fix(app): GitHub's refusals say why, and no hint adds GitHub where passwords are offered

Where an instance offers password sign-in, GitHub is added to nobody (ADR
0017, D2), yet the start screen still said "then add GitHub" after a GitHub
account nobody has, and every refusal but an unknown account read
"Couldn't sign in with GitHub." (the end-to-end test of 21 Oct).

- The gateway tells from one read of the basics whether GitHub signs in and
  whether it is added to people (`gitHubOffer`, in place of
  `gitHubClientId`); the GitHub bloc keeps it (`Ready.linking`) for the
  profile, with why an attempt failed (`Ready.problem`).
- The instance's `usePassword`, `deprecated` and `ended` become problems of
  their own (`gitHubSignInProblemOf`), worded by `gitHubProblemText` and on
  the start screen; an anonymous person refused a link is told the GitHub
  account is nobody's and offered the password instead.
- Where passwords are offered, the start screen offers an account to create
  in place of the app's hint on adding GitHub.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_app/test/auth/bloc/github_sign_in_bloc_test.dart

@@ -38,6 +38,21 @@ void main() {
     await expectLater(bloc.stream, emits(const GitHubSignInStateUnavailable()));
   });
 
+  test('offers linking no GitHub account where the instance signs people in '
+      'with a password (ADR 0017)', () async {
+    gateway.linksGitHub = false;
+    final bloc = GitHubSignInBloc(
+      AuthRepository(gateway, MemorySignInAddresses()),
+      deviceHoldsContent: () async => holdsContent,
+    )..add(const GitHubSignInEventStarted());
+    addTearDown(bloc.close);
+
+    await expectLater(
+      bloc.stream,
+      emits(const GitHubSignInStateReady(linking: false)),
+    );
+  });
+
   test('links the GitHub account to the person', () async {
     final bloc = await ready();
 
@@ -228,6 +243,60 @@ void main() {
     });
   });
 
+  test('says why the instance refused, keeping whether it links', () async {
+    gateway.linksGitHub = false;
+    final bloc = GitHubSignInBloc(
+      AuthRepository(gateway, MemorySignInAddresses()),
+      deviceHoldsContent: () async => holdsContent,
+    )..add(const GitHubSignInEventStarted());
+    addTearDown(bloc.close);
+    await expectLater(
+      bloc.stream,
+      emits(const GitHubSignInStateReady(linking: false)),
+    );
+    gateway.gitHubError = const GitHubSignInFailed(
+      GitHubSignInProblem.deprecated,
+    );
+
+    bloc.add(const GitHubSignInEventRequested());
+
+    await expectLater(
+      bloc.stream,
+      emitsInOrder([
+        const GitHubSignInStateBusy(),
+        const GitHubSignInStateReady(
+          linking: false,
+          failed: true,
+          problem: GitHubSignInProblem.deprecated,
+        ),
+      ]),
+    );
+  });
+
+  test('an anonymous person whose GitHub account now signs in with its '
+      'password is told so, and stays', () async {
+    gateway
+      ..gitHubLinkOutcome = GitHubLinkOutcome.takenByAnotherPerson
+      ..gitHubSwitchError = const GitHubSignInFailed(
+        GitHubSignInProblem.usePassword,
+      );
+    final bloc = await ready();
+
+    bloc.add(const GitHubSignInEventRequested());
+
+    await expectLater(
+      bloc.stream,
+      emitsInOrder([
+        const GitHubSignInStateBusy(),
+        const GitHubSignInStateReady(
+          failed: true,
+          problem: GitHubSignInProblem.usePassword,
+        ),
+      ]),
+    );
+    expect(gateway.status, anonymous);
+  });
+
   test('says so when signing in fails', () async {
     final bloc = await ready();
     gateway.gitHubError = Exception('No connection');

packages/halkyon_app/test/auth/bloc/session_bloc_test.dart

@@ -154,6 +154,37 @@ void main() {
     expect(gateway.gitHubSwitches, 0);
   });
 
