Carry main infrastructure and auth fixes into redesign main (#746)

[thomasluizon]

Change

Carries the seven specified main commits, in order, into redesign/main with git cherry-pick -x. Links thomasluizon/orbit-tickets#746. The standing ticket stays open.

• 1480d1ba (Add Render Terraform for production and staging #621): added the Render and AWS Terraform foundation in infra/, its validation workflow, and the root allowlist entry. No overlap with redesign code.
• 4c7b76a4 (Store confirmed waitlist contacts in Orbit database #620): added database backed waitlist contacts, marketing consent handling, and 20260927211258_AddMarketingContacts. Resolved the waitlist handler conflict as described below. The migration snapshot includes the new table and unique email index.
• 2301ccc2 (Add Google authorization code sign in #622): added Google authorization code sign in, its auth operation, SDK exchange service, validator, tests, and generated OpenAPI routes. Resolved the error catalog conflict as described below. The carried controller test was aligned with redesign's existing error response shape.
• 7e946a67 (Add Cloudflare DNS and Turnstile to Terraform #623): added Cloudflare DNS and Turnstile Terraform resources and the DNS cutover check. No conflicts.
• 78b42f2d (Gate production API releases through Render #624): added the gated production API release workflow and migration bundle path. No conflicts. Staging retains Database__MigrateOnStartup=true while production uses the bundle.
• b8ea2c13 (Keep Terraform from reverting web release digests #627): made Terraform ignore workflow controlled web image digests. No conflicts.
• 5e5623ec (Configure staging billing from SSM and verify test purchases #629): added staging billing SSM inputs and test purchase coverage. No conflicts.

None of the seven commits was already carried: each showed + in git cherry -v immediately before its cherry-pick, and each corresponding feature or file was absent from the current redesign tree. All seven resulting commits retain their source hash in a cherry picked from commit trailer.

Conflict verdicts

Both content conflicts came from the redesign error copy change in 23396af4 (#532):

• src/Orbit.Application/Waitlist/Commands/ConfirmWaitlistCommand.cs: kept redesign's InvalidWaitlistConfirmation error and added main's signed language extraction, canonicalization, and contact language persistence. Both invalid token and invalid language return the shared error.
• src/Orbit.Application/Common/ErrorMessages.cs: kept redesign's ErrorCopy backed catalog and added GoogleRedirectUriNotAllowed and GoogleCodeExchangeFailed. Added the two corresponding entries in ErrorCopy.cs so English and Portuguese lookups remain complete.

The new assertion in tests/Orbit.Infrastructure.Tests/Controllers/AuthControllerTests.cs expected lower case object members. It was corrected to assert the existing PascalCase error response and HTTP 401. The controller behavior remains the one already used by GoogleAuth.

Migration order

20260927211258_AddMarketingContacts follows the redesign and previously carried migrations, ending with 20260927014645_DropFoldDueTimeScheduledRemindersTrigger. dotnet ef migrations list returned one ordered history and exited 0. The local worktree has no database connection, so applied status was unavailable. dotnet ef migrations has-pending-model-changes exited 0 and reported no model changes. The migration uses EF's CreateTable and CreateIndex methods; no raw index SQL was added.

External interface evidence

• PR #622 records the installed Google SDK package XML for TokenResponse.FromHttpResponseAsync, token properties, signature validation settings, and email claims. The exchange service delegates response parsing to that SDK.
• PR #621 records the Render and AWS provider schemas and a read only Render service response. PR #623 records the Cloudflare, AWS, and Render provider fields used by the DNS and Turnstile resources. PR #627 records the installed Render image digest schema used by ignore_changes. This worktree installed the pinned providers and terraform validate exited 0.
• PR #624 records the Render deploy response and status fields, live deploy list projections, GitHub Deployment schema, and migration bundle CLI evidence used by the release workflow.
• PR #629 records the installed Google Android Publisher SDK TestPurchase marker and AWS SSM value schema used by the carried billing change.

Assumptions

• Added the new Google errors to redesign's localized ErrorCopy catalog; rejected restoring main's inline English error catalog because it would replace redesign behavior.
• Kept the source Terraform configuration as a code carry; rejected a live infrastructure apply from this worktree because that operation needs the operator's credentials, state, and plan review.

