fix(auth): only a session made since dismisses the owner's warning

The full reading's L1: the warning that ten wrong proofs ended a session is
there for the owner to learn of it, and any other session of the account
(another app on the same stolen phone) dismissed it. Now only a session
made after the warning dismisses it (signed in again, or the sign-in that
first shows it); an older one is refused (PasswordRefusal.signedInBefore,
its own text in English and German), and a new password clears it as
before. A member tells the register when its session asking was made.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_base_server/lib/src/generated/password/password_refusal.dart

@@ -93,7 +93,13 @@ enum PasswordRefusal implements _is.SerializableModel {
   /// A first password for an account that signs in with GitHub alone takes
   /// a GitHub sign-in of the last 10 minutes (the fourth reading: a session
   /// alone sets none): sign in with GitHub again, then set it.
-  signInAgain;
+  signInAgain,
+
+  /// The warning that a session of the account was ended for its wrong
+  /// proofs is dismissed only by a session made since (the full reading's
+  /// L1: another session of a stolen device would dismiss its only use):
+  /// sign in again on this device, or change the password.
+  signedInBefore;
 
   static PasswordRefusal fromJson(String name) {
     switch (name) {
@@ -139,6 +145,8 @@ enum PasswordRefusal implements _is.SerializableModel {
         return PasswordRefusal.passwordChanged;
       case 'signInAgain':
         return PasswordRefusal.signInAgain;
+      case 'signedInBefore':
+        return PasswordRefusal.signedInBefore;
       default:
         throw ArgumentError(
           'Value "$name" cannot be converted to "PasswordRefusal"',

packages/halkyon_base_server/lib/src/password/owner_proof_tries.dart

@@ -184,13 +184,30 @@ Future<void> noteSessionEndedForProofs(
 /// `AccountRegister.dismissSessionEndedWarning`.
 Future<void> dismissSessionEndedWarning(
   Session session,
-  UuidValue person,
-) async {
+  UuidValue person, {
+  required DateTime? sessionMadeAt,
+}) async {
+  // SELECT * FROM "account_password" WHERE "authUserId" = $1
+  final row = await AccountPassword.db.findFirstRow(
+    session,
+    where: (t) => t.authUserId.equals(person),
+  );
+  final warned = row?.sessionEndedForProofsAt;
+  if (warned == null) {
+    return;
+  }
+  // Only a session made since (the full reading's L1): another session of
+  // the device whose session was ended would dismiss the warning's only
+  // use, its owner learning of it.
+  if (sessionMadeAt == null || !sessionMadeAt.isAfter(warned)) {
+    throw PasswordRefusedException(reason: PasswordRefusal.signedInBefore);
+  }
   // UPDATE "account_password" SET "sessionEndedForProofsAt" = NULL
-  //   WHERE "authUserId" = $1
+  //   WHERE "authUserId" = $1 AND "sessionEndedForProofsAt" = $2
   await AccountPassword.db.updateWhere(
     session,
     columnValues: (t) => [t.sessionEndedForProofsAt(null)],
-    where: (t) => t.authUserId.equals(person),
+    where: (t) =>
+        t.authUserId.equals(person) & t.sessionEndedForProofsAt.equals(warned),
   );
 }

packages/halkyon_base_server/lib/src/password/password_endpoint.dart

@@ -161,11 +161,21 @@ class PasswordEndpoint extends Endpoint {
   /// ten wrong proofs in a row (`account.signInWays`'
   /// `sessionEndedForProofsAt`). Their session alone does: it hides a
   /// warning and changes nothing about how the account is secured.
-  Future<void> dismissSessionEndedWarning(Session session) =>
-      AccountRegister.of(session.serverpod).dismissSessionEndedWarning(
-        session,
-        session.authenticated!.authUserId,
-      );
+  Future<void> dismissSessionEndedWarning(Session session) async {
+    final authenticated = session.authenticated!;
+    // SELECT * FROM "serverpod_auth_core_session" WHERE "id" = $1
+    final asking = Uuid.isValidUUID(fromString: authenticated.authId)
+        ? await ServerSideSession.db.findById(
+            session,
+            UuidValue.withValidation(authenticated.authId),
+          )
+        : null;
+    await AccountRegister.of(session.serverpod).dismissSessionEndedWarning(
+      session,
+      authenticated.authUserId,
+      sessionMadeAt: asking?.createdAt,
+    );
+  }
 }
 
