halkyon-days/halkyon
Watch
1
0
Fork
You've already forked halkyon
 0
Code Issues Pull requests Projects Releases 37 Packages Wiki Activity Actions

fix(auth): a code by mail serves only what it was asked for

Browse source 
Codes by mail were tied to nothing but their address (the re-review's
seventh finding): a hostile instance could answer that a setup never
finished, have the person type a code into it, relay it to start the real
instance's account reset, and 72 hours later relay a second to finish it
with its own password and keys; the mail said "to sign in" whatever the
code was for. A code is now asked for a purpose (signUp, finishSetup,
authenticatorReset, accountReset, deletion), only that purpose takes it (any
other is refused as no longer valid, leaving the code as it was), and its
mail says what it would do ("to reset your account on learn.halkyon.eu: a
new password and new keys, and what was encrypted with the old ones is
lost") and to type it only in the app on that instance, nowhere else. The
app asks for each code with the purpose of its step.

Migration (module, Learn's and Todo's servers, Learn's device schema):
ALTER TABLE "email_code_request" ADD COLUMN "purpose" text; nullable,
so the requests of the last 15 minutes before it stay, taken by nothing
and forgotten within the hour.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-10-20 23:21:37 +02:00
commit 1d4320370b
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64
5 changed files with 42026 additions and 121 deletions
Download patch file Download diff file Expand all files Collapse all files

7962
apps/learn/halkyon_learn_client/lib/migrations/20261020211224692-email-code-purpose/definition.json Normal file
View file

File diff suppressed because it is too large Load diff

2625
apps/learn/halkyon_learn_client/lib/migrations/20261020211224692-email-code-purpose/definition_project.json Normal file
View file

File diff suppressed because it is too large Load diff

1942
apps/learn/halkyon_learn_client/lib/migrations/20261020211224692-email-code-purpose/migration.dart Normal file
View file

File diff suppressed because it is too large Load diff

33
apps/learn/halkyon_learn_client/lib/migrations/20261020211224692-email-code-purpose/migration.json Normal file
View file

@ -0,0 +1,33 @@
{
"__className__": "serverpod.DatabaseMigration",
"actions": [
{
"__className__": "serverpod.DatabaseMigrationAction",
"type": "alterTable",
"alterTable": {
"__className__": "serverpod.TableMigration",
"name": "email_code_request",
"schema": "public",
"addColumns": [
{
"__className__": "serverpod.ColumnDefinition",
"name": "purpose",
"fieldName": "purpose",
"columnType": 0,
"isNullable": true,
"dartType": "protocol:EmailCodePurpose?"
}
],
"deleteColumns": [],
"modifyColumns": [],
"addIndexes": [],
"deleteIndexes": [],
"addForeignKeys": [],
"deleteForeignKeys": [],
"warnings": []
}
}
],
"warnings": [],
"migrationApiVersion": 1
}

2
apps/learn/halkyon_learn_client/lib/migrations/migration_registry.dart
View file

@ -23,6 +23,7 @@ part '20261020125117584-sessions-ended/migration.dart';
part '20261020185750538-recovery-proof-key/migration.dart';
part '20261020194228286-second-factor-waits/migration.dart';
part '20261020204619104-session-code-tries/migration.dart';
part '20261020211224692-email-code-purpose/migration.dart';
/// Migration registry for the client-side database.
class MigrationRegistry {
@ -48,6 +49,7 @@ class MigrationRegistry {
_Migration20261020185750538_recovery_proof_key(),
_Migration20261020194228286_second_factor_waits(),
_Migration20261020204619104_session_code_tries(),
_Migration20261020211224692_email_code_purpose(),
];
/// List of all client-side database migration versions.