Sync: write device_info + account_info key atomically during signup for the unified device list

[CDRussell]

Task/Issue URL: https://app.asana.com/1/137249556945/project/72649045549333/task/1217243927034013?focus=true
Tech Design URL (if applicable):
API Proposals URL(s) (if applicable):

Description

Extends signup to bring the new device into the unified device list in the same request. On the v2/ddg signup path, when canWriteUnifiedDeviceList is enabled, creating an account now includes the account_info key and this device's encrypted device_info in the signup body, so account + key + device_info are created atomically.

Unlike login, which can't include device_info in its request (the account_info public key only arrives in the login response, so it writes via a follow-up PATCH), signup mints the key locally and has the public key up front, so it's a genuine one-shot.

Steps to test this PR

Pre-requisites

• fresh install internal variant

FF enabled: Creating account writes device_info

• enable canReadUnifiedDeviceList
• enable canWriteUnifiedDeviceList
• Visit Sync Dev Settings and tap Create account
• Verify in logs (in order):

     Sync-ScopedToken: generating RSA-3072 keypair
     Sync-UnifiedDevices: encrypted device_info (… chars, kid=…)
     Sync-ScopedToken: setting credentialId=ddg after account creation
     Sync-UnifiedDevices: signup wrote device_info + account_info key (kid=…)

Production device list

• Open production sync screen to see list of devices
• Verify in logs 1 via device_info

FF disabled: Creating account writes device_info

• Clear app data
• Visit Sync Dev Settings
• enable canReadUnifiedDeviceList
• ensure canWriteUnifiedDeviceList remains disabled
• Tap Create account
• Verify in logs you do NOT see signup wrote device_info

---

Note

Medium Risk
Changes the signup wire format and local key minting for new accounts on a crypto-sensitive path, though behavior is feature-flagged and degrades gracefully when mint/encrypt fails.

Overview
On the v2/ddg account-creation path, signup can now send the unified device list in a single request when canWriteUnifiedDeviceList is enabled: a locally minted account_info protected key and a JWE device_info blob encrypted under that key’s public half.

SignupAccountInfoBuilder orchestrates mint + encrypt (best-effort; failures omit the fields and signup still succeeds). AccountInfoKeyManager.mintUnregistered exposes ddg-only minting without set-if-absent; DeviceInfoEncryptor can encrypt against an explicit public key for signup before anything is cached.

After a successful signup that included those fields, the client caches accountInfoPublicKey and marks unified-device-list migration for the user. Signup API models and createAccount wire through optional device_info and keys.

^{Reviewed by Cursor Bugbot for commit 3136fb9. Configure here.}

[CDRussell]

• Sync: write device_info + account_info key atomically during signup for the unified device list #9434 👈 (View in Graphite)
• Sync: wire device_info writing into the login flow for the unified device list #9418
• Remove gzip exclusion from /sync/devices endpoint now that backend supports it #9405 : 1 other dependent PR (#9415 )
• Sync: read device_info in the device list, preferring it over legacy device data #9395
• develop

This stack of pull requests is managed by Graphite. Learn more about stacking.

[MiSikora]

⛏️: Could we rename it to something like mintedKey? minted reads a bit like a boolean.

[CDRussell]

Merge activity

• Aug 12, 8:02 AM UTC: @CDRussell merged this pull request with Graphite.