halkyon/packages/halkyon_base_server/test/integration/register/member_test.dart

import 'dart:convert';
import 'dart:typed_data';

import 'package:clock/clock.dart';
import 'package:halkyon_base_server/base.dart';
import 'package:halkyon_base_server/src/register/deletion_notices.dart';
import 'package:halkyon_base_server/src/register/instance_api.dart';
import 'package:halkyon_base_server/src/register/people.dart' show maxClockSkew;
import 'package:halkyon_base_server/src/register/register_protocol.dart';
import 'package:halkyon_base_server/src/register/remote_register.dart';
import 'package:serverpod/serverpod.dart';
import 'package:serverpod_auth_idp_server/core.dart';
import 'package:test/test.dart';

import '../support/fixtures.dart';
import '../support/password_device.dart';
import '../test_tools/serverpod_test_tools.dart';

const _secret = 'a shared secret only the instance knows';
final _learn = Uri.parse('http://learn.test:8082');

/// The instance's register, in memory: what a member asks it, and what it
/// answers.
final class _Register implements AccountRegister {
  final accounts = <UuidValue>{};
  final addresses = <String, UuidValue>{};
  final gitHub = <String, UuidValue>{};
  final profiles = <UuidValue, Profile>{};
  final codes = <UuidValue, ({String address, String code})>{};

  /// The calls asked, by name, in their order.
  final asked = <String>[];
  final networks = <String>[];
  final deleted = <UuidValue>[];

  /// What [knownAccounts] was asked about, call by call.
  final askedAbout = <Set<UuidValue>>[];
  bool offered = true;

  /// Whether it offers password sign-in.
  bool passwordOffered = true;

  /// The accounts with a password, and those with an authenticator too.
  final passwords = <UuidValue>{};
  final authenticated = <UuidValue>{};

  /// The people a password was set for with a GitHub sign-in of the
  /// member's made just now.
  final freshGitHubSignIns = <UuidValue>{};

  /// What a password sign-in proves; null refuses it.
  PasswordProof? proof;

  /// Thrown by every call while set: the register refusing, or down.
  Exception? failing;

  /// The hosts sign-ins were bound to, as members named them.
  final hosts = <String>[];

  Future<T> _answer<T>(String call, T Function() answer) async {
    asked.add(call);
    if (failing case final error?) {
      throw error;
    }
    return answer();
  }

  /// [person] as an account with the address [address].
  void add(UuidValue person, {String? address}) {
    accounts.add(person);
    if (address != null) {
      addresses[address] = person;
    }
  }

  @override
  Future<Profile?> profileOf(Session session, UuidValue person) =>
      _answer('profileOf', () => profiles[person]);

  @override
  Future<Map<UuidValue, Profile>> profilesOf(
    Session session,
    Set<UuidValue> people,
  ) => _answer(
    'profilesOf',
    () => {
      for (final person in people) person: ?profiles[person],
    },
  );

  @override
  Future<Profile?> profileByHandle(Session session, String handle) => _answer(
    'profileByHandle',
    () => profiles.values
        .where((profile) => profile.handle.toLowerCase() == handle)
        .firstOrNull,
  );

  @override
  Future<UuidValue?> personWithHandle(Session session, String handle) =>
      _answer(
        'personWithHandle',
        () => profiles.entries
            .where((entry) => entry.value.handle.toLowerCase() == handle)
            .firstOrNull
            ?.key,
      );

  @override
  Future<Profile> saveProfile(
    Session session,
    UuidValue person, {
    required String handle,
    required String displayName,
    required String bio,
    required List<String> links,
  }) => _answer(
    'saveProfile',
    () => profiles[person] = Profile(
      handle: handle,
      address: '$handle@learn.test',
      displayName: displayName,
      bio: bio,
      links: links,
      pageUrl: 'https://learn.test/@$handle',
      handleFixed: false,
    ),
  );

  @override
  Future<ProfileRefusal?> checkHandle(
    Session session,
    UuidValue person,
    String handle,
  ) => _answer('checkHandle', () => null);

  @override
  Future<Profile> checkLinks(Session session, UuidValue person) =>
      _answer('checkLinks', () => profiles[person]!);

  @override
  Future<Profile> setAvatar(Session session, UuidValue person, ByteData png) =>
      _answer('setAvatar', () => profiles[person]!);

  @override
  Future<Profile> removeAvatar(Session session, UuidValue person) =>
      _answer('removeAvatar', () => profiles[person]!);

  @override
  Future<void> removeProfile(Session session, UuidValue person) =>
      _answer('removeProfile', () => profiles.remove(person));

  @override
  Future<void> fixHandle(Session session, UuidValue person) =>
      _answer('fixHandle', () {});

  @override
  Future<bool> emailSignInOffered(Session session) =>
      _answer('emailSignInOffered', () => offered);