+  test('an account that signs in with its password now, and GitHub having '
+      'ended, are each said so, signing nobody in', () async {
+    start(signedOut: true);
+    bloc.add(const SessionEventStarted());
+    await expectLater(bloc.stream, emits(const SessionStateSignedOut()));
+
+    gateway.gitHubError = const GitHubSignInFailed(
+      GitHubSignInProblem.usePassword,
+    );
+    bloc.add(const SessionEventGitHubRequested());
+    await expectLater(
+      bloc.stream,
+      emitsInOrder([
+        const SessionStateSignedOut(busy: true),
+        const SessionStateSignedOut(problem: SignedOutProblem.usePassword),
+      ]),
+    );
+
+    gateway.gitHubError = const GitHubSignInFailed(GitHubSignInProblem.ended);
+    bloc.add(const SessionEventGitHubRequested());
+    await expectLater(
+      bloc.stream,
+      emitsInOrder([
+        const SessionStateSignedOut(busy: true),
+        const SessionStateSignedOut(problem: SignedOutProblem.gitHubEnded),
+      ]),
+    );
+    expect(gateway.signIns, 0);
+    expect(gateway.gitHubSwitches, 0);
+  });
+
   test('a session the server ended asks how to start too', () async {
     const stored = SignedIn(authUserId: 'github-1', isIdentified: true);
     start(status: stored);

packages/halkyon_app/test/auth/data/serverpod_auth_gateway_test.dart

@@ -20,9 +20,12 @@ final class _MemoryStorage() implements ClientAuthSuccessStorage {
 }
 
 /// An instance's halkyon_base as the network shows it: anonymous sign-ins
-/// get `anonymous-token`, its basics offer GitHub and passwords, and a
-/// sign-up makes Ben, signed in with `ben-token`.
+/// get `anonymous-token`, its basics offer GitHub (and passwords while
+/// [passwords]), and a sign-up makes Ben, signed in with `ben-token`.
 final class _Instance() {
+  /// Whether its basics offer password sign-in.
+  bool passwords = false;
+
   static final anonymous = UuidValue.withValidation(
     '0191f0c4-1111-7000-8000-000000000001',
   );
@@ -50,6 +53,7 @@ final class _Instance() {
             emailSignIn: true,
             sourceCodeUrl: 'https://code.example.org/learn',
             minimumAppBuild: 1,
+            passwordSignIn: passwords,
           ).toJson(),
         ),
         200,
@@ -116,8 +120,44 @@ void main() {
     },
   );
 
-  test('tells what the instance offers from its basics', () async {
-    expect(await gateway.gitHubClientId(), 'github-client');
+  test('tells what the instance offers from its basics: GitHub sign-in, '
+      'and linking GitHub to people only where passwords are not', () async {
+    expect(
+      await gateway.gitHubOffer(),
+      const GitHubOffer(signIn: true, linking: true),
+    );
+
+    instance.passwords = true;
+    expect(
+      await gateway.gitHubOffer(),
+      const GitHubOffer(signIn: true, linking: false),
+    );
+    expect(
+      instance.calls.where(
+        (each) => each.call == 'halkyon_base.instance/basics',
+      ),
+      hasLength(2),
+      reason: 'one read of the basics each',
+    );
+  });
+
+  test("puts the instance's refusals of GitHub as the app's problems", () {
+    expect(
+      {
+        for (final reason in GitHubSignInRefusal.values)
+          reason: gitHubSignInProblemOf(reason),
+      },
+      {
+        GitHubSignInRefusal.unavailable: GitHubSignInProblem.refused,
+        GitHubSignInRefusal.takenByAnotherPerson: GitHubSignInProblem.refused,
+        GitHubSignInRefusal.otherGitHubAccountLinked:
+            GitHubSignInProblem.refused,
+        GitHubSignInRefusal.unknownAccount: GitHubSignInProblem.unknownAccount,
+        GitHubSignInRefusal.usePassword: GitHubSignInProblem.usePassword,
+        GitHubSignInRefusal.deprecated: GitHubSignInProblem.deprecated,
+        GitHubSignInRefusal.ended: GitHubSignInProblem.ended,
+      },
+    );
   });
 
   test('a session granted elsewhere (a sign-up with a password, without '

