Carry main fixes into redesign main (#746)

[thomasluizon]

Refs thomasluizon/orbit-tickets#746

Change

Carry the four named main commits into redesign/main in order with git cherry-pick -x. No commits were skipped.

• eb18808b (Bump the nuget-minor-patch group with 3 updates #658): updated AWSSDK.SimpleEmailV2, FirebaseAdmin, and coverlet.collector versions in the infrastructure and test project files. Applied without a conflict.
• a78ba3aa (Chore(deps): bump the github-actions group with 5 updates #657): updated pinned CodeQL, Pullfrog, AWS credentials, and Terraform setup actions in four workflow files. Applied without a conflict.
• 1d806028 (Fix Google sign-in on MCP authorization page #660): carried the server-side Google authorization redirect and callback, pending request store, identity-only token handling, Terraform redirect settings, agent catalog entries, controller and store tests, and generated OpenAPI document. The conflict in tests/Orbit.Infrastructure.Tests/Controllers/OAuthControllerTests.cs came from redesign commits 23396af4 (Redesign the transactional emails, AI push copy and error messages (R20) #532), which changed error assertions, and a2f54698 (Clean timeless text on redesign branch for #715 #577), which changed test data. Kept those redesign assertions and data, retained tests for the still available deprecated POST /oauth/google route, and added the new callback tests. The API build regenerated src/Orbit.Api/openapi.json after the final cherry-pick.
• 1f8d7629 (Pass saved account language to audio transcription #661): carried the signed-in user ID into transcription, mapped the saved account language to the transcription hint, and carried the handler, validator, and controller tests. Applied without a conflict. The HTTP request and response shape remains the same.

No EF migration changed. dotnet ef migrations has-pending-model-changes --project src/Orbit.Infrastructure --startup-project src/Orbit.Api reported no pending model changes, so there is no migration ordering question.

Assumptions

• The deprecated POST /oauth/google route remains covered by its redesign tests because the carried controller still exposes it; removing those tests with the original main patch was rejected.
• The dead CreatePendingGoogleState helper is deleted rather than kept, because it modelled the page-view allocation #962 removed and nothing calls it.

Manual steps

• In Google Cloud Console, open the Orbit OAuth web client under APIs and Services > Credentials and confirm its authorized redirect URIs include https://api.useorbit.org/oauth/google/callback and https://api-staging.useorbit.org/oauth/google/callback. The original main PR recorded these as registered. A completed Google MCP sign-in on each host confirms the callback works.
• Apply the infra/ Terraform configuration to the orbit-production-api and orbit-staging-api environment groups if the main release has not already applied it. Confirm Google__AllowedRedirectUris__1 is https://api.useorbit.org/oauth/google/callback in production and Google__AllowedRedirectUris__3 is https://api-staging.useorbit.org/oauth/google/callback in staging. Release the carrying API build through release.yml for each target environment.
• None.

Test evidence

• Focused OAuth controller and store tests: 88 passed. Focused transcription application tests: 11 passed. Focused chat controller tests: 12 passed.
• With LANG and LC_ALL unset, dotnet build Orbit.slnx --verbosity quiet exited 0 with zero errors, and dotnet test --verbosity quiet passed 8,170 tests.
• With LANG unset and LC_ALL=en_US.UTF-8, the same build exited 0 with zero errors, and the same test command passed 8,170 tests.
• node tools/arch-map.mjs, terraform fmt -check infra/configuration.tf, the dash and timeless checks, and git diff --check passed. The OpenAPI generator left the committed document unchanged after the final build.
• The original Google authorization PR records the unchanged authorize page test passing with One Tap still present, the strengthened test failing before implementation, and passing after. The original transcription PR records two unchanged handler tests passing before the fix, then the strengthened tests failing to compile because the user input and language argument were absent, and passing after implementation. Those before-fix observations were made in the original main PRs, not rerun in this carry.
• Review batch 56953fc3: git cherry-pick -x 5dc0a016 (the main fix for the review thread, api#663, ticket #962). One conflicted file, tests/Orbit.Infrastructure.Tests/Controllers/OAuthControllerTests.cs: the using block keeps both sides; the second hunk keeps this branch's GoogleAuth_WithNonce_BindsNonceRetrievableAtTokenExchange and adds main's Authorize_PageViewAllocatesNoPendingGoogleRequest; the helper CreatePendingGoogleState is removed because main replaced it with CreatePendingGoogleRequest and StartGoogle and it had no callers left.
• dotnet build Orbit.slnx exit 0 with LANG unset and with LC_ALL=en_US.UTF-8. dotnet test Orbit.slnx exit 0 in both: 8,183 passed, 0 failed. Focused OAuth controller and store run: 101 passed.
• node tools/check-suppression-allowlist.mjs exit 0 (98 sites). openapi.json regenerated by the build and unchanged.

External interface evidence

• The original Google authorization PR records a live response from Google's OpenID configuration endpoint confirming the authorization endpoint, code response, supported scopes, and S256 challenge method. It also cites the OAuth code response schema for callback query fields.
• The original transcription PR links the matching OpenAI SDK 2.14.0 generated and custom source for AudioTranscriptionOptions.Language, including its conditional multipart language field.

[pullfrog]

Caution

Anonymous requests to the authorization page now allocate unbounded server-side state without a rate limit, exposing the API to memory exhaustion. Please bound allocation before merging.

Reviewed changes across all 26 files and four commits in this carry into redesign/main:

• Dependency and workflow pins: Updates NuGet packages and pinned GitHub Actions.
• MCP Google sign-in: Adds a server-side Google redirect, PKCE state store, identity-only callback, Terraform callback settings, and OAuth tests while preserving the legacy route.
• Audio transcription: Passes the signed-in user ID through the command and hints transcription with the saved account language, with controller and handler coverage.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using GPT Sol ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes since the prior Pullfrog review: the Google sign-in flow now bounds anonymous pending state and preserves the existing MCP authorization behavior.

• Moved state allocation: The authorize page renders without creating pending state; the Google start route revalidates parameters and creates the single-use request.
• Bounded pending requests: Auth rate limits cover both browser routes, and the store caps live Google requests at 1,000 with expired-entry eviction.
• Expanded OAuth coverage: Controller and store tests cover the new start flow, no-allocation page view, rate-limit attributes, capacity, and fallback.

  ^{｜ View workflow run ｜ Using GPT Sol ｜ 𝕏}