halkyon/packages/halkyon_base_server/test/integration/instance/instance_test.dart

112 lines
3.1 KiB
Dart
Raw Normal View History

import 'package:halkyon_base_server/base.dart';
import 'package:serverpod/serverpod.dart';
import 'package:test/test.dart';
import '../support/fixtures.dart';
import '../test_tools/serverpod_test_tools.dart';
/// Keeps nothing; there to say the instance can mail codes.
final class _NoMail implements CodeMailer {
@override
Future<void> send(
Session session, {
required String to,
required String code,
required EmailCodePurpose purpose,
required String language,
}) async {}
feat(auth): a password with TOTP on the register, and resets The register's side of signing in with an address, a password that never leaves the device (SRP-6a) and a code from an authenticator (ADR 0017), with members forwarding every step through AccountRegister: - password.set: salt, Argon2id's costs, SRP's verifier, the public keys and the private keys wrapped twice, all made on the device; with the address a mailed code proves, an anonymous person becomes identified under their ID. It signs in once an authenticator is confirmed. - passwordSignIn.begin and complete: SRP's two steps with a TOTP or recovery code. An address nobody has is answered from a decoy key as an account would be; every wrong credential is refused alike. - authenticator: secrets sealed under totpKey (XChaCha20-Poly1305, bound to their row), each code accepted once, ten recovery codes with the first, the last one kept. - accountRecovery: a lost authenticator reset 72 hours after the password and a mailed code or the recovery phrase ask, a lost password set anew with the phrase's signature, or the account reset with new keys 72 hours after a mailed code asks; a mail at each start, a sign-in calling it off. - An account with a password no longer signs in by a mailed code or GitHub; no new GitHub account is linked where passwords are offered, and from GITHUB_SIGN_IN_ENDS GitHub signs nobody in and its IDs go. Five tables, added by the module's migration; deletePerson deletes their rows. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
2026-10-20 13:32:12 +02:00
@override
Future<void> sendResetNotice(
Session session, {
required String to,
required AccountResetKind kind,
required DateTime takesEffectAt,
required String language,
}) async {}
fix(auth): codes wait after ten wrong in a row, and the owner is told Whoever knew the password could guess codes at 10 an hour forever, unnoticed, each guess checked against every authenticator (the second reading's M4). Every code an account's second factor refuses after a right password (sign-in, a phrase's reset, a change) or from a signed-in device (removing an authenticator, new recovery codes, the code from one confirmed before) now counts, per account, from every network; after every tenth in a row no code is taken (codesWait, saying until when), an hour, then twice as long each time, a day at the most (longestCodeWait, second_factor_waits.dart): at a day, ten guesses a day still have about a 1 % chance a year against one authenticator, so the first wait mails the owner that someone knows their password. The instance keeps no address, so sign-in and the phrase's reset now send the address the device typed (and its language), used only for that mail after its hash is checked against the account's. A code accepted clears it all. Migration (module, Learn's and Todo's servers, Learn's device schema): CREATE TABLE "second_factor_failures" ("id" bigserial PRIMARY KEY, "authUserId" uuid NOT NULL, "failures" bigint NOT NULL, "waits" bigint NOT NULL, "waitUntil" timestamp, "updatedAt" timestamp NOT NULL) with a unique index on "authUserId": a new table, nothing touched. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
2026-10-20 21:47:38 +02:00
@override
Future<void> sendCodesWaitNotice(
Session session, {
required String to,
required DateTime until,
required String language,
}) async {}
feat(base,app,learn): invitations to shared spaces by mail and by link The instance's half of Halkyon's ADR 0044, step 5 (D37 to D40). An invitation by mail (sharedSpace.inviteByEmail) goes out through the register (send-space-invitation), naming who invites by their handle and nothing of what is shared, with a link to /join/<token>. The instance keeps only the address's keyed hash, as for sign-in, and the SHA-256 of the token. Whoever opens it joins with a code mailed to that address (EmailCodePurpose.joinSpace, proven through the register, prove-address-code), so a forwarded mail admits nobody else; a code proving another address is refused. It lapses after 14 days, and the hourly pruning forgets it; inviting the address again replaces it. A space's own link (setJoinLink, the Owner's) admits whoever opens it as a Viewer (joinByLink) while it is on; switched off and on, it gets a new token. Its token is kept as it is, so that whoever may invite copies the link again (joinLink). The page at /join/<token>, in English and German, says who invites and as whom; preview tells the app the same. A membership someone else made is new to its member until they mark it seen (isNew, addedBy; mine names who shared it), for the Inbox. halkyon_app learns the two new refusals (handleNeeded, otherAddress), which Learn reports as not allowed until its screens offer these ways in. The ADR records D37 to D40 and how the instance's half is built. The migration, the same in the module and in each server including it (Learn, Meditate, Todo, Train): ALTER TABLE "shared_space" ADD COLUMN "joinToken" text; CREATE UNIQUE INDEX "shared_space_join_token_idx" ON "shared_space" ("joinToken"); CREATE TABLE "shared_space_email_invitation" (…), with its unique indexes on the space and address hash, and on the token's hash, and its foreign key to "shared_space" ON DELETE CASCADE; ALTER TABLE "shared_space_member" ADD COLUMN "addedBy" uuid; ALTER TABLE "shared_space_member" ADD COLUMN "isNew" boolean NOT NULL DEFAULT false; Every space gets no token, and the unique index allows any number of nulls; every membership gets no one who added it and isn't new, so nothing already shared shows in an Inbox. The new table starts empty. None of it rewrites a table, and the server before the switch names its own columns, so it keeps working. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
2026-11-11 18:28:13 +01:00
@override
Future<void> sendInvitation(
Session session, {
required String to,
required String inviter,
required String app,
required Uri link,
required DateTime lapsesAt,
required String language,
}) async {}
}
void main() {
withServerpod('What every instance tells its apps', (
sessionBuilder,
endpoints,
) {
late InstanceBasics basics;
setUp(() async {
useBase(sessionBuilder);
basics = await endpoints.instance.basics(
sessionBuilder.copyWith(
authentication: AuthenticationOverride.unauthenticated(),
),
);
});
test('names the app it serves, so an app recognises its own instances', () {
expect(basics.app, testApp);
});
test("names where the host's project publishes its source when the "
'operator set nothing', () {
// The tests run without SOURCE_URL.
