refactor(migration): simplify

CLAUDE.md

@@ -52,8 +52,7 @@ Android password manager using Clean Architecture per module:
 | `:feature:*` (remaining)   | `list_screen`, `item:{core,create,view}`, `credentials`, `totp`, `vault` |
 | `:automation`              | `@VaultItem` annotation + automation support                             |
 | `:automation-processor`    | KSP processor generating code from `@VaultItem`                          |
-| `:migration:create-access` | Post-migration main-password/account setup (high risk)                   |
-| `:migration:legacy-data`   | Reads/decrypts the legacy v1 database for import (high risk)             |
+| `:legacy-migration`        | The whole v1 to v2 migration: main password, item import (high risk)     |
 | `:rust`                    | Rust crypto/passkey ops via UniFFI-generated Kotlin bindings             |
 
 ## Key Patterns
@@ -127,8 +126,12 @@ carries its own rules:
 
 ## Sensitive Areas
 
-- **Migration** (`migration:create-access`, `migration:legacy-data`) — preserve backward compat,
-  smallest safe change
+- **Migration** (`legacy-migration`) — preserve backward compat, smallest safe change. The v1 main
+  password record is the marker for the whole migration and is cleared only by
+  `RunPendingMigrationUseCase`, only after the item import has returned a verdict. Four names are
+  the on-disk identity of shipped v1 data and must never change: `main-password.db`,
+  `secure_element_database`, `password_manager_skey`, and the `ProtoMainPassword` field numbers.
+  `OnDiskIdentityTest` pins all four.
 - **Autofill** (`feature/autofill/`) — constrained by Android framework, keep conservative
 - **UniFFI** — preserve memory and type safety across the FFI boundary.
 - **Room schema** — check migration implications before changing entities

app/build.gradle.kts

@@ -119,8 +119,7 @@ dependencies {
     implementation(projects.feature.settings)
     implementation(projects.feature.backup)
     implementation(projects.feature.onboarding)
-    implementation(projects.migration.createAccess)
-    implementation(projects.migration.legacyData)
+    implementation(projects.legacyMigration)
 
     implementation(libs.androidx.core.splashscreen)
     implementation(libs.androidx.core.ktx)

app/src/main/kotlin/de/davis/keygo/app/presentation/AppViewModel.kt

@@ -3,7 +3,7 @@ package de.davis.keygo.app.presentation
 import androidx.lifecycle.ViewModel
 import androidx.lifecycle.viewModelScope
 import de.davis.keygo.core.identity.domain.repository.AccountRepository
-import de.davis.keygo.migration.create_access.domain.usecase.HasMainPasswordUseCase
+import de.davis.keygo.legacy_migration.domain.usecase.HasMainPasswordUseCase
 import kotlinx.coroutines.flow.MutableStateFlow
 import kotlinx.coroutines.flow.asStateFlow
 import kotlinx.coroutines.flow.update

core/identity/src/testFixtures/kotlin/de/davis/keygo/core/identity/FakeAccountRepository.kt

@@ -3,6 +3,7 @@ package de.davis.keygo.core.identity
 import de.davis.keygo.core.identity.domain.model.Account
 import de.davis.keygo.core.identity.domain.repository.AccountRepository
 import de.davis.keygo.core.util.Result
+import kotlinx.coroutines.CompletableDeferred
 import kotlinx.coroutines.flow.Flow
 import kotlinx.coroutines.flow.MutableStateFlow
 import kotlinx.coroutines.flow.asStateFlow
@@ -14,16 +15,40 @@ class FakeAccountRepository : AccountRepository {
 
     var setFails: Boolean = false
 
+    /**
+     * When set, [getOrNull] suspends on it and answers with whatever it is completed to.
+     *
+     * The only place a test can stand inside an unlock. Reading the account is the first thing
+     * `UnlockWithPasswordUseCase` does and everything after it hops to `Dispatchers.Default`, which
+     * the test scheduler cannot see, so this is the one suspension a test can both hold open and
+     * release on demand.
+     */
+    var pendingRead: CompletableDeferred<Account?>? = null
+
+    /**
+     * How many accounts were actually persisted. A caller that mints a second account overwrites
+     * the first here exactly as the real registry does, so the stored value alone cannot tell the
+     * two apart.
+     */
+    var setCount: Int = 0
+        private set
+
     fun seed(account: Account) {
         this.account.update { account }
     }
 
-    override suspend fun getOrNull(): Account? = account.value
+    // Not an elvis over await(): completing the read with null is the point of it, and an elvis
+    // would quietly hand back the seeded account instead.
+    override suspend fun getOrNull(): Account? = when (val pending = pendingRead) {
+        null -> account.value
+        else -> pending.await()
+    }
 
     override fun observe(): Flow<Account?> = account.asStateFlow()
 
     override suspend fun set(account: Account): Result<Unit, Unit> {
         if (setFails) return Result.Failure(Unit)
+        setCount++
         this.account.update { account }
         return Result.Success(Unit)
     }

core/security/src/main/kotlin/de/davis/keygo/core/security/data/SessionImpl.kt

@@ -1,9 +1,6 @@
 package de.davis.keygo.core.security.data
 
 import de.davis.keygo.core.security.domain.Session
-import kotlinx.coroutines.channels.BufferOverflow
-import kotlinx.coroutines.flow.Flow
-import kotlinx.coroutines.flow.MutableSharedFlow
 import org.koin.core.annotation.Single
 import javax.security.auth.DestroyFailedException
 