  @override
  Future<UuidValue> sendSignInCode(
    Session session, {
    required String address,
    required String language,
    required EmailCodePurpose purpose,
    required String network,
  }) => _answer('sendSignInCode', () {
    networks.add(network);
    final request = const Uuid().v7obj();
    codes[request] = (address: address, code: 'K7QX-M2PD');
    return request;
  });

  @override
  Future<void> linkGitHub(
    Session session, {
    required UuidValue person,
    required String gitHubUserId,
  }) => _answer('linkGitHub', () {
    accounts.add(person);
    gitHub[gitHubUserId] = person;
  });

  @override
  Future<UuidValue?> accountWithGitHub(Session session, String gitHubUserId) =>
      _answer('accountWithGitHub', () => gitHub[gitHubUserId]);

  @override
  Future<SignInWays> signInWaysOf(Session session, UuidValue person) => _answer(
    'signInWaysOf',
    () => SignInWays(
      gitHub: gitHub.containsValue(person),
      email: addresses.containsValue(person),
      password: passwords.contains(person),
      authenticator: authenticated.contains(person),
      passwordOnly:
          passwords.contains(person) && authenticated.contains(person),
    ),
  );

  @override
  Future<bool> passwordSignInOffered(Session session) =>
      _answer('passwordSignInOffered', () => passwordOffered);

  @override
  Future<void> setPassword(
    Session session, {
    required UuidValue person,
    required PasswordSetup setup,
    UuidValue? request,
    String? code,
    bool freshGitHubSignIn = false,
  }) => _answer('setPassword', () {
    add(person);
    passwords.add(person);
    if (freshGitHubSignIn) {
      freshGitHubSignIns.add(person);
    }
  });

  @override
  Future<PasswordChallenge> beginPasswordSignIn(
    Session session, {
    required String address,
    required String network,
  }) => _answer('beginPasswordSignIn', () {
    networks.add(network);
    return PasswordChallenge(
      challenge: const Uuid().v7obj(),
      salt: ByteData(16),
      costs: newPasswordCosts,
      serverValue: ByteData(384),
    );
  });

  PasswordProof _proven() =>
      proof ??
      (throw PasswordRefusedException(
        reason: PasswordRefusal.wrongCredentials,
      ));

  @override
  Future<PasswordProof> completePasswordSignIn(
    Session session, {
    required UuidValue challenge,
    required ByteData clientValue,
    required ByteData clientProof,
    String? totpCode,
    String? recoveryCode,
    UuidValue? request,
    String? code,
    required String host,
    String? address,
    String? language,
  }) {
    hosts.add(host);
    return _answer('completePasswordSignIn', _proven);
  }

  @override
  Future<UuidValue> signUpWithCode(
    Session session, {
    required UuidValue request,
    required String code,
    required PasswordSetup setup,
  }) => _answer('signUpWithCode', () {
    final account = const Uuid().v7obj();
    add(account);
    passwords.add(account);
    return account;
  });

  @override
  Future<AuthenticatorEnrolment> enrolAuthenticator(
    Session session, {
    required UuidValue person,
    required String name,
    required String label,
  }) => _answer(
    'enrolAuthenticator',
    () => AuthenticatorEnrolment(
      authenticator: const Uuid().v7obj(),
      uri: 'otpauth://totp/learn.test:$label',
    ),
  );

  @override
  Future<List<String>> confirmAuthenticator(
    Session session, {
    required UuidValue person,
    required UuidValue authenticator,
    required String code,
    OwnerProof? proof,
  }) => _answer('confirmAuthenticator', () {
    authenticated.add(person);
    return const ['K7QX-M2PD'];
  });

  @override
  Future<List<Authenticator>> authenticatorsOf(
    Session session,
    UuidValue person,
  ) => _answer('authenticatorsOf', () => const <Authenticator>[]);

  @override
  Future<void> removeAuthenticator(
    Session session, {
    required UuidValue person,
    required UuidValue authenticator,
    OwnerProof? proof,
  }) => _answer('removeAuthenticator', () {});

  @override
  Future<List<String>> newRecoveryCodes(
    Session session, {
    required UuidValue person,
    required OwnerProof proof,
  }) => _answer('newRecoveryCodes', () => const ['K7QX-M2PD']);

  @override
  Future<ResetPending> resetAuthenticator(
    Session session, {
    required UuidValue challenge,
    required ByteData clientValue,
    required ByteData clientProof,
    required String address,
    required String language,
    UuidValue? request,
    String? code,
    UuidValue? keyChallenge,
    ByteData? signature,
    required String host,
  }) => _answer(
    'resetAuthenticator',
    () => ResetPending(takesEffectAt: DateTime.utc(2026, 10, 23)),
  );

