Sync exchange v2: Fix password deriation mismatch

[CDRussell]

Task/Issue URL: https://app.asana.com/1/137249556945/task/1216049977533939?focus=true
Tech Design URL (if applicable):

Description

Fixes a password derivation mismatch in the native 3party → ddg upgrade flow (joinAccountFromThirdPartyRecoveryCode).

When minting the new DDG credential on POST /access-credentials/ddg, credentialHashedPassword now uses newDdgKeys.passwordHash (libsodium/Argon2, same as signup) instead of an HKDF-derived hash from the new primary key. That keeps server-side stored hashes aligned with what performLogin sends via prepareForLogin.

Steps to test this PR

Note

• Fresh install internal build from this branch
• You'll need two emulators/devices to test
• When I say Sync screen I mean Settings -> Sync & Backup

Native to native pairing

• Both devices:: Go to Sync screen and choose Sync With Another Device
• Scan one barcode from the other (or copy/paste code between them)
• Both devices: On confirmation dialog that appears, choose Sync Now
• Both devices: Verify both devices appear in the Synced Devices list (might take a few seconds)

Adding in 3rd party browser

• On a 3rd party desktop browser (e.g., Firefox/Chrome), visit https://duck.ai/
• Tap Settings & More (bottom left) then Settings and tap Turn On Sync & Backup -> Sync With Another Device
• On Android device/emulator, visit Sync screen and tap Sync With Another Device
• From Android, scan the 3p browser's barcode (copy / paste between them)
• When prompted on Android, choose Sync Now
• Verify you now have three devices in your device list; the two native Android ones and your 3rd party browser.

Important

Log out of sync on all devices (e.g., Sync screen -> Turn Off Sync & Backup...

3rd party code first

• Confirm you are not signed in to sync with the native Android, nor on 3rd party browser
• In 3rd party browser: Tap Settings & More, Settings and tap Turn On Sync & Backup -> Sync With Another Device
• In Android: Sync screen then Sync with Another Device
• Use Android app to scan 3rd party browser's code (or copy from 3p to Android app)
• In Android: When you see user confirmation tap Sync Now
• In Android: Verify you see two devices in your list; the current Android device and the 3rd party browser
• In Android: Tap Sync with Another Device
• In the other Android: Tap Sync with Another Device too
• Pair these together (one scans the other's code or copy paste), and tap Sync Now on both devices when prompted
• Verify you now have 3 devices all signed into sync

---

Note

High Risk
Changes authentication hashing and the post-upgrade login/commit path for joining sync accounts; a regression could block 3party upgrades or leave credentials in a bad state until TTL expiry.

Overview
Fixes a password derivation mismatch in the native 3party → ddg upgrade flow (joinAccountFromThirdPartyRecoveryCode).

When minting the new DDG credential on POST /access-credentials/ddg, credentialHashedPassword now uses newDdgKeys.passwordHash (libsodium/Argon2, same as signup) instead of an HKDF-derived hash from the new primary key. That keeps server-side stored hashes aligned with what performLogin sends via prepareForLogin.

Step 7 no longer uses the removed performDdgLoginForUpgrade plus a manual SyncStore write. It calls performLogin (with retries), so committing the credential, persisting the unrestricted ddg token, decrypting protected_encryption_key, setting credentialId, scoped password handling, and post-login sync all follow the normal login path.

Interface/docs now describe three network steps, with the third unscoped /sync/login going through performLogin. Tests mock prepareForLogin, decrypt, and return protected_encryption_key on the post-upgrade login response.

^{Reviewed by Cursor Bugbot for commit 994d6c4. Configure here.}

[CDRussell]

• Replace thread.sleep in sync exchange v2 with coroutine-based delay #8986
• Sync v2: Remove direct integration with set_if_absent #9012
• Sync exchange v2: Fix password deriation mismatch #9014 👈 (View in Graphite)
• develop

This stack of pull requests is managed by Graphite. Learn more about stacking.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 994d6c4. Configure here.}

[CrisBarreiro]

Other than not seeing "sync now"dialog when pairing 2 Android devices, it works as expected

[CDRussell]

@CrisBarreiro , re #9014 (review)

since writing the testing steps the remote flag for canShowV2ConnectCode was disabled so you'd have been scanning a v1 code at that point, hence why not seeing the "Sync Now" confirmation.

I'll do a final round of testing to check it all works before merging this.

[CDRussell]

Merge activity

• Jun 26, 4:45 PM UTC: A user started a stack merge that includes this pull request via Graphite.
• Jun 26, 4:45 PM UTC: @CDRussell merged this pull request with Graphite.