@@ -12,22 +9,12 @@ internal class SessionImpl : Session {
 
     private var _ark: ByteArray? = null
 
-    // Replayed so a collector wired up after an unlock still sees it, and buffered with
-    // DROP_OLDEST so emitting can never suspend or fail inside startSession.
-    private val _sessionStarts = MutableSharedFlow<Unit>(
-        replay = 1,
-        onBufferOverflow = BufferOverflow.DROP_OLDEST,
-    )
-
-    override val sessionStarts: Flow<Unit> = _sessionStarts
-
     override val ark: ByteArray
         get() = _ark ?: throw IllegalStateException("No active session")
 
     override fun startSession(ark: ByteArray) {
         endSession()
         _ark = ark
-        _sessionStarts.tryEmit(Unit)
     }
 
     override fun endSession() {

core/security/src/main/kotlin/de/davis/keygo/core/security/domain/Session.kt

@@ -1,21 +1,9 @@
 package de.davis.keygo.core.security.domain
 
-import kotlinx.coroutines.flow.Flow
-
 interface Session {
 
     val ark: ByteArray
 
-    /**
-     * Emits once per [startSession], for work that has to happen on every unlock however the user
-     * got there.
-     *
-     * A session is started from the auth screen, from the autofill service and from both passkey
-     * activities. A caller that enumerated those instead would go stale the next time a fifth way
-     * in is added, and would do so silently.
-     */
-    val sessionStarts: Flow<Unit>
-
     fun startSession(ark: ByteArray)
     fun endSession()
 }

core/security/src/test/kotlin/de/davis/keygo/core/security/data/SessionImplTest.kt

@@ -1,10 +1,5 @@
 package de.davis.keygo.core.security.data
 
-import kotlinx.coroutines.flow.first
-import kotlinx.coroutines.flow.launchIn
-import kotlinx.coroutines.flow.onEach
-import kotlinx.coroutines.test.runCurrent
-import kotlinx.coroutines.test.runTest
 import kotlin.test.Test
 import kotlin.test.assertEquals
 import kotlin.test.assertFailsWith
@@ -63,33 +58,4 @@ class SessionImplTest {
         session.endSession()
         session.endSession() // should not throw
     }
-
-    /**
-     * What the v1 import's retry rests on: it is not enough for the first unlock to be announced,
-     * because the run it starts is the one that may have left work behind.
-     */
-    @Test
-    fun `a later start reaches a collector that already handled an earlier one`() = runTest {
-        val starts = mutableListOf<Unit>()
-        session.sessionStarts.onEach { starts += it }.launchIn(backgroundScope)
-
-        session.startSession(generateArk())
-        runCurrent()
-        session.startSession(generateArk())
-        runCurrent()
-
-        assertEquals(2, starts.size)
-    }
-
-    /**
-     * Replayed so the work bound to an unlock still runs when its collector attaches after the
-     * fact. Nothing collecting must not be able to swallow the one signal that a v1 import, or
-     * anything wired here later, gets to hear.
-     */
-    @Test
-    fun `a start is replayed to a collector that arrives afterwards`() = runTest {
-        session.startSession(generateArk())
-
-        session.sessionStarts.first()
-    }
 }

core/security/src/testFixtures/kotlin/de/davis/keygo/core/security/crypto/FakeSession.kt

@@ -1,9 +1,6 @@
 package de.davis.keygo.core.security.crypto
 
 import de.davis.keygo.core.security.domain.Session
-import kotlinx.coroutines.channels.BufferOverflow
-import kotlinx.coroutines.flow.Flow
-import kotlinx.coroutines.flow.MutableSharedFlow
 
 /**
  * A fake implementation of [Session] that provides a fixed DEK for testing purposes.
@@ -18,24 +15,13 @@ class FakeSession(
     override val ark: ByteArray
         get() = _ark ?: throw IllegalStateException("FakeSession not started")
 