  @override
  Future<KeyProofChallenge> beginKeyProof(
    Session session, {
    required String address,
    required String network,
  }) => _answer('beginKeyProof', () {
    networks.add(network);
    return KeyProofChallenge(
      challenge: const Uuid().v7obj(),
      nonce: ByteData(32),
      encryptionPublicKey: ByteData(32),
      signingPublicKey: ByteData(32),
      recoveryKeys: WrappedKeys(nonce: ByteData(24), cipherText: ByteData(112)),
    );
  });

  /// The moment a reset ended the account's sessions at the register.
  DateTime endedBefore = DateTime.utc(2026, 10, 20, 12);

  @override
  Future<AccountSessionsEnded> resetPasswordWithPhrase(
    Session session, {
    required UuidValue challenge,
    required ByteData signature,
    required NewPassword password,
    String? totpCode,
    String? recoveryCode,
    required String host,
    String? address,
    String? language,
  }) => _answer(
    'resetPasswordWithPhrase',
    () => (account: _proven().account, endedBefore: endedBefore),
  );

  @override
  Future<ResetPending> startAccountReset(
    Session session, {
    required String address,
    required String language,
    required UuidValue request,
    required String code,
  }) => _answer(
    'startAccountReset',
    () => ResetPending(takesEffectAt: DateTime.utc(2026, 10, 23)),
  );

  @override
  Future<AccountSessionsEnded> completeAccountReset(
    Session session, {
    required String address,
    required UuidValue request,
    required String code,
    required PasswordSetup setup,
  }) => _answer(
    'completeAccountReset',
    () => (account: _proven().account, endedBefore: endedBefore),
  );

  /// The sessions kept by the password changes asked, by person.
  final changed = <UuidValue, UuidValue?>{};

  @override
  Future<PasswordChallenge> beginPasswordChange(
    Session session, {
    required UuidValue person,
  }) => _answer(
    'beginPasswordChange',
    () => PasswordChallenge(
      challenge: const Uuid().v7obj(),
      salt: ByteData(16),
      costs: newPasswordCosts,
      serverValue: ByteData(384),
    ),
  );

  @override
  Future<void> changePassword(
    Session session, {
    required UuidValue person,
    required OwnerProof proof,
    required NewPassword password,
    UuidValue? keepSession,
  }) => _answer('changePassword', () {
    changed[person] = keepSession;
    changedWith.add(proof);
  });

  @override
  Future<void> setRecoveryKeys(
    Session session, {
    required UuidValue person,
    required OwnerProof proof,
    required WrappedKeys recoveryKeys,
    required ByteData recoveryProofKey,
  }) => _answer('setRecoveryKeys', () {});

  @override
  Future<void> deleteAccount(
    Session session,
    UuidValue person, {
    DeletionProof? proof,
  }) => _answer('deleteAccount', () {
    deleted.add(person);
    deletedWith.add(proof);
    accounts.remove(person);
  });

  /// The proofs deletions came with, as the member bound them.
  final deletedWith = <DeletionProof?>[];
  final changedWith = <OwnerProof>[];

  @override
  Future<Set<UuidValue>> knownAccounts(
    Session session,
    Set<UuidValue> people,
  ) => _answer('knownAccounts', () {
    askedAbout.add(people);
    return people.intersection(accounts);
  });
}

void main() {
  withServerpod(
    'A member of an instance',
    // Sessions issued and revoked, and deletions in transactions of their
    // own: these tests delete what they make instead.
    rollbackDatabase: RollbackDatabase.disabled,
    (sessionBuilder, endpoints) {
      late Session session;
      late Serverpod pod;
      late _Register register;

      /// Anonymous here, signed in on her phone.
      late UuidValue anna;
      late UuidValue annasPhone;

      /// An account of the register, identified here, signed in on his
      /// laptop.
      late UuidValue ben;
      late UuidValue bensLaptop;

      /// Whose data the host deleted.
      late List<UuidValue> hostDeleted;

      setUp(() async {
        hostDeleted = [];
        useBase(
          sessionBuilder,
          accounts: MemberOfRegister(_learn),
          deletePersonData: [
            (session, person, transaction) async {
              hostDeleted.add(person);
              return null;
            },
          ],
        );
        session = sessionBuilder.build();
        pod = session.serverpod;
        await _deleteAll(session);
        useInstanceSecret(pod, _secret);
        register = _Register();
        AccountRegister.use(pod, register);
        anna = await newAnonymousPerson(session);
        annasPhone = await signInNewDevice(session, anna);
        ben = (await AuthServices.instance.authUsers.create(
          session,
          scopes: {identified},
        )).id;
        register.add(ben, address: 'ben@example.org');
        bensLaptop = await signInNewDevice(session, ben, scopes: {identified});
      });
      tearDown(() async {
        AccountRegister.use(pod, null);
        useInstanceSecret(pod, null);
        await _deleteAll(sessionBuilder.build());
      });

