halkyon/packages/halkyon_base_server/test/integration/support/fixtures.dart

89 lines
2.8 KiB
Dart
Raw Normal View History

import 'package:halkyon_base_server/base.dart';
import 'package:serverpod/serverpod.dart';
import 'package:serverpod_auth_idp_server/core.dart';
import '../test_tools/serverpod_test_tools.dart';
/// The app the tests' host is.
const testAppName = 'Halkyon Test';
/// The id of the app the tests' host serves.
const testApp = 'test';
/// Where the tests' host says its project publishes its source.
const testUpstreamSourceCodeUrl = 'https://code.example.org/halkyon_test';
/// The oldest app build the tests' host works with.
const testMinimumAppBuild = 7;
/// Sets the module up on the pod [sessionBuilder]'s sessions run on, as a
/// host does before its pod starts, with [deletePersonData] as its
/// deletions and [profilePageNote] at the foot of profile pages, and
/// authentication exactly as hosts run it
/// (`auth_config.dart`). Not on `Serverpod.instance`: that is the pod made
/// last, and a test file with several `withServerpod` groups has a pod each.
void useBase(
TestSessionBuilder sessionBuilder, {
List<PersonDataDeletion> deletePersonData = const [],
ProfilePageNote? profilePageNote,
AccountsMode accounts = const HoldsRegister(),
}) {
final pod = sessionBuilder.build().serverpod;
HalkyonBase.configure(
pod,
HalkyonBase(
app: testApp,
appName: testAppName,
upstreamSourceCodeUrl: testUpstreamSourceCodeUrl,
minimumAppBuild: testMinimumAppBuild,
deletePersonData: deletePersonData,
profilePageNote: profilePageNote,
accounts: accounts,
),
);
AuthServices.set(
tokenManagerBuilders: tokenManagerBuilders,
identityProviderBuilders: identityProviderBuilders(pod),
);
feat(auth): a password with TOTP on the register, and resets The register's side of signing in with an address, a password that never leaves the device (SRP-6a) and a code from an authenticator (ADR 0017), with members forwarding every step through AccountRegister: - password.set: salt, Argon2id's costs, SRP's verifier, the public keys and the private keys wrapped twice, all made on the device; with the address a mailed code proves, an anonymous person becomes identified under their ID. It signs in once an authenticator is confirmed. - passwordSignIn.begin and complete: SRP's two steps with a TOTP or recovery code. An address nobody has is answered from a decoy key as an account would be; every wrong credential is refused alike. - authenticator: secrets sealed under totpKey (XChaCha20-Poly1305, bound to their row), each code accepted once, ten recovery codes with the first, the last one kept. - accountRecovery: a lost authenticator reset 72 hours after the password and a mailed code or the recovery phrase ask, a lost password set anew with the phrase's signature, or the account reset with new keys 72 hours after a mailed code asks; a mail at each start, a sign-in calling it off. - An account with a password no longer signs in by a mailed code or GitHub; no new GitHub account is linked where passwords are offered, and from GITHUB_SIGN_IN_ENDS GitHub signs nobody in and its IDs go. Five tables, added by the module's migration; deletePerson deletes their rows. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
2026-10-20 13:32:12 +02:00
// No password sign-in unless a test gives it keys, whatever the test
// run's passwords hold.
usePasswordKeys(pod, null);
}
/// Signs [person] in on a new device and returns the new session's id.
Future<UuidValue> signInNewDevice(
Session session,
UuidValue person, {
Set<Scope> scopes = const {},
String method = 'test',
}) async {
Future<Set<UuidValue>> sessionIds() async => {
for (final serverSideSession in await ServerSideSession.db.find(
session,
where: (t) => t.authUserId.equals(person),
))
serverSideSession.id!,
};
final before = await sessionIds();
await AuthServices.instance.tokenManager.createToken(
session,
authUserId: person,
method: method,
scopes: scopes,
);
return (await sessionIds()).difference(before).single;
}
/// A person as an app's first launch creates them: anonymous.
Future<UuidValue> newAnonymousPerson(
Session session, {
DateTime? createdAt,
}) async {
final person = (await AuthServices.instance.authUsers.create(session)).id;
await AnonymousAccount.db.insertRow(
session,
AnonymousAccount(authUserId: person, createdAt: createdAt),
);
return person;
}