Manual steps

• Before the staging API uses Google code sign in, confirm Google__AllowedRedirectUris__0 is https://staging.useorbit.org/auth-callback and Google__ClientId and Google__ClientSecret are configured in Render > orbit-staging-api > Environment. Add that callback in Google Cloud Console > APIs & Services > Credentials > OAuth 2.0 client > Authorized redirect URIs. A successful code exchange for that exact URI proves both settings.
• In AWS Systems Manager Parameter Store in us-east-2, confirm /orbit/staging/api/Stripe__ProProductId, /orbit/staging/api/Stripe__MonthlyPriceIdUsd, /orbit/staging/api/Stripe__YearlyPriceIdUsd, /orbit/staging/api/Stripe__MonthlyPriceIdBrl, and /orbit/staging/api/Stripe__YearlyPriceIdBrl exist as String parameters, with /orbit/staging/api/Stripe__SecretKey and /orbit/staging/api/Stripe__WebhookSecret as SecureString test values. A Terraform plan resolving all seven and mapping them to orbit-staging-api proves the inputs exist.
• In the operator shell, provide RENDER_API_KEY, CLOUDFLARE_API_TOKEN, AWS credentials, and ignored infra/local.tfvars; review and apply the Terraform plan. Verify Render's orbit-staging-api environment group has Database__MigrateOnStartup=true, the new billing keys, and BotProtection__SecretKey. Verify the turnstile_site_key and cloudflare_name_servers Terraform outputs. The production API environment must retain Database__MigrateOnStartup=false and ./efbundle as its predeploy command.
• If the redesign staging audience has confirmed contacts in Resend, export their verified fields through the Resend Contacts API and backfill the staging MarketingContacts table in the Render Postgres database, preserving opt outs. Matching distinct normalized email counts and sampled unsubscribe and suppression timestamps prove the import.

Test evidence

• env -u LANG LC_ALL=en_US.UTF-8 dotnet build Orbit.slnx -v quiet: exit 0, zero errors.
• env -u LANG LC_ALL=en_US.UTF-8 dotnet test: exit 0, 7,917 passed, zero failed across four projects. An earlier run found one failing carried controller assertion; its focused rerun passed 1/1 after the response shape correction.
• terraform fmt -check -recursive infra: exit 0. terraform -chdir=infra init -backend=false -input=false: exit 0. terraform -chdir=infra validate: exit 0.
• dotnet ef migrations list --project src/Orbit.Infrastructure --startup-project src/Orbit.Api --no-build: exit 0. dotnet ef migrations has-pending-model-changes with the same project options: exit 0, no pending changes.
• node tools/arch-map.mjs, actionlint over the three changed workflows, root allowlist, dash baseline, timeless, suppression allowlist, and git diff --check: all passed. dotnet build regenerated src/Orbit.Api/openapi.json after the last cherry-pick, with no further diff.

[pullfrog]

Important

Preserve existing marketing opt-outs before switching broadcast audiences, and prevent Terraform applies from replacing approved web image digests.

Reviewed changes across the eight commits carrying main infrastructure and auth changes into redesign/main:

• Infrastructure: Adds Render, AWS, Cloudflare, and Turnstile Terraform resources, production API deployment workflow, and EF migration bundle.
• Marketing: Moves waitlist contacts into the API database and incorporates them into broadcast, consent, unsubscribe, and account deletion flows.
• Authentication: Adds Google authorization-code sign-in and localized errors; checked its endpoint contract against the paired consumer PR orbit-ui-mobile#1219.
• Verification: Adds unit coverage, Terraform validation, and Docker bundle checks.

⚠️ Existing marketing opt-outs are missing from the new broadcast audience

The new MarketingContacts table starts empty while the existing waitlist audience lives in Resend. Switching IMarketingContactsService to database storage does not transfer Resend's unsubscribe or suppression flags: an address that opted out in Resend can reconfirm in the database and receive a broadcast. The PR only makes a staging backfill conditional; production needs a consent-preserving transition before database-backed broadcasts are enabled.

Technical details

# Preserve marketing consent during the audience cutover

## Affected sites
- `src/Orbit.Infrastructure/Migrations/20260927211258_AddMarketingContacts.cs:14` creates an empty contact table.
- `src/Orbit.Api/Extensions/ServiceCollectionExtensions.Infrastructure.cs:72` switches contact persistence to that table.
- `src/Orbit.Infrastructure/Services/DatabaseMarketingContactsService.cs:16` creates a new active contact if none exists locally.
- `src/Orbit.Application/Marketing/Commands/SendMarketingBroadcastCommand.cs:66` sends to locally eligible waitlist contacts without consulting historical Resend opt-outs.

## Required outcome
- Import and verify existing confirmed contacts and their opt-out/suppression state before any database-backed broadcast can reach them, in every affected environment, or retain an equivalent authoritative suppression check through the transition.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using GPT Sol ｜ 𝕏}

[thomasluizon]

Disposition of the review finding on infra/production.tf:52: filed as thomasluizon/orbit-tickets#814, fixed on main first and carried by the next #746 sync. This pull request only carries main unchanged.

[thomasluizon]

@pullfrog review

[pullfrog]

• Read authoritative PR diff and metadata end to end
• Trace changed behavior against base, callers and sibling contracts
• Submit one evidence-backed review

  ^{｜ View workflow run ｜ via Pullfrog ｜ Using GPT Sol ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes since the prior Pullfrog review: no new commits landed; rechecked the existing eight-commit carry and its resolved discussion.

• Rechecked infrastructure: Confirmed the Terraform digest concern is resolved in discussion and tracked for the next carry as thomasluizon/orbit-tickets#814.
• Rechecked marketing and authentication: Found no new changes to the database-backed audience or Google authorization-code flow.

  ^{｜ View workflow run ｜ Using GPT Sol ｜ 𝕏}