      TestSessionBuilder asAnna() => sessionBuilder.copyWith(
        authentication: AuthenticationOverride.authenticationInfo(
          anna.uuid,
          {},
          authId: annasPhone.uuid,
        ),
      );
      TestSessionBuilder asBen() => sessionBuilder.copyWith(
        authentication: AuthenticationOverride.authenticationInfo(
          ben.uuid,
          {identified},
          authId: bensLaptop.uuid,
        ),
      );
      TestSessionBuilder notSignedIn() => sessionBuilder.copyWith(
        authentication: AuthenticationOverride.unauthenticated(),
      );

      Future<Set<String>> scopesOf(UuidValue person) async =>
          (await AuthUser.db.findById(session, person))!.scopeNames;

      group('signs in by asking the register', () {
        test('which mails the code, its device network passed on', () async {
          await endpoints.emailCode.sendCode(
            asAnna(),
            address: 'anna@example.org',
            language: 'de',
            purpose: EmailCodePurpose.signUp,
          );

          expect(register.asked, ['sendSignInCode']);
          expect(register.codes.values.single.address, 'anna@example.org');
          expect(register.networks, hasLength(1));
        });

        test('and refuses as the register refuses', () async {
          register.failing = EmailSignInRefusedException(
            reason: EmailSignInRefusal.tooManyCodes,
          );

          await expectLater(
            endpoints.emailCode.sendCode(
              asAnna(),
              address: 'anna@example.org',
              language: 'de',
              purpose: EmailCodePurpose.signUp,
            ),
            throwsA(
              isA<EmailSignInRefusedException>().having(
                (error) => error.reason,
                'reason',
                EmailSignInRefusal.tooManyCodes,
              ),
            ),
          );
        });

        test('an account signing in again is the same person here', () async {
          await issueSession(session, ben, method: 'test');
          await issueSession(session, ben, method: 'test');

          expect(
            await AuthUser.db.count(session, where: (t) => t.id.equals(ben)),
            1,
          );
          expect(
            await ServerSideSession.db.count(
              session,
              where: (t) => t.authUserId.equals(ben),
            ),
            3,
          );
        });

        test('an account the register proved is identified here even where '
            'linking its way in was cut off', () async {
          final success = await issueSession(session, anna, method: 'test');

          expect(success.authUserId, anna);
          expect(await scopesOf(anna), contains(identified.name));
          expect(
            (await ServerSideSession.db.findById(
              session,
              annasPhone,
            ))!.scopeNames,
            contains(identified.name),
          );
        });

        test('email sign-in is offered as the register offers it', () async {
          expect(
            (await endpoints.instance.basics(notSignedIn())).emailSignIn,
            isTrue,
          );
          register.offered = false;
          expect(
            (await endpoints.instance.basics(notSignedIn())).emailSignIn,
            isFalse,
          );
        });

        test('the basics still answer while the register is out of reach, '
            'without email sign-in', () async {
          register.failing = RegisterUnavailableException('test');

          final basics = await endpoints.instance.basics(notSignedIn());

          expect(basics.emailSignIn, isFalse);
          expect(basics.app, testApp);
        });

        test('the ways in are those the register knows', () async {
          register.gitHub['1001'] = ben;

          final ways = await endpoints.account.signInWays(asBen());

          expect(ways.toJson(), SignInWays(gitHub: true, email: true).toJson());
        });
      });

      group('passwords, by asking the register (ADR 0017)', () {
        test('sign the account the register proved in here, made a person '
            'here the first time, the device network passed on', () async {
          final carla = const Uuid().v7obj();
          register.proof = PasswordProof(
            account: carla,
            serverProof: ByteData(32),
            encryptionPublicKey: ByteData(32),
            signingPublicKey: ByteData(32),
            passwordKeys: WrappedKeys(
              nonce: ByteData(24),
              cipherText: ByteData(112),
            ),
            needsAuthenticator: false,
          );

          final challenge = await endpoints.passwordSignIn.begin(
            notSignedIn(),
            address: 'carla@example.org',
          );
          final signedIn = await endpoints.passwordSignIn.complete(
            notSignedIn(),
            challenge: challenge.challenge,
            clientValue: ByteData(384),
            clientProof: ByteData(32),
            totpCode: '123456',
            host: testHost,
            address: 'anna@example.org',
            language: 'en',
          );

          expect(register.asked, [
            'beginPasswordSignIn',
            'completePasswordSignIn',
          ]);
          expect(register.networks, hasLength(1));
          // Bound to the host the device addressed: this member's.
          expect(register.hosts, [testHost]);
          expect(signedIn.authUserId, carla);
          expect(await scopesOf(carla), {identified.name});
          expect(
            (await ServerSideSession.db.find(
              session,
              where: (t) => t.authUserId.equals(carla),
            )).single.method,
            passwordMethod,
          );
        });

        test('sign up at the register, the new account signed in here, '
            'identified', () async {
          final device = await PasswordDevice.make();

          final signedUp = await endpoints.passwordSignIn.signUp(
            notSignedIn(),
            request: const Uuid().v7obj(),
            code: 'K7QX-M2PD',
            setup: device.setup(),
          );

