fix(auth): close the account pre-emption + wrong-account link holes (E1 S5, SEC-10/11)

SEC-10 (account pre-emption / "pre-hijack"): a password set on an account whose
email was never verified is untrusted — whoever registered the address (to
pre-empt the real owner) could have chosen it. Both the Google-adoption callback
and admin activation (_activate_user_by_email) now drop that pre-set password and
bump the session epoch when the account isn't email_verified, so a later Google
login / admin approval can't hand the pre-set password a working login. No-op for
a verified account (the legit no-SMTP flow). +2 tests.

SEC-11 (link/upgrade bound to the session default): the OAuth link/upgrade GETs
resolved to the session DEFAULT account, so a tab acting as a secondary account
would link Google / the YouTube grant to the wrong account. The frontend now
threads the active account through the navigation URL (withActiveAccount ->
?account=<active>), and _complete_link accepts any wallet account, not only the
default, so the identity lands on the account that started the flow.

backend/app/routes/admin.py

@@ -19,6 +19,7 @@ from app.auth import (
 )
 from app.db import get_db
 from app.demo import reset_demo_state
+from app.routes.auth import bump_session_epoch
 from app.models import (
     DemoWhitelist,
     Invite,
@@ -62,6 +63,13 @@ def _activate_user_by_email(db: Session, email: str) -> None:
     it can sign in. No-op if no such user exists yet (a Google user is created at first login)."""
     user = db.execute(select(User).where(User.email == email.lower())).scalar_one_or_none()
     if user is not None and not user.is_active:
+        # SEC-10: same guard as the Google-adoption path — approving an account whose email was never
+        # verified must not activate a password set on it by whoever registered the address (a
+        # pre-emption). Drop the untrusted password + revoke any session it minted; the owner re-sets
+        # one via password-reset. (No-op when email_verified is True, e.g. legit no-SMTP registrations.)
+        if not user.email_verified:
+            user.password_hash = None
+            bump_session_epoch(user)
         user.is_active = True
         db.commit()
 

backend/app/routes/auth.py

@@ -286,6 +286,14 @@ async def callback(
                 return RedirectResponse(url="/?access=denied")
             user = existing
             user.google_sub = sub
+            # SEC-10: a password set on this account BEFORE its email was ever verified is untrusted —
+            # whoever registered the address (to pre-empt the real owner, who is only now arriving via
+            # Google) could have chosen it. Drop it now that Google attests ownership, and bump the epoch
+            # to revoke any session that pre-set password may have minted. The owner can set a fresh
+            # password via password-reset later if they also want email+password sign-in.
+            if not user.email_verified:
+                user.password_hash = None
+                bump_session_epoch(user)
             # Google verified the email and is_allowed granted access, so finish activating a
             # previously pending password registration (otherwise current_user would bounce it).
             user.email_verified = True
@@ -392,8 +400,12 @@ def _complete_link(
     Google identity owned by another account, or to silently swap a different linked identity.
     `explicit` (the popped oauth_link_explicit marker) distinguishes a "Connect Google" click from
     a YouTube upgrade — the caller pops it up front so an aborted flow leaves nothing behind."""
-    # The marker must match the live session user (guards a stale/forged marker).
-    if link_uid != request.session.get("user_id"):
+    # SEC-11: the marker must name an account signed into THIS browser — the session default OR any
+    # account in the wallet — not only the default. A tab acting as a secondary account links Google to
+    # ITSELF (the marker was set from current_user, which resolves the ?account= it navigated with), so
+    # accepting wallet membership stops the identity/token landing on the default account A instead of B.
+    accounts = request.session.get("account_ids") or []
+    if link_uid != request.session.get("user_id") and link_uid not in accounts:
         return RedirectResponse(url="/?link=error")
     user = db.get(User, link_uid)
     if user is None or user.is_demo:

backend/tests/test_auth_session.py

@@ -90,3 +90,32 @@ def test_reset_confirm_is_single_use_and_kills_existing_sessions(client, make_us
     # The token is single-use: a replay is a clean 400, not a second reset.
     replay = client.post("/auth/password-reset/confirm", json={"token": raw, "password": "another pw!!"})
     assert replay.status_code == 400
+
+
+def test_activating_an_unverified_account_drops_its_preset_password(db, make_user):
+    # SEC-10 (account pre-emption): an attacker registers victim@x with a password before the approved
+    # owner arrives. The address was never verified, so admin approval must NOT hand that pre-set
+    # password a working login — it is dropped and any session it minted is revoked.
+    from app.routes.admin import _activate_user_by_email
+
+    victim = make_user(
+        email="victim@example.com", password="attacker-chosen", email_verified=False, is_active=False
+    )
+    epoch0 = victim.session_epoch or 0
+    _activate_user_by_email(db, "victim@example.com")
+    assert victim.is_active is True
+    assert victim.password_hash is None
+    assert (victim.session_epoch or 0) == epoch0 + 1
+
+
+def test_activating_a_verified_account_keeps_its_password(db, make_user):
+    # A legit account whose email IS verified (e.g. a no-SMTP registration) keeps its password on
+    # approval — the guard must not break the normal flow.
+    from app.routes.admin import _activate_user_by_email
+
+    user = make_user(
+        email="legit@example.com", password="my own password", email_verified=True, is_active=False
+    )
+    _activate_user_by_email(db, "legit@example.com")
+    assert user.is_active is True
+    assert user.password_hash is not None

frontend/src/components/SettingsPanel.tsx

@@ -1,4 +1,5 @@
 import { useState } from "react";
+import { withActiveAccount } from "../lib/activeAccount";
 import { qk } from "../lib/queryKeys";
 import { useTranslation } from "react-i18next";
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
@@ -418,7 +419,7 @@ function SignInMethods({ me }: { me: Me }) {
           ) : (
             <button
               onClick={() => {
-                window.location.href = "/auth/link";
+                window.location.href = withActiveAccount("/auth/link");
               }}
               className="shrink-0 glass-card glass-hover px-3 py-1.5 rounded-xl text-sm transition"
             >
@@ -644,7 +645,7 @@ function Account({ me, onOpenWizard }: { me: Me; onOpenWizard: () => void }) {
               grantedHint={t("settings.account.readGrantedHint")}
               enableHint={t("settings.account.readEnableHint")}
               onEnable={() => {
-                window.location.href = "/auth/upgrade?access=read";
+                window.location.href = withActiveAccount("/auth/upgrade?access=read");
               }}
             />
             <AccessRow
@@ -653,7 +654,7 @@ function Account({ me, onOpenWizard }: { me: Me; onOpenWizard: () => void }) {
               grantedHint={t("settings.account.writeGrantedHint")}
               enableHint={t("settings.account.writeEnableHint")}
               onEnable={() => {
-                window.location.href = "/auth/upgrade?access=write";
+                window.location.href = withActiveAccount("/auth/upgrade?access=write");
               }}
             />
           </div>

frontend/src/lib/activeAccount.ts

@@ -19,6 +19,17 @@ export function activeAccountId(): number | null {
   }
 }
 
+// Append `?account=<active>` to a top-level navigation URL (SEC-11). XHRs carry the active account in
+// the X-Siftlode-Account header, but a full-page navigation (window.location) can't, so the OAuth
+// link/upgrade GETs would resolve to the SESSION DEFAULT account instead of the tab's active one — the
+// identity/token would then land on the wrong account. This threads the active account through the URL
+// so resolved_user_id picks it. No-op when there's no distinct active account pinned yet.
+export function withActiveAccount(path: string): string {
+  const id = activeAccountId();
+  if (id == null) return path;
+  return `${path}${path.includes("?") ? "&" : "?"}account=${id}`;
+}
+
 // Reactive active-account. setActiveAccount/clearActiveAccount write sessionStorage — a silent op that
 // triggers no React render — so this tab's per-account state (sort/filter/view/layout, all keyed by the
 // account) would never re-read once the account is finally known. That bites exactly once, on first

frontend/src/lib/onboarding.ts

@@ -12,6 +12,7 @@
 //                                       suppresses the auto-popup on future logins (they
 //                                       can still reopen it from Settings → Account).
 
+import { withActiveAccount } from "./activeAccount";
 import { getAccountRaw, LS, setAccountRaw } from "./storage";
 
 const ONBOARD_ACTIVE = "siftlode.onboarding.active"; // sessionStorage (not in LS, which is localStorage)
@@ -36,7 +37,7 @@ export function shouldAutoOpenOnboarding(me: {
 /** Mark a grant as in progress, then send the user to Google's consent screen. */
 export function beginGrant(access: "read" | "write"): void {
   sessionStorage.setItem(ONBOARD_ACTIVE, "1");
-  window.location.href = `/auth/upgrade?access=${access}`;
+  window.location.href = withActiveAccount(`/auth/upgrade?access=${access}`);
 }
 
 /** Leave the wizard. `dismiss` suppresses the future auto-popup (used when read is skipped). */