anchor.diff:          return updatedUser;
         }
   
  +      // Create new user without oauth2 user_id, to support legacy clients
  +      // that don't have 'openid' scope, and thus, no user_id.
  +      if (auth.oauthUserId == null) {
  +        final newUser = User()
  +          ..parentKey = _db.emptyKey
  +          ..id = _uuid.v4().toString()
  +          ..oauthUserId = null
  +          ..email = auth.email
  +          ..created = DateTime.now().toUtc();
  +        await _db.commit(inserts: [newUser]);
  +        return newUser;
  +      }
  +
  +      // Create new user with oauth2 user_id mapping
         final newUser = User()
           ..parentKey = _db.emptyKey
           ..id = _uuid.v4().toString()
  
positive.code:           info.userId.isEmpty ||
            info.expiresIn == null ||
            info.expiresIn <= 0 ||
            info.verifiedEmail != true ||
            info.email == null ||
            info.email.isEmpty) {
  
negative.code:       // TODO: trigger consistency mitigation if more than one email exists
        if (usersWithEmail.length == 1 &&
            usersWithEmail.single.oauthUserId == null) {
          // Handle legacy logins that don't have 'openid' scope, and thus, no
          // user_id (oauthUserId), these can't be upgraded yet.
          if (auth.oauthUserId == null) {
            return usersWithEmail.single;
          }
  
          // We've found a single pre-migrated User with empty oauthUserId: need
          // to create OAuthUserID for it.
          final updatedUser = await _db.withTransaction((tx) async {
  