          expect(register.asked, ['signUpWithCode']);
          expect(register.passwords, {signedUp.authUserId});
          expect(await scopesOf(signedUp.authUserId), {identified.name});
          expect(
            (await ServerSideSession.db.find(
              session,
              where: (t) => t.authUserId.equals(signedUp.authUserId),
            )).single.method,
            passwordMethod,
          );
        });

        test('refuse as the register refuses, signing nobody in', () async {
          final people = await AuthUser.db.count(session);

          await expectLater(
            endpoints.passwordSignIn.complete(
              notSignedIn(),
              challenge: const Uuid().v7obj(),
              clientValue: ByteData(384),
              clientProof: ByteData(32),
              host: testHost,
              address: 'anna@example.org',
              language: 'en',
            ),
            throwsA(
              isA<PasswordRefusedException>().having(
                (error) => error.reason,
                'reason',
                PasswordRefusal.wrongCredentials,
              ),
            ),
          );
          expect(await AuthUser.db.count(session), people);
        });

        test('set one at the register, the person becoming identified '
            'here', () async {
          final device = await PasswordDevice.make();

          await endpoints.password.set(
            asAnna(),
            setup: device.setup(),
            request: const Uuid().v7obj(),
            code: 'K7QX-M2PD',
          );

          expect(register.passwords, {anna});
          expect(register.freshGitHubSignIns, isEmpty);
          expect(await scopesOf(anna), contains(identified.name));
          expect(
            await AnonymousAccount.db.count(
              session,
              where: (t) => t.authUserId.equals(anna),
            ),
            0,
          );
        });

        test(
          'tell the register whether the session asking was made by a '
          'GitHub sign-in of the last ten minutes (the fourth reading)',
          () async {
            final device = await PasswordDevice.make();
            Future<void> setFrom(UuidValue device_) => endpoints.password.set(
              sessionBuilder.copyWith(
                authentication: AuthenticationOverride.authenticationInfo(
                  anna.uuid,
                  {},
                  authId: device_.uuid,
                ),
              ),
              setup: device.setup(),
              request: const Uuid().v7obj(),
              code: 'K7QX-M2PD',
            );
            final old = await withClock(
              Clock.fixed(DateTime.now().subtract(const Duration(minutes: 11))),
              () => signInNewDevice(session, anna, method: gitHubMethod),
            );
            await setFrom(old);
            expect(register.freshGitHubSignIns, isEmpty);
            await setFrom(annasPhone);
            expect(register.freshGitHubSignIns, isEmpty);
            await setFrom(
              await signInNewDevice(session, anna, method: gitHubMethod),
            );
            expect(register.freshGitHubSignIns, {anna});
          },
        );

        test('are offered as the register offers them, and not while it is '
            'out of reach', () async {
          expect(
            (await endpoints.instance.basics(notSignedIn())).passwordSignIn,
            isTrue,
          );
          register.passwordOffered = false;
          expect(
            (await endpoints.instance.basics(notSignedIn())).passwordSignIn,
            isFalse,
          );
          register
            ..passwordOffered = true
            ..failing = RegisterUnavailableException('test');
          expect(
            (await endpoints.instance.basics(notSignedIn())).passwordSignIn,
            isFalse,
          );
        });

        test('keep GitHub from signing into an account that has one, as '
            'the register knows it', () async {
          register.gitHub['1001'] = ben;
          expect(await gitHubAccountToSignIn(session, '1001'), ben);

          register
            ..passwords.add(ben)
            ..authenticated.add(ben);

          await expectLater(
            gitHubAccountToSignIn(session, '1001'),
            throwsA(
              isA<GitHubSignInRefusedException>().having(
                (error) => error.reason,
                'reason',
                GitHubSignInRefusal.usePassword,
              ),
            ),
          );
        });
      });

      group('profiles', () {
        test('are saved and found at the register', () async {
          final saved = await endpoints.profile.save(
            asBen(),
            'Ben',
            'Ben',
            '',
            const [],
          );

          expect(register.profiles[ben]!.toJson(), saved.toJson());
          expect(
            (await endpoints.profiles.byHandle(asAnna(), 'ben')).toJson(),
            saved.toJson(),
          );
          expect((await profileOf(session, ben))!.toJson(), saved.toJson());
          expect(await PublicProfile.db.count(session), 0);
        });

        test("have their page at the register's address, where this "
            "server's sends its visitors", () async {
          await endpoints.profile.save(asBen(), 'Ben', 'Ben', '', const []);

          final page = await profilePage(
            session,
            '@ben',
            host: 'todo.test',
          );

          expect(page.status, 308);
          expect(page.location, 'https://learn.test/@Ben');
        });
      });

      group('deleting the account', () {
        test('of an identified person deletes it at the register, which '
            'tells every member, and here at once', () async {
          await endpoints.account.delete(asBen());