expect(basics.sourceCodeUrl, testUpstreamSourceCodeUrl);
});
test('names the oldest app build the host works with, to anyone, so an '
'older app can say it needs an update', () {
expect(basics.minimumAppBuild, testMinimumAppBuild);
});
test('says nothing of where its data and backups are where the '
'operator said nothing', () {
// The tests run without DATA_LOCATION and BACKUP_LOCATION.
expect(basics.dataLocation, isNull);
expect(basics.backupLocation, isNull);
});
feat(base,app)!: GitHub signs nobody in any more (ADR 0020, D36) Every account signs in with SimpleLogin or a password now, so GitHub goes from the module, the shared app package, Learn and Todo, ahead of ADR 0017's GITHUB_SIGN_IN_ENDS. - halkyon_base: no `gitHubSignIn` endpoint, GitHub identity provider or GitHub refusals; no `githubClientId`/`githubClientSecret`, no `GITHUB_SIGN_IN_ENDS` and no `forgetGitHubAccounts`; the register loses `account-with-github`. `SignInWays.gitHub`, the basics' `gitHubClientId` and `gitHubSignInEnds`, and `PasswordRefusal`'s `signInAgain` and `noAddress` go. A first password takes a code mailed to the person's own address; an account without one sets none (`wrongCredentials`). - Learn's server: `instance.info()` without `gitHubClientId`, the pruning without GitHub, and `minimumAppBuild` 24, as builds up to 23 (v0.20.0) require `SignInWays.gitHub`: the server deploys with the release of build 24. - halkyon_app: no GitHub button or problems on the start screen, no password offered after a GitHub sign-in, and `ServerpodAuthGateway` without the browser half only GitHub used (`(client, base:)`). The account section offers a first password only to an account with an address. `LoopbackWebAuth` and the apps' schemes stay, SimpleLogin's ways back. - Learn's Profile lists no GitHub; the texts go (English, German). - Serverpod's `serverpod_auth_idp_github_account` stays, as its migrations make it; a row goes with its account, and ADR 0020's D36 gives operators the SQL to delete those left. - deploy/: compose.yaml and .env.example without GitHub. The READMEs, AGENTS.md files and ADR 0017 amended. BREAKING CHANGE: builds up to 23 can't read the instance's answers about an account's ways in; minimumAppBuild is 24. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
2026-10-25 12:52:52 +01:00
test('serves no GitHub sign-in: GitHub signs nobody in any more (ADR '
'0020, D36)', () {
final pod = sessionBuilder.build().serverpod;
feat(base,app)!: GitHub signs nobody in any more (ADR 0020, D36) Every account signs in with SimpleLogin or a password now, so GitHub goes from the module, the shared app package, Learn and Todo, ahead of ADR 0017's GITHUB_SIGN_IN_ENDS. - halkyon_base: no `gitHubSignIn` endpoint, GitHub identity provider or GitHub refusals; no `githubClientId`/`githubClientSecret`, no `GITHUB_SIGN_IN_ENDS` and no `forgetGitHubAccounts`; the register loses `account-with-github`. `SignInWays.gitHub`, the basics' `gitHubClientId` and `gitHubSignInEnds`, and `PasswordRefusal`'s `signInAgain` and `noAddress` go. A first password takes a code mailed to the person's own address; an account without one sets none (`wrongCredentials`). - Learn's server: `instance.info()` without `gitHubClientId`, the pruning without GitHub, and `minimumAppBuild` 24, as builds up to 23 (v0.20.0) require `SignInWays.gitHub`: the server deploys with the release of build 24. - halkyon_app: no GitHub button or problems on the start screen, no password offered after a GitHub sign-in, and `ServerpodAuthGateway` without the browser half only GitHub used (`(client, base:)`). The account section offers a first password only to an account with an address. `LoopbackWebAuth` and the apps' schemes stay, SimpleLogin's ways back. - Learn's Profile lists no GitHub; the texts go (English, German). - Serverpod's `serverpod_auth_idp_github_account` stays, as its migrations make it; a row goes with its account, and ADR 0020's D36 gives operators the SQL to delete those left. - deploy/: compose.yaml and .env.example without GitHub. The READMEs, AGENTS.md files and ADR 0017 amended. BREAKING CHANGE: builds up to 23 can't read the instance's answers about an account's ways in; minimumAppBuild is 24. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
2026-10-25 12:52:52 +01:00
expect(pod.server.endpoints.getConnectorByName('gitHubSignIn'), isNull);
});
test('offers email sign-in only where it can mail codes', () async {
final codes = EmailCodes.of(sessionBuilder.build().serverpod);
final unauthenticated = sessionBuilder.copyWith(
authentication: AuthenticationOverride.unauthenticated(),
);
addTearDown(() => codes.mailer = null);
codes.mailer = null;
expect(
(await endpoints.instance.basics(unauthenticated)).emailSignIn,
isFalse,
);
codes.mailer = _NoMail();
expect(
(await endpoints.instance.basics(unauthenticated)).emailSignIn,
isTrue,
);
});
});
}