-    private val _sessionStarts = MutableSharedFlow<Unit>(
-        replay = 1,
-        onBufferOverflow = BufferOverflow.DROP_OLDEST,
-    )
-
-    override val sessionStarts: Flow<Unit> = _sessionStarts
-
     init {
-        if (startOnConstruct) {
-            _ark = ByteArray(32) { it.toByte() }
-            _sessionStarts.tryEmit(Unit)
-        }
+        if (startOnConstruct) _ark = ByteArray(32) { it.toByte() }
     }
 
     override fun startSession(ark: ByteArray) {
         _ark = ark
         startSessionCalled = true
-        _sessionStarts.tryEmit(Unit)
     }
 
     override fun endSession() {

feature/auth/build.gradle.kts

@@ -11,14 +11,15 @@ dependencies {
     implementation(projects.core.identity)
     implementation(projects.core.item)
     implementation(projects.core.ui)
-    implementation(projects.migration.createAccess)
+    implementation(projects.legacyMigration)
 
     implementation(libs.androidx.navigation.compose)
 
     testImplementation(projects.rust)
+    testImplementation(libs.robolectric)
     testImplementation(testFixtures(projects.core.identity))
     testImplementation(testFixtures(projects.core.item))
     testImplementation(testFixtures(projects.core.security))
     testImplementation(testFixtures(projects.rust))
-    testImplementation(testFixtures(projects.migration.createAccess))
+    testImplementation(testFixtures(projects.legacyMigration))
 }

feature/auth/src/main/kotlin/de/davis/keygo/feature/auth/presentation/AuthContent.kt

@@ -31,6 +31,7 @@ import androidx.compose.material3.OutlinedSecureTextField
 import androidx.compose.material3.Surface
 import androidx.compose.material3.Switch
 import androidx.compose.material3.Text
+import androidx.compose.material3.TextButton
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.getValue
 import androidx.compose.runtime.mutableStateOf
@@ -75,6 +76,79 @@ fun AuthContent(
             }
         }
 
+        is AuthState.ImportingLegacyData -> {
+            Surface(modifier = Modifier.fillMaxSize()) {
+                Column(
+                    horizontalAlignment = Alignment.CenterHorizontally,
+                    verticalArrangement = Arrangement.spacedBy(16.dp, Alignment.CenterVertically),
+                    modifier = Modifier
+                        .fillMaxSize()
+                        .padding(24.dp),
+                ) {
+                    ContainedLoadingIndicator()
+
+                    Text(
+                        text = stringResource(R.string.importing_legacy_data),
+                        style = MaterialTheme.typography.titleMedium,
+                    )
+
+                    Text(
+                        text = stringResource(R.string.importing_legacy_data_description),
+                        textAlign = TextAlign.Center,
+                        style = MaterialTheme.typography.bodyMedium,
+                    )
+                }
+            }
+        }
+
+        is AuthState.MigrationSummary -> {
+            Surface(modifier = Modifier.fillMaxSize()) {
+                AlertDialog(
+                    onDismissRequest = {},
+                    icon = {
+                        Icon(imageVector = Icons.Default.AutoFixHigh, contentDescription = null)
+                    },
+                    title = { Text(text = stringResource(R.string.migration_summary_title)) },
+                    text = {
+                        Text(
+                            text = stringResource(
+                                R.string.migration_summary_description,
+                                state.skippedItems,
+                            ),
+                        )
+                    },
+                    confirmButton = {
+                        Button(onClick = { onEvent(AuthUIEvent.ContinueAfterMigration) }) {
+                            Text(text = stringResource(R.string.continue_anyway))
+                        }
+                    },
+                )
+            }
+        }
+
+        is AuthState.MigrationFailed -> {
+            Surface(modifier = Modifier.fillMaxSize()) {
+                AlertDialog(
+                    onDismissRequest = {},
+                    icon = {
+                        Icon(imageVector = Icons.Default.AutoFixHigh, contentDescription = null)
+                    },
+                    title = { Text(text = stringResource(R.string.migration_failed_title)) },
+                    text = { Text(text = stringResource(R.string.migration_failed_description)) },
+                    confirmButton = {
+                        Button(onClick = { onEvent(AuthUIEvent.RetryMigration) }) {
+                            Text(text = stringResource(R.string.retry))
+                        }
+                    },
+                    dismissButton = {
+                        TextButton(onClick = { onEvent(AuthUIEvent.ContinueAfterMigration) }) {
+                            Text(text = stringResource(R.string.continue_anyway))
+                        }
+                    },
+                )
+            }
+        }
+
         is AuthState.Interactable -> InteractableAuthContent(
             state = state,
             onEvent = onEvent,

feature/auth/src/main/kotlin/de/davis/keygo/feature/auth/presentation/AuthScreen.kt

@@ -36,7 +36,7 @@ fun AuthScreen(onSuccess: () -> Unit) {
                     keyId = KeyId.BiometricVaultKek,
                     mode = request.cryptoMode
                 ).onSuccess {
-                    viewModel.executeCreateAccessAndClearV1(request.password, it)
+                    viewModel.executeCreateAccess(request.password, it)
                 }.onFailure {
                     Log.e("AuthScreen", "Failed to create cipher for biometric access: $it")
                     // TODO: show error
@@ -47,7 +47,7 @@ fun AuthScreen(onSuccess: () -> Unit) {
                 biometricUnlockAdapter.useAdapter {
                     biometricCryptoController.requestUnlockVault()
                 }.onSuccess {
-                    currentOnSuccess()
+                    viewModel.onSessionEstablished()
                 }
             }
         }