          expect(register.deleted, [ben]);
          expect(await AuthUser.db.findById(session, ben), isNull);
          expect(
            await ServerSideSession.db.count(
              session,
              where: (t) => t.authUserId.equals(ben),
            ),
            0,
          );
          expect(hostDeleted, [ben]);
          expect(await AuthUser.db.findById(session, anna), isNotNull);
        });

        test("passes the password's proof on to the register, bound to "
            'the host the device addressed here', () async {
          await endpoints.account.delete(
            asBen(),
            proof: DeletionProof(
              challenge: const Uuid().v7obj(),
              clientValue: ByteData(384),
              clientProof: ByteData(32),
              totpCode: '123456',
              host: 'LOCALHOST',
            ),
          );

          expect(register.deleted, [ben]);
          expect(register.deletedWith.single?.host, testHost);
          expect(register.deletedWith.single?.totpCode, '123456');
        });

        test('of an anonymous person deletes it here alone', () async {
          await endpoints.account.delete(asAnna());

          expect(register.asked, isEmpty);
          expect(await AuthUser.db.findById(session, anna), isNull);
          expect(hostDeleted, [anna]);
        });

        test('is refused while the register is out of reach, deleting '
            'nothing here', () async {
          register.failing = RegisterUnavailableException('test');

          await expectLater(
            endpoints.account.delete(asBen()),
            throwsA(isA<RegisterUnavailableException>()),
          );
          expect(await AuthUser.db.findById(session, ben), isNotNull);
          expect(
            await ServerSideSession.db.count(
              session,
              where: (t) => t.authUserId.equals(ben),
            ),
            1,
          );
          expect(hostDeleted, isEmpty);
        });
      });

      group('told by the register that an account is gone', () {
        Future<InstanceAnswer> tell(
          Object? account, {
          String? authorization = 'Bearer $_secret',
        }) => answerRegister(
          session,
          jsonEncode({'account': account}),
          authorization: authorization,
        );

        test('deletes that person here with their sessions, and nobody '
            'else', () async {
          final answer = await tell(ben.uuid);

          expect(answer.status, 200);
          expect(await AuthUser.db.findById(session, ben), isNull);
          expect(
            await ServerSideSession.db.count(
              session,
              where: (t) => t.authUserId.equals(ben),
            ),
            0,
          );
          expect(hostDeleted, [ben]);
          expect(await AuthUser.db.findById(session, anna), isNotNull);
          expect(register.asked, isEmpty);
        });

        test('confirms an account it never had', () async {
          expect((await tell(const Uuid().v7())).status, 200);
          expect(hostDeleted, isEmpty);
        });

        test('refuses without the instance secret, or with a wrong one, '
            'deleting nobody', () async {
          for (final authorization in [
            null,
            'Bearer wrong',
            'Basic $_secret',
          ]) {
            expect(
              (await tell(ben.uuid, authorization: authorization)).status,
              401,
            );
          }
          useInstanceSecret(pod, null);
          expect((await tell(ben.uuid)).status, 401);
          expect(await AuthUser.db.findById(session, ben), isNotNull);
          expect(hostDeleted, isEmpty);
        });

        test('refuses what it cannot read', () async {
          for (final account in [null, 7, 'not an id']) {
            expect((await tell(account)).status, 400, reason: '$account');
          }
          expect(
            (await answerRegister(
              session,
              'not JSON',
              authorization: 'Bearer $_secret',
            )).status,
            400,
          );
          expect(await AuthUser.db.findById(session, ben), isNotNull);
        });

        test('is answered by no register', () async {
          useBase(sessionBuilder);

          expect((await tell(ben.uuid)).status, 404);
          expect(await AuthUser.db.findById(session, ben), isNotNull);
        });
      });

      group('told by the register that sessions ended (ADR 0017)', () {
        Future<InstanceAnswer> tell(
          Map<String, Object?> body, {
          String? authorization = 'Bearer $_secret',
        }) => answerSessionsEnded(
          session,
          jsonEncode(body),
          authorization: authorization,
        );

        Future<DateTime> createdAt(UuidValue id) async =>
            (await ServerSideSession.db.findById(session, id))!.createdAt;

        test('ends those of the account made before the moment, but the one '
            'kept and those made since, and nobody else', () async {
          final bensPhone = await signInNewDevice(session, ben);
          final endedBefore = (await createdAt(
            bensPhone,
          )).add(const Duration(microseconds: 1));
          await Future<void>.delayed(const Duration(milliseconds: 5));
          final bensTablet = await signInNewDevice(session, ben);

          final answer = await tell({
            'account': ben.uuid,
            'endedBefore': endedBefore.toIso8601String(),
            'keepSession': bensLaptop.uuid,
          });