packages/halkyon_app/test/auth/widget/github_texts_test.dart

@@ -0,0 +1,45 @@
+import 'package:flutter_test/flutter_test.dart';
+import 'package:halkyon_app/halkyon_app.dart';
+import 'package:halkyon_app/l10n/halkyon_app_localizations_en.dart';
+
+void main() {
+  final en = HalkyonAppLocalizationsEn();
+
+  String? textOf(GitHubSignInProblem? problem, {bool anonymous = false}) =>
+      gitHubProblemText(en, problem, anonymous: anonymous);
+
+  test('each refusal the instance gives a reason for says it', () {
+    expect(
+      textOf(GitHubSignInProblem.unknownAccount),
+      'No account here signs in with this GitHub account yet.',
+    );
+    expect(
+      textOf(GitHubSignInProblem.usePassword),
+      'This account signs in with its email address and password now, not '
+      'with GitHub.',
+    );
+    expect(
+      textOf(GitHubSignInProblem.deprecated),
+      "GitHub can't be added as a way to sign in any more: your email "
+      'address and password are.',
+    );
+    expect(
+      textOf(GitHubSignInProblem.ended),
+      'Sign-in with GitHub has ended on this instance.',
+    );
+  });
+
+  test('for an anonymous person, linking refused means the GitHub account is '
+      "nobody's: a password keeps the account instead", () {
+    expect(
+      textOf(GitHubSignInProblem.deprecated, anonymous: true),
+      'No account here signs in with this GitHub account yet. To keep your '
+      'progress, set up a password instead.',
+    );
+  });
+
+  test("leaves the rest to the screen's own failure", () {
+    expect(textOf(GitHubSignInProblem.refused), isNull);
+    expect(textOf(null), isNull);
+  });
+}

packages/halkyon_app/test/auth/widget/session_gate_test.dart

@@ -98,7 +98,8 @@ void main() {
   });
 
   testWidgets('from there, GitHub signs in its person; a GitHub account '
-      'nobody here has yet is said so', (tester) async {
+      'nobody here has yet is said so, with an account to create in its '
+      'place where passwords are offered (ADR 0017)', (tester) async {
     await dependencies.signedOut.write(signedOut: true);
     await start(tester);
 
@@ -109,12 +110,16 @@ void main() {
     await tester.pumpAndSettle();
     expect(
       find.text(
-        // The package's sentence, then the app's on where GitHub is added.
-        'No account here signs in with this GitHub account yet. Start '
-        'without an account, then add GitHub in Settings.',
+        'No account here signs in with this GitHub account yet. Create an '
+        'account with your email address and a password instead.',
       ),
       findsOneWidget,
     );
+    expect(
+      find.textContaining('add GitHub'),
+      findsNothing,
+      reason: 'GitHub is added to nobody where passwords are offered',
+    );
 
     gateway.gitHubError = null;
     await tester.tap(find.text('Sign in with GitHub'));
@@ -140,6 +145,55 @@ void main() {
     expect(find.text('App of github-person'), findsOneWidget);
   });
 
+  testWidgets('where no passwords are offered, a GitHub account nobody here '
+      'has yet is said so with where the app adds GitHub', (tester) async {
+    dependencies.passwordGateway.offered = false;
+    await dependencies.signedOut.write(signedOut: true);
+    await start(tester);
+
+    gateway.gitHubError = const GitHubSignInFailed(
+      GitHubSignInProblem.unknownAccount,
+    );
+    await tester.tap(find.text('Sign in with GitHub'));
+    await tester.pumpAndSettle();
+    expect(
+      find.text(
+        // The package's sentence, then the app's on where GitHub is added.
+        'No account here signs in with this GitHub account yet. Start '
+        'without an account, then add GitHub in Settings.',
+      ),
+      findsOneWidget,
+    );
+  });
+
+  testWidgets('an account that signs in with its password, and GitHub having '
+      'ended, are each said so', (tester) async {
+    await dependencies.signedOut.write(signedOut: true);
+    await start(tester);
+
+    gateway.gitHubError = const GitHubSignInFailed(
+      GitHubSignInProblem.usePassword,
+    );
+    await tester.tap(find.text('Sign in with GitHub'));
+    await tester.pumpAndSettle();
+    expect(
+      find.text(
+        'This account signs in with its email address and password now, '
+        'not with GitHub.',
+      ),
+      findsOneWidget,
+    );
+
+    gateway.gitHubError = const GitHubSignInFailed(GitHubSignInProblem.ended);
+    await tester.tap(find.text('Sign in with GitHub'));
+    await tester.pumpAndSettle();
+    expect(
+      find.text('Sign-in with GitHub has ended on this instance.'),
+      findsOneWidget,
+    );
+    expect(find.text("Couldn't sign in with GitHub."), findsNothing);
+  });
+
   testWidgets('offers only the ways the instance has', (tester) async {
     gateway.offersGitHub = false;
     dependencies.passwordGateway.offered = false;