2026-09-16 19:24:59 +02:00
|
|
|
name: halkyon_learn_server
|
|
|
|
|
description: Starting point for a Serverpod server.
|
|
|
|
|
# version: 1.0.0
|
|
|
|
|
# homepage: https://www.example.com
|
|
|
|
|
|
|
|
|
|
environment:
|
|
|
|
|
sdk: '^3.13.0'
|
|
|
|
|
|
|
|
|
|
resolution: workspace
|
|
|
|
|
|
|
|
|
|
dependencies:
|
feat(server): deleting accounts and pruning abandoned ones
deletePerson deletes a person with everything they have, in one transaction and in ADR 0001 rule 6's order: their sessions first, since a device with a valid session would re-upload everything; then their memberships and personal space, whose foreign keys cascade into every synced table and the sync engine's bookkeeping; then the person, whose identities cascade. AccountEndpoint.delete deletes the caller and tells their devices that their sessions ended.
pruneAbandonedAnonymousPeople deletes, 500 at a time, anonymous people created and unused for 90 days: their sessions have expired and nobody can ever return to them. Identified people are never pruned. PruningFutureCall runs it daily at 03:17; the server schedules it at start, cancelling the previous entry by its identifier first, since scheduling always adds one.
Tests, refusal first: deleting when not signed in; deleting removes the caller, their sessions, their anonymous identity and the content of their space, and nobody else's; pruning takes the unused and the never-signed-in, and spares the recently used, newcomers and identified people.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
2026-09-30 17:09:47 +02:00
|
|
|
clock: ^1.1.3
|
Store people's files on the server
The asset endpoint (login required) takes a file into the caller's own space
by its SHA-256 and serves an asset row's file only to its space's owner and
members; anyone else, and a deleted row, gets NotFoundException as for a
missing file. startUpload hands out Serverpod's upload description, or null
when the file is there already (claiming it anew); finishUpload keeps the
upload only if its content has the announced hash. Files are stored in the
private database storage at spaces/<space>/<sha256>, at most 20 MB.
deletePerson deletes the person's files in its transaction, and a daily
future call deletes the files no live asset row refers to, and uploads never
finished, 7 days after they were last claimed (ADR 0004, rule 5).
The tests run on the sync engine's database, as the server does, without
rollback: its writes take transactions of their own.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
2026-10-02 04:52:02 +02:00
|
|
|
crypto: ^3.0.7
|
2026-10-19 14:39:00 +02:00
|
|
|
# What every Halkyon server has (ADR 0014): signing in, the account and its
|
2026-10-19 20:14:07 +02:00
|
|
|
# deletion, pruning, the instance's basics. A Serverpod module among the
|
|
|
|
|
# repository's shared packages.
|
2026-10-19 14:39:00 +02:00
|
|
|
halkyon_base_server:
|
2026-10-19 20:14:07 +02:00
|
|
|
path: ../../../packages/halkyon_base_server
|
feat(profile): profile pages on the account domain, and links verified by rel="me"
A profile now has a page on the web, at the root of the account domain
(https://halkyon.eu/@raisondetredev where the operator set ACCOUNT_DOMAIN,
else on the instance's web server), so the address belongs to the
identity rather than to Learn and stays when other services share it
(ADR 0011). The page shows what the app's profile sheet shows, in English
or German, without JavaScript or cookies, asks search engines not to list
it, marks every link rel="me" so other sites can verify links to it, and
sends a visitor who asked on another host to its own address. Caddy
forwards /@… to the web server, and serves nothing else on the account
domain; compose now passes ACCOUNT_DOMAIN on, which it never did.