          expect(answer.status, 200);
          final left = {
            for (final row in await ServerSideSession.db.find(
              session,
              where: (t) => t.authUserId.equals(ben),
            ))
              row.id!,
          };
          expect(left, {bensLaptop, bensTablet});
          expect(
            await ServerSideSession.db.findById(session, annasPhone),
            isNotNull,
          );
          expect(register.asked, isEmpty);
        });

        test('refuses without the secret and what it cannot read, and is '
            'answered by no register, ending nothing', () async {
          final everything = {
            'account': ben.uuid,
            'endedBefore': DateTime.now().toUtc().toIso8601String(),
          };
          expect((await tell(everything, authorization: null)).status, 401);
          expect(
            (await tell(everything, authorization: 'Bearer wrong')).status,
            401,
          );
          expect(
            (await tell({'account': ben.uuid, 'endedBefore': 'soon'})).status,
            400,
          );
          expect((await tell({'account': ben.uuid})).status, 400);
          useBase(sessionBuilder);
          expect((await tell(everything)).status, 404);
          expect(
            await ServerSideSession.db.findById(session, bensLaptop),
            isNotNull,
          );
        });
      });

      group('changing a password, by asking the register (ADR 0017)', () {
        test('keeps the session asking: its ID goes to the register, which '
            'tells every service', () async {
          final challenge = await endpoints.password.beginChange(asBen());

          await endpoints.password.change(
            asBen(),
            proof: OwnerProof(
              challenge: challenge.challenge,
              clientValue: ByteData(384),
              clientProof: ByteData(32),
              host: 'LOCALHOST',
              totpCode: '123456',
            ),
            password: NewPassword(
              salt: ByteData(16),
              costs: newPasswordCosts,
              verifier: ByteData(384),
              passwordKeys: WrappedKeys(
                nonce: ByteData(24),
                cipherText: ByteData(112),
              ),
            ),
          );

          expect(register.asked, ['beginPasswordChange', 'changePassword']);
          expect(register.changed, {ben: bensLaptop});
          // Bound to the host the device addressed here.
          expect(register.changedWith.single.host, testHost);
          expect(register.changedWith.single.totpCode, '123456');
        });

        test("counts its own session's wrong proofs, which the register "
            'refuses: the tenth in a row ends the session here', () async {
          register.failing = PasswordRefusedException(
            reason: PasswordRefusal.wrongCredentials,
          );
          Future<List<String>> newCodes() =>
              endpoints.authenticator.newRecoveryCodes(
                asBen(),
                proof: OwnerProof(
                  challenge: const Uuid().v7obj(),
                  clientValue: ByteData(384),
                  clientProof: ByteData(32),
                  host: testHost,
                  totpCode: '000000',
                ),
              );
          for (var i = 0; i < 9; i++) {
            await expectLater(
              newCodes(),
              throwsA(
                isA<PasswordRefusedException>().having(
                  (refusal) => refusal.reason,
                  'reason',
                  PasswordRefusal.wrongCredentials,
                ),
              ),
            );
          }
          await expectLater(
            newCodes(),
            throwsA(
              isA<PasswordRefusedException>().having(
                (refusal) => refusal.reason,
                'reason',
                PasswordRefusal.sessionEnded,
              ),
            ),
          );
          expect(
            await ServerSideSession.db.findById(session, bensLaptop),
            isNull,
          );
        });

        test('a reset ends the sessions here made before the register ended '
            'them, the new one made after', () async {
          register
            ..proof = PasswordProof(
              account: ben,
              serverProof: ByteData(32),
              encryptionPublicKey: ByteData(32),
              signingPublicKey: ByteData(32),
              passwordKeys: WrappedKeys(
                nonce: ByteData(24),
                cipherText: ByteData(112),
              ),
              needsAuthenticator: false,
            )
            ..endedBefore = DateTime.now().toUtc();

          final signedIn = await endpoints.accountRecovery.resetPassword(
            notSignedIn(),
            challenge: const Uuid().v7obj(),
            signature: ByteData(64),
            password: NewPassword(
              salt: ByteData(16),
              costs: newPasswordCosts,
              verifier: ByteData(384),
              passwordKeys: WrappedKeys(
                nonce: ByteData(24),
                cipherText: ByteData(112),
              ),
            ),
            totpCode: '123456',
            host: testHost,
            address: 'anna@example.org',
            language: 'en',
          );

          expect(signedIn.authUserId, ben);
          final left = await ServerSideSession.db.find(
            session,
            where: (t) => t.authUserId.equals(ben),
          );
          expect(left.single.id, isNot(bensLaptop));
          expect(
            left.single.createdAt.isBefore(register.endedBefore),
            isFalse,
          );
        });

