halkyon/packages/halkyon_base_client/analysis_options.yaml

# The workspace's lint rules (see ../../analysis_options.yaml) for what is written
# here by hand (lib/srp.dart, lib/src/srp/); the code Serverpod generates is left out.
include: ../../analysis_options.yaml

analyzer:
  exclude:
    - lib/src/protocol/**

formatter:
  trailing_commas: preserve
feat(crypto): SRP-6a, the register's half and the device's ADR 0017's step 1. Generic over group and hash (SrpGroup); production takes RFC 5054's 3072-bit group with SHA-256. k = H(N \| PAD(g)), u = H(PAD(A) \| PAD(B)), K = H(PAD(S)), M1 = H(H(N) xor H(g) \| H(I) \| s \| PAD(A) \| PAD(B) \| K), M2 = H(PAD(A) \| M1 \| K). A and B must lie in 1..N-1 and u must not be 0; a and b are 256 bits from Random.secure(); proofs are compared in constant time. x comes from the caller (halkyon_keys makes it); RFC 5054's own x is there for the vectors only. - The register's half in halkyon_base_server (base.dart: srpChallenge, srpVerify), the device's written by hand in halkyon_base_client (srp.dart: SrpClient, srpVerifier). Serverpod's generator cleans and writes only a client's lib/src/protocol/ (serverpod_cli 4.0.4's _getDirectoriesRequiringCleaning; a generate leaves srp/ untouched). - Tests: RFC 5054 Appendix B on both halves; the client against the register, succeeding and every refusal. - The module's tests depend on its client, and pub resolves every member's dev dependencies, so Learn's server image takes the module's client into its workspace too. - The format check covers the hand-written half. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me> 2026-10-20 12:01:52 +02:00			`# The workspace's lint rules (see ../../analysis_options.yaml) for what is written`
			`# here by hand (lib/srp.dart, lib/src/srp/); the code Serverpod generates is left out.`
			`include: ../../analysis_options.yaml`
halkyon_base: a Serverpod module for sign-in, accounts and instance basics What every Halkyon server has, taken from Halkyon Learn's: anonymous, GitHub and email-code sign-in with their endpoints, an account's ways in and its deletion, the pruning of abandoned anonymous people, of sign-up attempts and of expired codes, and the instance's basics (the sign-in ways offered, the source link, the minimum app build, where people's data and its backups are). Endpoints sit under the nickname `base`. A host configures it in one place before its pod starts: its name for the mails, its source link, its minimum build, and hooks that delete its own data with a person. The tables keep Learn's names, columns and indexes, so a host moving onto the module migrates nothing but version rows. Server package under the SSPL, client under the AGPL, as Learn's are. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me> 2026-10-19 14:28:09 +02:00
			`analyzer:`
			`exclude:`
			`- lib/src/protocol/**`

			`formatter:`
			`trailing_commas: preserve`