account states now follow the same transaction, provisioning write/read, account save, session creation and background-job enqueue sequence.

Closes thomasluizon/orbit-tickets#102. Implements ORB-96.

Approach

• AuthUserProvisioning builds and validates the same domain candidate for every authenticated email. The new IAuthUserStore and Infrastructure AuthUserStore perform a parameterized email-keyed upsert, followed by a tracked read. Conflicts update only the email to itself, preserving the stored profile, trial, language, handle, preferences and Google tokens. Candidate identity distinguishes the insert winner without reading a database-specific result field.
• VerifyCodeCommandHandler and GoogleSignInFlow execute provisioning and session persistence inside the existing unit-of-work transaction. The upsert holds the account row lock until commit; the tracked read preserves PostgreSQL's concurrency token. Marking email modified makes the subsequent account save write in both branches, including an otherwise unchanged returning account.
• Both flows enqueue CompleteSignupJob after the transaction completes. Returning-account jobs exit immediately. Signup analytics, welcome mail and referral processing run with fresh Hangfire-scoped services. Email referral processing consequently moves out of the request; Google referral processing was already background work. The existing Hangfire registration gains this job, and the service registrations gain the store.
• Existing validators and domain factory guards remain authoritative. Response contracts, route mappings, error texts, status mappings and headers are unchanged. OpenAPI generation ran during the build and produced no contract diff.

This implements the final run decision to remove branch-dependent work. It makes no exact constant-time claim and adds no response floor or wall-clock timing assertions. PostgreSQL's INSERT documentation describes the atomic insert-or-update guarantee used here.

Path audit

The defect was present on starting head b802f9e4: AuthUserProvisioning.cs:24 returned after a lookup for known emails, whereas :31 created, added and committed new accounts. VerifyCodeCommand.cs:99 also processed new-user referrals inline and :112 captured signup analytics; GoogleSignInFlow.cs:33 scheduled signup effects and :53 captured analytics only for new accounts.

Current path	Evidence and treatment
Email send, including operations and OAuth wrappers	src/Orbit.Application/Auth/Commands/SendCodeCommand.cs:16 accepts only cache and job-client collaborators; :59 enqueues verification mail. No user lookup or registration-dependent branch. Production code unchanged; constructor and existing cache/enqueue tests guard the property.
Email verify, including operations and OAuth wrappers	src/Orbit.Application/Auth/Commands/VerifyCodeCommand.cs:28 rejects invalid codes before persistence; :33 begins the common sign-in transaction and :63 always enqueues the signup decision after success. The provisioning, referral and analytics split above is removed.
Google access-token sign-in and operations wrapper	src/Orbit.Application/Auth/Commands/GoogleAuthCommand.cs:21 validates the provider token before calling the shared flow. src/Orbit.Application/Auth/Commands/GoogleSignInFlow.cs:22 now uses the same transaction/save/session/enqueue collaborators for both registration states. No change to provider-token parsing or the wrapper.
Google code sign-in and operations wrapper	src/Orbit.Application/Auth/Commands/GoogleCodeAuthCommand.cs:23 exchanges the code once; :28 dispatches CompleteGoogleSignInCommand, whose handler calls the shared Google flow. It inherits the provisioning fix. Code exchange and retry boundaries are unchanged.
Google OAuth callback	src/Orbit.Api/Controllers/OAuthController.cs:275 already dispatches GoogleCodeAuthCommand with calendar-token persistence disabled. There is no GoogleAuth action or duplicated FindOrCreateGoogleUserAsync on this head. No controller production change was needed. The new composition test drives callback, code exchange, completion and shared provisioning, comparing collaborator order and email-provisioning language/handle defaults.
Session creation and refresh	src/Orbit.Infrastructure/Services/AuthSessionService.cs:32 creates and saves a session for every successful sign-in. Refresh at :54 consumes an existing refresh credential and reads the associated user by ID at :68; it never chooses work by email registration. Unchanged.
OAuth token exchange	src/Orbit.Api/Controllers/OAuthController.cs:342 consumes an already-issued authorization code, queries prior keys, adds a new key and saves for every accepted exchange. It neither accepts an email nor provisions a user. Per-key revocation depends on credential history, not a registration lookup. Unchanged.
Other user creation	The repository-wide User.Create search finds only shared auth provisioning, the domain factory and src/Orbit.Api/Seed/StagingSeedCommand.cs:137. The latter is a staging-only seed command guarded at :50, with no public response to probe. Unchanged.

