drop old platform ID column

apps/auth/README.md

@@ -98,7 +98,10 @@ cached login.
 
 The account blob keeps `platform`/`platformId` as the account's **primary** identity
 (the first one linked). It feeds the account DTO and a refreshed token's claims, and
-nothing authorizes off it.
+nothing authorizes off it. It is no longer indexed: migration 0008 drops the
+`account.platform_id` generated column that 0004 added, since leaving a queryable copy
+of one identity per account invites exactly the picker/grant disagreement above. Look
+identities up in `platform_account`.
 
 ## Signup caps
 

apps/auth/migrations/0008_account_drop_platform_id.sql

@@ -0,0 +1,23 @@
+-- Drop the `platform_id` generated column added by 0004. Nothing reads it any more:
+-- 0007 moved every account ↔ identity link into `platform_account`, which is now the
+-- one source of truth for the login picker and the `cached_login` grant. The column's
+-- last reader was 0007's own backfill, which has already run.
+--
+-- Leaving it would leave a SECOND, stale answer to "which account does this identity
+-- open?" — it only ever holds the account's primary identity, so an account reachable
+-- from a PC and a headset appears here under one of them. That is exactly the split
+-- that used to have the picker offer an account the grant then refused.
+--
+-- The underlying `platformId` in the JSON blob STAYS: it is the account's primary
+-- identity, and feeds the account DTO and a refreshed token's claims. This drops the
+-- generated column and its index only — a virtual column stores nothing, so no account
+-- data is rewritten or lost. The index has to go first; SQLite refuses to drop an
+-- indexed column. Kept in sync with SCHEMA_DDL in @repo/domain's accounts-db.ts.
+--
+-- Safe to run before or after the deploy that ships it: no worker queries this column,
+-- so the currently-deployed code doesn't notice it go. (`PLATFORM_BACKFILL_SQL` in
+-- src/platform-db.ts still names it in 0007's text — that statement has run and won't
+-- run again; the exported copy selects the blob instead so tests keep working.)
+
+DROP INDEX IF EXISTS idx_accounts_platform_id;
+ALTER TABLE account DROP COLUMN platform_id;

apps/auth/src/platform-db.ts

@@ -39,22 +39,30 @@ export const PLATFORM_SCHEMA_DDL: string[] = [
 ]
 
 /**
- * The one-time backfill 0007 runs after creating the table: every identity already
- * bound to an account becomes a link, so nobody loses their cached login at deploy.
- * Exported so a test can run exactly the statement the migration does.
+ * The one-time backfill 0007 ran after creating the table: every identity already bound
+ * to an account became a link, so nobody lost their cached login at deploy. It has run;
+ * this exists so a test can still exercise it, which is the only coverage that legacy
+ * blob-bound accounts get a link at all.
  *
  * `platform` is COALESCEd to 0 because nothing ever defaulted that field — an account
  * can carry a platformId with no platform recorded, and back when Steam was the only
  * verifiable platform an unset one *was* Steam.
+ *
+ * NOT byte-identical to the migration any more, deliberately. 0007 selected the
+ * `account.platform_id` generated column; 0008 drops it, so that text is unrunnable
+ * against the head schema the tests build. This selects the blob directly instead —
+ * the same values, since the dropped column was DEFINED as
+ * `json_extract(data, '$.platformId')`. 0007 is left exactly as it ran on prod.
  */
 export const PLATFORM_BACKFILL_SQL = `INSERT OR IGNORE INTO platform_account (account_id, platform, platform_id, linked_at)
 	SELECT
 		account_id,
 		COALESCE(json_extract(data, '$.platform'), 0),
-		platform_id,
+		json_extract(data, '$.platformId'),
 		COALESCE(json_extract(data, '$.createdAt'), '1970-01-01T00:00:00Z')
 	FROM account
-	WHERE platform_id IS NOT NULL AND platform_id <> ''`
+	WHERE json_extract(data, '$.platformId') IS NOT NULL
+		AND json_extract(data, '$.platformId') <> ''`
 
 /** One account ↔ platform identity link. */
 export interface PlatformLink {