 /// Whether [session]'s own session (this server's) was made by a GitHub

packages/halkyon_base_server/lib/src/password/password_refusal.spy.yaml

@@ -62,3 +62,8 @@ values:
   ### a GitHub sign-in of the last 10 minutes (the fourth reading: a session
   ### alone sets none): sign in with GitHub again, then set it.
   - signInAgain
+  ### The warning that a session of the account was ended for its wrong
+  ### proofs is dismissed only by a session made since (the full reading's
+  ### L1: another session of a stolen device would dismiss its only use):
+  ### sign in again on this device, or change the password.
+  - signedInBefore

packages/halkyon_base_server/lib/src/register/account_register.dart

@@ -143,7 +143,11 @@ abstract interface class AccountRegister {
   Future<void> noteSessionEndedForProofs(Session session, UuidValue person);
 
   /// Dismisses [person]'s warning that a session was ended for its proofs.
-  Future<void> dismissSessionEndedWarning(Session session, UuidValue person);
+  Future<void> dismissSessionEndedWarning(
+    Session session,
+    UuidValue person, {
+    required DateTime? sessionMadeAt,
+  });
 
   /// Whether people sign in with a password and TOTP (ADR 0017): the
   /// register holds the keys it needs.

packages/halkyon_base_server/lib/src/register/instance_api.dart

@@ -205,6 +205,8 @@ Future<Map<String, Object?>?> _answer(
       await register.dismissSessionEndedWarning(
         session,
         arguments.id('person'),
+        // When the member's session asking was made (the full reading's L1).
+        sessionMadeAt: arguments.optionalTime('sessionMadeAt'),
       );
       return const {};
     case RegisterOperation.deleteAccount:
@@ -521,6 +523,12 @@ extension type const _Arguments(Map<String, Object?> _map) {
   ByteData? optionalBytes(String name) =>
       optionalString(name) == null ? null : bytes(name);
 
+  /// The moment [name] (ISO 8601) in UTC; null where it is missing.
+  DateTime? optionalTime(String name) => switch (optionalString(name)) {
+    final value? => DateTime.parse(value).toUtc(),
+    null => null,
+  };
+
   /// Whether the argument [name] holds anything (not null).
   bool has(String name) => _map[name] != null;
 

packages/halkyon_base_server/lib/src/register/local_register.dart

@@ -408,8 +408,13 @@ final class LocalRegister implements AccountRegister {
   @override
   Future<void> dismissSessionEndedWarning(
     Session session,
-    UuidValue person,
-  ) => owner_proofs.dismissSessionEndedWarning(session, person);
+    UuidValue person, {
+    required DateTime? sessionMadeAt,
+  }) => owner_proofs.dismissSessionEndedWarning(
+    session,
+    person,
+    sessionMadeAt: sessionMadeAt,
+  );
 
   @override
   Future<bool> passwordSignInOffered(Session session) async =>

packages/halkyon_base_server/lib/src/register/remote_register.dart

@@ -285,9 +285,11 @@ final class RemoteRegister implements AccountRegister {
   @override
   Future<void> dismissSessionEndedWarning(
     Session session,
-    UuidValue person,
-  ) => _ask(RegisterOperation.dismissSessionEndedWarning, {
+    UuidValue person, {
+    required DateTime? sessionMadeAt,
+  }) => _ask(RegisterOperation.dismissSessionEndedWarning, {
     'person': person.uuid,
+    'sessionMadeAt': sessionMadeAt?.toUtc().toIso8601String(),
   });
 
   @override