fix(auth): an account whose second factor doesn't work deletes itself
An account whose setup never finished, or whose authenticators' reset took effect, could not delete itself (the re-review's eighth finding): deletion asked for a TOTP or recovery code it had no way to give. Such an account now deletes itself with the password's proof and a code by mail to its address asked for deleting (EmailCodePurpose.deletion, which nothing else takes), the address checked against the account's as everywhere after the password; an account whose second factor works still takes a code from it. The app's deletion sheet asks for the password and mails the code there, then takes it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
parent
1d4320370b
commit
293ec6b103
1 changed files with 752 additions and 185 deletions
|
|
@ -783,6 +783,13 @@ class HalkyonAppLocalizationsEn extends HalkyonAppLocalizations {
|
|||
@override
|
||||
String get passwordAddressUnknown =>
|
||||
'This device doesn\'t know your account\'s address, which this takes. Sign out, then sign in again with your address and password.';
|
||||
|
||||
@override
|
||||
String get passwordDeleteIntroByMail =>
|
||||
'Your account goes with everything in it, in every service of this instance. Its authenticator isn\'t set up, so a code by mail confirms it: type your password, then the code we email to your address.';
|
||||
|
||||
@override
|
||||
String get passwordDeleteSendCode => 'Email me a code';
|
||||
}
|
||||
|
||||
/// The translations for English, as used in the United Kingdom (`en_GB`).
|
||||
|
|
|
|||
Loading…
Reference in a new issue