halkyon-days/halkyon
Watch
1
0
Fork
You've already forked halkyon
 0
Code Issues Pull requests Projects Releases 37 Packages Wiki Activity Actions

feat(base,app)!: GitHub signs nobody in any more (ADR 0020, D36)

Browse source 
Every account signs in with SimpleLogin or a password now, so GitHub
goes from the module, the shared app package, Learn and Todo, ahead of
ADR 0017's GITHUB_SIGN_IN_ENDS.

- halkyon_base: no `gitHubSignIn` endpoint, GitHub identity provider or
  GitHub refusals; no `githubClientId`/`githubClientSecret`, no
  `GITHUB_SIGN_IN_ENDS` and no `forgetGitHubAccounts`; the register
  loses `account-with-github`. `SignInWays.gitHub`, the basics'
  `gitHubClientId` and `gitHubSignInEnds`, and `PasswordRefusal`'s
  `signInAgain` and `noAddress` go. A first password takes a code
  mailed to the person's own address; an account without one sets none
  (`wrongCredentials`).
- Learn's server: `instance.info()` without `gitHubClientId`, the
  pruning without GitHub, and `minimumAppBuild` 24, as builds up to 23
  (v0.20.0) require `SignInWays.gitHub`: the server deploys with the
  release of build 24.
- halkyon_app: no GitHub button or problems on the start screen, no
  password offered after a GitHub sign-in, and `ServerpodAuthGateway`
  without the browser half only GitHub used (`(client, base:)`). The
  account section offers a first password only to an account with an
  address. `LoopbackWebAuth` and the apps' schemes stay, SimpleLogin's
  ways back.
- Learn's Profile lists no GitHub; the texts go (English, German).
- Serverpod's `serverpod_auth_idp_github_account` stays, as its
  migrations make it; a row goes with its account, and ADR 0020's D36
  gives operators the SQL to delete those left.
- deploy/: compose.yaml and .env.example without GitHub. The READMEs,
  AGENTS.md files and ADR 0017 amended.

BREAKING CHANGE: builds up to 23 can't read the instance's answers
about an account's ways in; minimumAppBuild is 24.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-10-25 12:52:52 +01:00
commit 4e33133733
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64
1 changed files with 564 additions and 3570 deletions
Download patch file Download diff file Expand all files Collapse all files

8
apps/learn/README.md
View file

@ -15,8 +15,7 @@ instance are published, so anyone can see how an instance works and run their ow
- **Every account has a way in**: SimpleLogin, whose ID alone the instance keeps, or an
email address with a password and an authenticator, the password never leaving the
device ([ADR 0020](../../docs/adr/0020-sign-in-with-simplelogin.md),
[ADR 0017](../../docs/adr/0017-password-totp-and-keys.md)). GitHub still signs in
those who have it, until the instance ends it.
[ADR 0017](../../docs/adr/0017-password-totp-and-keys.md)).
- **No end-to-end encryption.** Content is readable by the operator of the instance, as on
Mastodon; whoever trusts no operator can run their own
([ADR 0002](../../docs/adr/0002-no-end-to-end-encryption.md)).
@ -80,10 +79,7 @@ which `flutter pub get` fetches by itself.
The server's secrets live in `apps/learn/halkyon_learn_server/config/passwords.yaml`,
which is never committed. In a fresh clone, create it with a `development` and a `test`
section, each holding `database`, `serverSideSessionKeyHashPepper` and `serviceSecret`
(for example from `openssl rand -base64 32`). GitHub sign-in is optional: add
`githubClientId` and `githubClientSecret` of your own GitHub OAuth app to `development`,
registered with the callback URLs `app.halkyon.learn://github-callback` and
`http://127.0.0.1/github-callback`.
(for example from `openssl rand -base64 32`).
Then start the server, its embedded database and the app: