OAuth-created accounts can violate the at-least-one-card invariant enforced elsewhere in the application

[Ridanshi]

Summary

Accounts created through OAuth onboarding can bypass the invariant that users should always possess at least one card.

This creates inconsistent account state compared to accounts created through standard onboarding flows.

Affected Files

• auth.ts
• cards.ts
• onboarding.ts

Root Cause

OAuth onboarding and standard onboarding follow different account initialization paths.

The OAuth flow can complete without creating a default card or enforcing the invariant expected elsewhere in the application.

Reproduction

1. Create a new account using OAuth.
2. Inspect associated card records.
3. Compare against accounts created through the normal onboarding flow.
4. Observe missing default-card state.

Expected Behavior

All account creation paths should enforce identical card invariants.

Actual Behavior

OAuth-created accounts can exist without a card.

Why This Is Difficult To Detect

Most testing validates authentication rather than post-onboarding invariants.

Production Impact

• Broken assumptions
• Missing profile content
• Downstream failures
• Inconsistent account state

Suggested Fix

Enforce card initialization consistently across all account creation paths.

Severity

High

[Ridanshi]

I investigated this issue and would like to work on it.

The current OAuth onboarding flow appears capable of bypassing card initialization guarantees enforced elsewhere.

I plan to:

• review account initialization logic
• preserve existing onboarding behavior
• enforce consistent card invariants
• add regression coverage for OAuth-created accounts

Please assign this issue to me.