        test("waits a few seconds at most for the register's moment: a "
            'clock further behind is refused at once, and signs nobody in, '
            'rather than holding the request', () async {
          register
            ..proof = PasswordProof(
              account: ben,
              serverProof: ByteData(32),
              encryptionPublicKey: ByteData(32),
              signingPublicKey: ByteData(32),
              passwordKeys: WrappedKeys(
                nonce: ByteData(24),
                cipherText: ByteData(112),
              ),
              needsAuthenticator: false,
            )
            ..endedBefore = DateTime.now().toUtc().add(
              const Duration(minutes: 1),
            );
          final watch = Stopwatch()..start();

          await expectLater(
            endpoints.accountRecovery.resetPassword(
              notSignedIn(),
              challenge: const Uuid().v7obj(),
              signature: ByteData(64),
              password: NewPassword(
                salt: ByteData(16),
                costs: newPasswordCosts,
                verifier: ByteData(384),
                passwordKeys: WrappedKeys(
                  nonce: ByteData(24),
                  cipherText: ByteData(112),
                ),
              ),
              totpCode: '123456',
              host: testHost,
              address: 'anna@example.org',
              language: 'en',
            ),
            throwsA(
              isA<PasswordRefusedException>().having(
                (error) => error.reason,
                'reason',
                PasswordRefusal.passwordChanged,
              ),
            ),
          );
          expect(watch.elapsed, lessThan(maxClockSkew));
          expect(
            await ServerSideSession.db.count(
              session,
              where: (t) => t.authUserId.equals(ben),
            ),
            0,
          );
        });
      });

      group('pruning', () {
        late UuidValue carla;

        setUp(() async {
          carla = (await AuthServices.instance.authUsers.create(
            session,
            scopes: {identified},
          )).id;
        });

        test('deletes the identified people the register no longer knows, '
            'asking only about those', () async {
          final forgotten = await forgetPeopleTheRegisterForgot(
            session,
            batch: 1,
          );

          expect(forgotten, 1);
          expect(await AuthUser.db.findById(session, carla), isNull);
          expect(await AuthUser.db.findById(session, ben), isNotNull);
          expect(await AuthUser.db.findById(session, anna), isNotNull);
          expect(register.askedAbout.expand((people) => people), {ben, carla});
        });

        test('deletes nobody while the register knows none of those asked '
            'about, as a register misnamed or emptied would say', () async {
          register.accounts.clear();

          expect(await forgetPeopleTheRegisterForgot(session), 0);
          expect(await AuthUser.db.findById(session, ben), isNotNull);
          expect(await AuthUser.db.findById(session, carla), isNotNull);
        });

        test('deletes nobody while the register is out of reach', () async {
          register.failing = RegisterUnavailableException('test');

          await expectLater(
            forgetPeopleTheRegisterForgot(session),
            throwsA(isA<RegisterUnavailableException>()),
          );
          expect(await AuthUser.db.findById(session, ben), isNotNull);
          expect(await AuthUser.db.findById(session, carla), isNotNull);
        });

        test('does nothing on the register', () async {
          useBase(sessionBuilder);

          expect(await forgetPeopleTheRegisterForgot(session), 0);
          expect(register.asked, isEmpty);
          expect(await AuthUser.db.findById(session, carla), isNotNull);
        });
      });

      test('does not start without the secret where it would need it, and '
          'needs none alone', () {
        expect(() => checkInstanceSecret(pod), returnsNormally);
        useInstanceSecret(pod, null);
        expect(() => checkInstanceSecret(pod), throwsStateError);

        useBase(sessionBuilder, accounts: HoldsRegister(members: [_learn]));
        expect(() => checkInstanceSecret(pod), throwsStateError);
        useBase(sessionBuilder);
        expect(() => checkInstanceSecret(pod), returnsNormally);
      });

      test('does not start with a secret shorter than 32 characters, alone '
          'or not: it gates every account of the instance', () {
        for (final accounts in [
          const HoldsRegister(),
          HoldsRegister(members: [_learn]),
          MemberOfRegister(_learn),
        ]) {
          useBase(sessionBuilder, accounts: accounts);
          useInstanceSecret(pod, 'x' * 31);
          expect(() => checkInstanceSecret(pod), throwsStateError);
          useInstanceSecret(pod, 'x' * 32);
          expect(() => checkInstanceSecret(pod), returnsNormally);
        }
      });

      test('asks the register at its address with the secret, and asks '
          'nothing without one', () {
        AccountRegister.use(pod, null);

        expect(
          AccountRegister.of(pod),
          isA<RemoteRegister>()
              .having((remote) => remote.register, 'register', _learn)
              .having((remote) => remote.secret, 'secret', _secret),
        );
        useInstanceSecret(pod, null);
        expect(() => AccountRegister.of(pod), throwsStateError);
        expect(
          MemberNotifier.of(pod),
          isA<HttpMemberNotifier>().having(
            (notifier) => notifier.secret,
            'secret',
            isNull,
          ),
        );
      });
    },
  );
}

Future<void> _deleteAll(Session session) async {
  await AuthUser.db.deleteWhere(session, where: (t) => t.id.notEquals(null));
}