Test evidence

1. Before changing implementation or tests, ran dotnet test tests/Orbit.Application.Tests --filter 'FullyQualifiedName~VerifyCodeCommandHandlerTests|FullyQualifiedName~GoogleAuthCommandHandlerTests' --verbosity quiet on the defective head: exit 0, 22 passed. Existing success/error tests did not compare branch work.
2. Added AuthRegistrationWorkTests.SignIn_RegistrationDoesNotChangeCollaboratorOrder and ran dotnet test tests/Orbit.Application.Tests --filter FullyQualifiedName~AuthRegistrationWorkTests --verbosity quiet while implementation was unchanged: exit 1, both email and Google cases failed. The comparison exposed the signup-only insert/save/analytics calls. This red regression is preserved in commit dfb5b180 before the implementation commit.
3. After the fix, dotnet test tests/Orbit.Application.Tests --filter 'FullyQualifiedName~Commands.Auth' --verbosity quiet: exit 0, 84 passed. The branch-order test now also covers referral and Google-token inputs and asserts enqueue follows transaction completion.
4. dotnet test tests/Orbit.Infrastructure.Tests --filter 'FullyQualifiedName~AuthUserStoreTests|FullyQualifiedName~GoogleAuthFirstLoginRaceTests|FullyQualifiedName~OAuthControllerTests|FullyQualifiedName~AuthControllerTests' --verbosity quiet: exit 0, 118 passed. Actual SQL sequences match between insertion and conflict; candidate defaults persist; existing account state survives. Callback tests reach the shared command composition. Anonymous verification tests compare serialized body, status and headers for absent, expired, wrong and throttled codes, with zero persistence/session/job calls. Wrong-code tests assert one failed attempt in each registration state.
5. CompleteSignupJobTests execute signup effects and returning-account no-ops directly, including referral and analytics failures. Existing code-exchange retry tests still prove a consumed Google code is not redeemed again.

Broader checks:

• dotnet build Orbit.slnx --verbosity quiet: exit 0, zero errors.
• dotnet test tests/Orbit.Domain.Tests --verbosity quiet: exit 0, 671 passed.
• dotnet test tests/Orbit.Application.Tests --verbosity quiet: exit 0, 5,494 passed.
• dotnet test tests/Orbit.Infrastructure.Tests --verbosity quiet: exit 0, 3,364 passed.
• dotnet test tests/Orbit.Analyzers.Tests --verbosity quiet: exit 0, 32 passed, covering ORBIT0001 through ORBIT0005.

Existing package-version, API-versioning and obsolete-member warnings remain. Git hooks passed after retrying a transient formatter restore failure; hooks were never bypassed. No browser, server, live database harness or mutation testing was started.

• Unchanged infrastructure tests: 3 passed using:
  dotnet test tests/Orbit.Infrastructure.Tests --filter 'FullyQualifiedName~AuthUserStoreTests|FullyQualifiedName~GoogleAuthFirstLoginRaceTests' --verbosity minimal
• Required-column regression: temporarily removing Name from the insert columns and values made Insert_IncludesEveryRequiredMappedColumnWithoutDatabaseDefault fail with NOT NULL constraint failed: Users.Name. Command:
  dotnet test tests/Orbit.Infrastructure.Tests --filter 'FullyQualifiedName~Insert_IncludesEveryRequiredMappedColumnWithoutDatabaseDefault' --verbosity minimal
  Restored the column; final infrastructure focus: 5 passed.
• Concurrent regression initially failed with cannot start a transaction within a transaction using the shared SQLite connection. Independent connections to a temporary SQLite file fixed the harness. Both simultaneous callers now receive one account, with two sessions and one signup.
• Unchanged signup/referral tests: 10 passed using:
  dotnet test tests/Orbit.Application.Tests --filter 'FullyQualifiedName~CompleteSignupJobTests|FullyQualifiedName~ProcessReferralCodeCommandHandlerTests' --verbosity minimal
• Strengthened email-retry test failed because analytics was captured twice:
  dotnet test tests/Orbit.Application.Tests --filter 'FullyQualifiedName~CompleteSignupJobTests' --verbosity minimal
  After splitting jobs, the combined focus passed 12 tests, including one analytics capture, one referral invocation, and successful email retry.

