2026-09-16 19:24:59 +02:00
|
|
|
name: halkyon_learn_server
|
|
|
|
|
description: Starting point for a Serverpod server.
|
|
|
|
|
# version: 1.0.0
|
|
|
|
|
# homepage: https://www.example.com
|
|
|
|
|
|
|
|
|
|
environment:
|
|
|
|
|
sdk: '^3.13.0'
|
|
|
|
|
|
|
|
|
|
resolution: workspace
|
|
|
|
|
|
|
|
|
|
dependencies:
|
feat(server): deleting accounts and pruning abandoned ones
deletePerson deletes a person with everything they have, in one transaction and in ADR 0001 rule 6's order: their sessions first, since a device with a valid session would re-upload everything; then their memberships and personal space, whose foreign keys cascade into every synced table and the sync engine's bookkeeping; then the person, whose identities cascade. AccountEndpoint.delete deletes the caller and tells their devices that their sessions ended.
pruneAbandonedAnonymousPeople deletes, 500 at a time, anonymous people created and unused for 90 days: their sessions have expired and nobody can ever return to them. Identified people are never pruned. PruningFutureCall runs it daily at 03:17; the server schedules it at start, cancelling the previous entry by its identifier first, since scheduling always adds one.
Tests, refusal first: deleting when not signed in; deleting removes the caller, their sessions, their anonymous identity and the content of their space, and nobody else's; pruning takes the unused and the never-signed-in, and spares the recently used, newcomers and identified people.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
2026-09-30 17:09:47 +02:00
|
|
|
clock: ^1.1.3
|
Store people's files on the server
The asset endpoint (login required) takes a file into the caller's own space
by its SHA-256 and serves an asset row's file only to its space's owner and
members; anyone else, and a deleted row, gets NotFoundException as for a
missing file. startUpload hands out Serverpod's upload description, or null
when the file is there already (claiming it anew); finishUpload keeps the
upload only if its content has the announced hash. Files are stored in the
private database storage at spaces/<space>/<sha256>, at most 20 MB.
deletePerson deletes the person's files in its transaction, and a daily
future call deletes the files no live asset row refers to, and uploads never
finished, 7 days after they were last claimed (ADR 0004, rule 5).
The tests run on the sync engine's database, as the server does, without
rollback: its writes take transactions of their own.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
2026-10-02 04:52:02 +02:00
|
|
|
crypto: ^3.0.7
|
feat(auth): codes go by mail, through the SMTP service an instance sets up
Email sign-in's codes are mailed over SMTP (pub.dev's mailer), through
whichever service the passwords name: emailSmtpHost, emailSmtpPort,
emailSmtpUser, emailSmtpPassword and emailFrom (EMAIL_SMTP_* and
EMAIL_FROM in deploy/.env, with EMAIL_SIGN_IN_PEPPER). TLS only:
STARTTLS, or TLS directly on 465. learn.halkyon.eu sends through Proton's
SMTP submission. Without a service, codes still go to the log in
development, and elsewhere there is no email sign-in.
The mail is plain text, in English or German: the code first and in the
subject, so it shows in the notification and the system can offer it,
the instance it signs in to, its 15 minutes, and that it can be ignored;
no links, no tracking, no HTML. A mail that couldn't be sent is a refusal
of its own (mailFailed): nothing of the request is kept, and the log
names the error's type only, as the service's answer may name the
address. A fake SMTP server on loopback drives the real mailer in the
tests: it delivers, and nothing goes to a server without TLS.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
2026-10-15 20:00:52 +02:00
|
|
|
# Mails email sign-in's codes over SMTP (ADR 0010).
|
|
|
|
|
mailer: ^7.2.0
|
2026-10-09 11:09:52 +02:00
|
|
|
serverpod: 4.0.4
|
|
|
|
|
serverpod_auth_idp_server: 4.0.4
|
|
|
|
|
serverpod_offline_sync_server: 0.0.10
|
2026-09-16 19:24:59 +02:00
|
|
|
dev_dependencies:
|
2026-10-09 11:09:52 +02:00
|
|
|
serverpod_test: 4.0.4
|
2026-09-16 19:24:59 +02:00
|
|
|
test: ^1.25.5
|
|
|
|
|
|
|
|
|
|
serverpod:
|
|
|
|
|
# Companion Flutter apps that `serverpod start` can launch (Ctrl+R), keyed
|
|
|
|
|
# by a display alias. The default device is the web server, opening the
|
|
|
|
|
# machine's default browser when ready. All non-reserved properties are
|
|
|
|
|
# forwarded to `flutter run`. For the best IDE debugging experience, use
|
|
|
|
|
# `chrome` or a native target as the device. See the example below:
|
|
|
|
|
#
|
|
|
|
|
# Admin:
|
|
|
|
|
# path: ../apps/admin_flutter
|
|
|
|
|
# displayName: "Admin app"
|
|
|
|
|
# auto_launch: true
|
|
|
|
|
# device: chrome
|
|
|
|
|
# target: lib/main.dart
|
|
|
|
|
# web-hostname: 0.0.0.0
|
|
|
|
|
# web-port: 8090
|
|
|
|
|
# release: true
|
|
|
|
|
# pub: false
|
|
|
|
|
# dart-define:
|
|
|
|
|
# API_URL=https://admin.example.com
|
|
|
|
|
# FLAVOR=production
|
|
|
|
|
flutter_apps:
|
|
|
|
|
halkyon_learn:
|
|
|
|
|
path: ../halkyon_learn_flutter
|
|
|
|
|
displayName: "Halkyon learn app"
|
|
|
|
|
auto_launch: true
|
|
|
|
|
target: lib/driver.dart
|
|
|
|
|
device: linux
|