halkyon-days/halkyon
Watch
1
0
Fork
You've already forked halkyon
 0
Code Issues Pull requests Projects Releases 37 Packages Wiki Activity Actions

fix(auth): only a session made since dismisses the owner's warning

Browse source 
The full reading's L1: the warning that ten wrong proofs ended a session is
there for the owner to learn of it, and any other session of the account
(another app on the same stolen phone) dismissed it. Now only a session
made after the warning dismisses it (signed in again, or the sign-in that
first shows it); an older one is refused (PasswordRefusal.signedInBefore,
its own text in English and German), and a new password clears it as
before. A member tells the register when its session asking was made.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-10-21 13:32:33 +02:00
commit 003cb4821a
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64
8 changed files with 165 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

3
packages/halkyon_app/lib/l10n/halkyon_app_de.arb
View file

@ -232,5 +232,6 @@
"passwordResetsCallOff": "Absagen",
"passwordCallOffTitle": "Zurücksetzen absagen",
"passwordCallOffIntro": "Dein Passwort und ein Code sagen jedes anstehende Zurücksetzen ab.",
"passwordSectionGitHubEndsDeletes": "Die Anmeldung mit GitHub endet am {date}. Dann wird dein Konto mit allem darin gelöscht, es sei denn, du richtest vorher ein Passwort ein."
"passwordSectionGitHubEndsDeletes": "Die Anmeldung mit GitHub endet am {date}. Dann wird dein Konto mit allem darin gelöscht, es sei denn, du richtest vorher ein Passwort ein.",
"passwordSignedInBefore": "Nur ein seitdem angemeldetes Gerät kann diese Warnung ausblenden: Melde dich auf diesem neu an oder ändere dein Passwort."
}

3
packages/halkyon_app/lib/l10n/halkyon_app_en.arb
View file

@ -507,5 +507,6 @@
"type": "String"
}
}
}
},
"passwordSignedInBefore": "Only a device signed in since then can dismiss this warning: sign in again on this one, or change your password."
}

6
packages/halkyon_app/lib/l10n/halkyon_app_localizations.dart
View file

@ -1500,6 +1500,12 @@ abstract class HalkyonAppLocalizations {
/// In en, this message translates to:
/// **'Sign-in with GitHub ends on {date}. Your account, with everything in it, will be deleted then, unless you set up a password before.'**
String passwordSectionGitHubEndsDeletes(String date);
/// No description provided for @passwordSignedInBefore.
///
/// In en, this message translates to:
/// **'Only a device signed in since then can dismiss this warning: sign in again on this one, or change your password.'**
String get passwordSignedInBefore;
}
class _HalkyonAppLocalizationsDelegate

4
packages/halkyon_app/lib/l10n/halkyon_app_localizations_de.dart
View file

@ -874,4 +874,8 @@ class HalkyonAppLocalizationsDe extends HalkyonAppLocalizations {
String passwordSectionGitHubEndsDeletes(String date) {
return 'Die Anmeldung mit GitHub endet am $date. Dann wird dein Konto mit allem darin gelöscht, es sei denn, du richtest vorher ein Passwort ein.';
}
@override
String get passwordSignedInBefore =>
'Nur ein seitdem angemeldetes Gerät kann diese Warnung ausblenden: Melde dich auf diesem neu an oder ändere dein Passwort.';
}

4
packages/halkyon_app/lib/l10n/halkyon_app_localizations_en.dart
View file

@ -857,6 +857,10 @@ class HalkyonAppLocalizationsEn extends HalkyonAppLocalizations {
String passwordSectionGitHubEndsDeletes(String date) {
return 'Sign-in with GitHub ends on $date. Your account, with everything in it, will be deleted then, unless you set up a password before.';
}
@override
String get passwordSignedInBefore =>
'Only a device signed in since then can dismiss this warning: sign in again on this one, or change your password.';
}
/// The translations for English, as used in the United Kingdom (`en_GB`).

1
packages/halkyon_app/lib/src/password/data/serverpod_password_gateway.dart
View file

@ -464,6 +464,7 @@ PasswordProblem _problemOf(protocol.PasswordRefusal reason) => switch (reason) {
protocol.PasswordRefusal.sessionEnded => PasswordProblem.sessionEnded,
protocol.PasswordRefusal.passwordChanged => PasswordProblem.passwordChanged,
protocol.PasswordRefusal.signInAgain => PasswordProblem.signInAgain,
protocol.PasswordRefusal.signedInBefore => PasswordProblem.signedInBefore,
};
/// Keeps one session in memory, for a client used once.

4
packages/halkyon_app/lib/src/password/model/password_failed.dart
View file

@ -34,6 +34,10 @@ enum PasswordProblem() {
/// then go on.
signInAgain,
/// The warning that a session was ended is dismissed only by a session
/// made since: sign in again on this device, or change the password.
signedInBefore,
/// No reset waits for the address.
noReset,

1
packages/halkyon_app/lib/src/password/widget/password_texts.dart
View file

@ -27,6 +27,7 @@ String passwordProblemText(BuildContext context, PasswordFailed failed) {
PasswordProblem.sessionEnded => l10n.passwordSessionEnded,
PasswordProblem.passwordChanged => l10n.passwordChangedSignInAgain,
PasswordProblem.signInAgain => l10n.passwordSignInAgain,
PasswordProblem.signedInBefore => l10n.passwordSignedInBefore,
PasswordProblem.noReset => l10n.passwordNoReset,
PasswordProblem.passwordExists => l10n.passwordExists,
PasswordProblem.addressTaken => l10n.passwordAddressTaken,