Post-commit verification:

Command	Result
dotnet build Orbit.slnx --verbosity minimal	0 errors
Both focused commands above with --no-build	17 passed
dotnet test tests/Orbit.Domain.Tests --no-build --verbosity minimal	671 passed
dotnet test tests/Orbit.Application.Tests --no-build --verbosity minimal	5,496 passed
dotnet test tests/Orbit.Infrastructure.Tests --no-build --verbosity minimal	3,366 passed
dotnet test tests/Orbit.Analyzers.Tests --no-build --verbosity minimal	32 passed

Pre-commit gates passed. OpenAPI regeneration produced no changes. Job tests execute actual Hangfire-produced Job.Type, Method, and Args; the schema guard reads actual EF metadata.

• Existing tests with defect present: 27 passed.
• New regressions before fix: five failed as intended; all pass after fix.
• Final build: zero errors.
• Final suites: Domain 677, Application 5,502, Infrastructure 3,372, Analyzers 32 passed. All exit codes zero.
• Unchanged baseline: dotnet test tests/Orbit.Application.Tests --no-build --filter 'FullyQualifiedName~CompleteSignupJobTests' passed all 7 tests with the defect present. After the fix, all 7 passed again.
• Red: dotnet test tests/Orbit.Infrastructure.Tests --filter 'FullyQualifiedName~CompleteSignupReferralTests' exited 1. CouponFailure_RollsBackReferralAndAllowsRetryWithoutRepeatingOtherSignupJobs failed because ReferredByUserId persisted after coupon failure. Both terminal-failure cases passed.
• Green: dotnet test tests/Orbit.Infrastructure.Tests --no-build --filter 'FullyQualifiedName~CompleteSignupReferralTests' exited 0; all 3 passed.
• Final dotnet build: exit 0, zero errors.
• git diff --exit-code -- src/Orbit.Api/openapi.json: exit 0.
• Repository hooks passed; no bare narration comments added.

Full suite command	Passed	Exit
dotnet test tests/Orbit.Domain.Tests --no-build	716	0
dotnet test tests/Orbit.Application.Tests --no-build	5,520	0
dotnet test tests/Orbit.Infrastructure.Tests --no-build	3,511	0
dotnet test tests/Orbit.Analyzers.Tests --no-build	32	0

Interface evidence

• AuthUserStoreTests.NewAndExistingAccounts_ExecuteIdenticalSqlInOrder captures real EF commands executed against the repository's existing SQLite fixture, rather than mocking an invented upsert result. The observed sequence is INSERT ... ON CONFLICT ("Email") DO UPDATE, SELECT, UPDATE for both states. The test also exercises an already tracked account and verifies all persisted domain values. Conflict_PreservesDeactivatedAccountAndItsPreferences observes the real tracked entry's modified-email flag. The SQL execution return value is ignored; no affected-row count or undocumented database field is read.
• The auth tests capture Hangfire's actual Enqueue expression output at its IBackgroundJobClient.Create port: job type CompleteSignupJob, arguments [userId, isNewUser, language, referralCode], enqueued state. Tests execute the real job separately. No new Google or Supabase response fields are read, and their existing HTTP parsing is untouched. Production PostgreSQL/provider calls were not made during these unit checks.

Assumptions

• Followed the final run decision's uniform-work implementation instead of the superseded floor/configuration/p95-measurement proposal.
• Applied the Google fix in the current shared GoogleSignInFlow instead of recreating the removed OAuth Google action and duplicate provisioning helper.
• Preserved account-specific success values such as stored name and WasReactivated, as the ticket explicitly excludes changing them, instead of homogenizing those values.
• Used xUnit and the repository's existing SQLite unit-test fixture instead of the generic Vitest language and a new live-Postgres measurement harness.
• Enqueued a signup decision for every successful login instead of enqueueing only for new accounts, which would retain registration-dependent request work.
• Used the explicitly permitted column-coverage guard instead of replacing the parameterized upsert with model-derived SQL.
• Used independent SQLite file connections instead of the shared in-memory connection for concurrent callers.