A link is verified as Mastodon verifies one: its page links back to the
profile's with rel="me". profile.checkLinks fetches each link's page, at
most ten times an hour, over HTTPS on port 443 and to public addresses
only, connecting to the address it checked and verifying the certificate
for the host, with three redirects, 1 MiB and ten seconds at most, and
keeps what links back on the profile (verifiedLinks, a column of a table
no device syncs). A changed link loses its check, a new handle all of
them. The app shows the page's address to copy, checks a link saved by
itself and on Check links, and marks verified links in the form and in
others' profiles; a check answered after a newer save only adds its
checks.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
2026-10-15 20:29:30 +02:00
|
|
|
# Reads the pages profile links point to, for their rel="me" back-links.
|
|
|
|
|
html: ^0.15.6
|
feat(auth): codes go by mail, through the SMTP service an instance sets up
Email sign-in's codes are mailed over SMTP (pub.dev's mailer), through
whichever service the passwords name: emailSmtpHost, emailSmtpPort,
emailSmtpUser, emailSmtpPassword and emailFrom (EMAIL_SMTP_* and
EMAIL_FROM in deploy/.env, with EMAIL_SIGN_IN_PEPPER). TLS only:
STARTTLS, or TLS directly on 465. learn.halkyon.eu sends through Proton's
SMTP submission. Without a service, codes still go to the log in
development, and elsewhere there is no email sign-in.
The mail is plain text, in English or German: the code first and in the
subject, so it shows in the notification and the system can offer it,
the instance it signs in to, its 15 minutes, and that it can be ignored;
no links, no tracking, no HTML. A mail that couldn't be sent is a refusal
of its own (mailFailed): nothing of the request is kept, and the log
names the error's type only, as the service's answer may name the
address. A fake SMTP server on loopback drives the real mailer in the
tests: it delivers, and nothing goes to a server without TLS.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
2026-10-15 20:00:52 +02:00
|
|
|
# Mails email sign-in's codes over SMTP (ADR 0010).
|
|
|
|
|
mailer: ^7.2.0
|
2026-10-09 11:09:52 +02:00
|
|
|
serverpod: 4.0.4
|
|
|
|
|
serverpod_auth_idp_server: 4.0.4
|
|
|
|
|
serverpod_offline_sync_server: 0.0.10
|
2026-09-16 19:24:59 +02:00
|
|
|
dev_dependencies:
|
fix(learn): the instance asks LanguageTool for its languages again a minute after it didn't answer
Switching the sidecar on learn.halkyon.eu's server recreated the server
beside LanguageTool, whose start takes a minute: the server's first look
at the languages failed, and it looked again only an hour later, as
after one that worked. Until then instance.info() named no languages,
and an app that asked meanwhile keeps that answer, so its editors check
nothing until it starts anew. A look LanguageTool doesn't answer is now
tried again a minute later, by a timer, until it answers, the languages
known before kept meanwhile; one that worked still counts for an hour.
The server's tests take fake_async (^1.3.3, as Learn's app, already in
the lock) for the timer.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
2026-10-26 12:32:06 +01:00
|
|
|
# Time in tests that wait on timers (looking again for LanguageTool's languages).
|
|
|
|
|
fake_async: ^1.3.3
|
2026-10-09 11:09:52 +02:00
|
|
|
serverpod_test: 4.0.4
|
2026-09-16 19:24:59 +02:00
|
|
|
test: ^1.25.5
|
|
|
|
|
|
|
|
|
|
serverpod:
|
|
|
|
|
# Companion Flutter apps that `serverpod start` can launch (Ctrl+R), keyed
|
|
|
|
|
# by a display alias. The default device is the web server, opening the
|
|
|
|
|
# machine's default browser when ready. All non-reserved properties are
|
|
|
|
|
# forwarded to `flutter run`. For the best IDE debugging experience, use
|
|
|
|
|
# `chrome` or a native target as the device. See the example below:
|
|
|
|
|
#
|
|
|
|
|
# Admin:
|
|
|
|
|
# path: ../apps/admin_flutter
|
|
|
|
|
# displayName: "Admin app"
|
|
|
|
|
# auto_launch: true
|
|
|
|
|
# device: chrome
|
|
|
|
|
# target: lib/main.dart
|
|
|
|
|
# web-hostname: 0.0.0.0
|
|
|
|
|
# web-port: 8090
|
|
|
|
|
# release: true
|
|
|
|
|
# pub: false
|
|
|
|
|
# dart-define:
|
|
|
|
|
# API_URL=https://admin.example.com
|
|
|
|
|
# FLAVOR=production
|
|
|
|
|
flutter_apps:
|
|
|
|
|
halkyon_learn:
|
|
|
|
|
path: ../halkyon_learn_flutter
|
|
|
|
|
displayName: "Halkyon learn app"
|
|
|
|
|
auto_launch: true
|
|
|
|
|
target: lib/driver.dart
|
|
|
|
|
device: linux
|