Legacy accounts without signup metadata retain their historical signup behavior. Original serialized Hangfire job signatures remain compatible.

Placed the relational regression in Infrastructure.Tests to reuse its existing SQLite fixture, instead of introducing a database harness in Application.Tests.

Manual steps

None. No new environment variables, secrets, console settings, migrations, or backfills are required.

Normal deployment through GitHub Actions > Release API > Run workflow applies the included migration through Database:MigrateOnStartup. Verify the deployed commit and migration entry in __EFMigrationsHistory. No new settings or backfill required.

None introduced by this round.

[pullfrog]

Caution

A signup-job scheduling failure now turns committed email and Google sign-ins into HTTP 500 responses and can permanently skip new-account signup work.

Reviewed changes Read all 19 changed files and traced provisioning, transaction/session persistence, signup dispatch, and the affected authentication entry points.

• Uniform provisioning: Replaces lookup/insert branching with candidate creation and an email-keyed upsert, followed by a fresh tracked read and forced account update.
• Transactional authentication: Moves account provisioning, reactivation, Google-token persistence, and session creation into a common transaction sequence.
• Background signup effects: Enqueues CompleteSignupJob for every successful sign-in and moves referral processing, signup analytics, and welcome mail into scoped background execution.
• Regression coverage: Adds collaborator-order, SQL-shape/state-preservation, callback-composition, and anonymous-error parity tests. All 202 focused Application and Infrastructure auth tests passed locally; no live PostgreSQL concurrency or timing test was run.

Optional cross-model verification was unavailable: /bin/sh: 1: codex: not found.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}

[pullfrog]

Important

No new Critical or High findings in this delta. The existing post-commit signup-dispatch finding remains unresolved, so this is not an approval.

Reviewed changes Reviewed 1ea91154 against the prior review at 84d481fb, with the full PR diff as context.

• Isolated welcome-email retries: Split referral processing, signup analytics, and welcome delivery into separate jobs so an email-delivery retry does not repeat the other effects.
• Strengthened provisioning coverage: Added required-column checks against EF metadata and simultaneous same-email sign-ins using independent SQLite connections.
• Verified retry and replay behavior: Added welcome-email retry and completed-referral replay regressions. All 36 focused Application and Infrastructure tests passed locally, including shared SQLite query tests; no live PostgreSQL or timing test was run.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}

[pullfrog]

Important

A new referral failure path commits partial referral state and marks the effect complete without creating the user's discount. This needs correction before merging.

Reviewed changes Reviewed 3a445d05 against the prior Pullfrog review at 1ea91154, with the full PR diff as context.

• Preserved signup intent in nullable account fields so later sign-ins recover the original language and referral after dispatch failure.
• Isolated dispatch failures behind SignupJobDispatcher, preserving committed email and Google authentication responses and logging the request identifier.
• Serialized signup checkpoints under a user-row lock and added an additive migration to persist per-effect completion.
• Verified recovery and replay coverage with 98 Application, 129 Infrastructure, and 6 Domain tests passing. A separate temporary SQLite diagnostic reproduced the partial-referral commit described inline; no live PostgreSQL or timing test was run.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}

[pullfrog]

No new issues found. Both prior findings are fixed and settled; no Critical or High concerns remain.

Reviewed changes Reviewed 3a445d05..f375e8e8 against the prior Pullfrog review, with the complete PR diff as context.

• Removed referral exception swallowing so failed coupon creation rolls back tracked referral mutations and leaves the completion checkpoint unset for retry.
• Added real-handler regression coverage proving rollback, successful retry in a fresh context, independent welcome and analytics completion, and checkpointing of terminal referral rejections.
• Updated migration-model assertions after merging main to distinguish the existing accountability-pair cascade migration from the additive signup fields.
• Verified 115 focused tests: 98 Application and 17 Infrastructure tests passed locally. No full-suite, live PostgreSQL, or timing test was run in this review.

  ^{｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
97.1% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud