halkyon-days/halkyon
Watch
1
0
Fork
You've already forked halkyon
 0
Code Issues Pull requests Projects Releases 37 Packages Wiki Activity Actions

feat(base,app)!: GitHub signs nobody in any more (ADR 0020, D36)

Browse source 
Every account signs in with SimpleLogin or a password now, so GitHub
goes from the module, the shared app package, Learn and Todo, ahead of
ADR 0017's GITHUB_SIGN_IN_ENDS.

- halkyon_base: no `gitHubSignIn` endpoint, GitHub identity provider or
  GitHub refusals; no `githubClientId`/`githubClientSecret`, no
  `GITHUB_SIGN_IN_ENDS` and no `forgetGitHubAccounts`; the register
  loses `account-with-github`. `SignInWays.gitHub`, the basics'
  `gitHubClientId` and `gitHubSignInEnds`, and `PasswordRefusal`'s
  `signInAgain` and `noAddress` go. A first password takes a code
  mailed to the person's own address; an account without one sets none
  (`wrongCredentials`).
- Learn's server: `instance.info()` without `gitHubClientId`, the
  pruning without GitHub, and `minimumAppBuild` 24, as builds up to 23
  (v0.20.0) require `SignInWays.gitHub`: the server deploys with the
  release of build 24.
- halkyon_app: no GitHub button or problems on the start screen, no
  password offered after a GitHub sign-in, and `ServerpodAuthGateway`
  without the browser half only GitHub used (`(client, base:)`). The
  account section offers a first password only to an account with an
  address. `LoopbackWebAuth` and the apps' schemes stay, SimpleLogin's
  ways back.
- Learn's Profile lists no GitHub; the texts go (English, German).
- Serverpod's `serverpod_auth_idp_github_account` stays, as its
  migrations make it; a row goes with its account, and ADR 0020's D36
  gives operators the SQL to delete those left.
- deploy/: compose.yaml and .env.example without GitHub. The READMEs,
  AGENTS.md files and ADR 0017 amended.

BREAKING CHANGE: builds up to 23 can't read the instance's answers
about an account's ways in; minimumAppBuild is 24.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-10-25 12:52:52 +01:00
commit 4e33133733
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64
13 changed files with 564 additions and 3570 deletions
Download patch file Download diff file Expand all files Collapse all files

85
packages/halkyon_app/test/auth/bloc/session_bloc_test.dart
View file

@ -96,85 +96,8 @@ void main() {
expect(gateway.accountDeletions, 0);
});
test('signing in with GitHub from there switches to its person', () async {
start();
bloc.add(const SessionEventStarted());
await expectLater(bloc.stream, emits(const SessionStateSignedOut()));
bloc.add(const SessionEventGitHubRequested());
// A password is offered first (ADR 0017, D2), then the person's app.
const person = SignedIn(authUserId: 'github-person', isIdentified: true);
await expectLater(
bloc.stream,
emitsThrough(const SessionStateGitHubSignedIn(person)),
);
bloc.add(const SessionEventPasswordOfferDone());
await expectLater(bloc.stream, emits(const SessionStateActive(person)));
});
test('a GitHub account nobody here signs in with yet is said so; any '
'other refusal fails, and nothing is made either way', () async {
start();
bloc.add(const SessionEventStarted());
await expectLater(bloc.stream, emits(const SessionStateSignedOut()));
gateway.gitHubError = const GitHubSignInFailed(
GitHubSignInProblem.unknownAccount,
);
bloc.add(const SessionEventGitHubRequested());
await expectLater(
bloc.stream,
emitsInOrder([
const SessionStateSignedOut(busy: true),
const SessionStateSignedOut(problem: SignedOutProblem.noGitHubAccount),
]),
);
gateway.gitHubError = const GitHubSignInFailed(GitHubSignInProblem.refused);
bloc.add(const SessionEventGitHubRequested());
await expectLater(
bloc.stream,
emitsInOrder([
const SessionStateSignedOut(busy: true),
const SessionStateSignedOut(problem: SignedOutProblem.failed),
]),
);
expect(gateway.gitHubSwitches, 0);
});
test('an account that signs in with its password now, and GitHub having '
'ended, are each said so, signing nobody in', () async {
start();
bloc.add(const SessionEventStarted());
await expectLater(bloc.stream, emits(const SessionStateSignedOut()));
gateway.gitHubError = const GitHubSignInFailed(
GitHubSignInProblem.usePassword,
);
bloc.add(const SessionEventGitHubRequested());
await expectLater(
bloc.stream,
emitsInOrder([
const SessionStateSignedOut(busy: true),
const SessionStateSignedOut(problem: SignedOutProblem.usePassword),
]),
);
gateway.gitHubError = const GitHubSignInFailed(GitHubSignInProblem.ended);
bloc.add(const SessionEventGitHubRequested());
await expectLater(
bloc.stream,
emitsInOrder([
const SessionStateSignedOut(busy: true),
const SessionStateSignedOut(problem: SignedOutProblem.gitHubEnded),
]),
);
expect(gateway.gitHubSwitches, 0);
});
test('a session the server ended asks how to start too', () async {
const stored = SignedIn(authUserId: 'github-1', isIdentified: true);
const stored = SignedIn(authUserId: 'person-1', isIdentified: true);
start(status: stored);
bloc.add(const SessionEventStarted());
await expectLater(bloc.stream, emits(const SessionStateActive(stored)));
@ -185,7 +108,7 @@ void main() {
});
test('deleting the account asks how to start', () async {
const stored = SignedIn(authUserId: 'github-1', isIdentified: true);
const stored = SignedIn(authUserId: 'person-1', isIdentified: true);
start(status: stored);
bloc.add(const SessionEventStarted());
await expectLater(bloc.stream, emits(const SessionStateActive(stored)));
@ -204,7 +127,7 @@ void main() {
test('a deletion that fails keeps the person signed in, their app in '
'place, and says so; asked again, it tries again', () async {
const stored = SignedIn(authUserId: 'github-1', isIdentified: true);
const stored = SignedIn(authUserId: 'person-1', isIdentified: true);
start(status: stored);
bloc.add(const SessionEventStarted());
await expectLater(bloc.stream, emits(const SessionStateActive(stored)));
@ -236,7 +159,7 @@ void main() {
test('a sign-out that fails keeps the person signed in, their app in '
'place, and says so', () async {
const stored = SignedIn(authUserId: 'github-1', isIdentified: true);
const stored = SignedIn(authUserId: 'person-1', isIdentified: true);
start(status: stored);
bloc.add(const SessionEventStarted());
await expectLater(bloc.stream, emits(const SessionStateActive(stored)));

57
packages/halkyon_app/test/auth/data/serverpod_auth_gateway_test.dart
View file

@ -19,13 +19,9 @@ final class _MemoryStorage() implements ClientAuthSuccessStorage {
Future<void> set(AuthSuccess? data) async => _session = data;
}
/// An instance's halkyon_base as the network shows it: its basics offer
/// GitHub while it has [gitHubClientId], and a sign-up makes Ben, signed
/// in with `ben-token`.
/// An instance's halkyon_base as the network shows it: a sign-up makes
/// Ben, signed in with `ben-token`.
final class _Instance() {
/// The client ID of its GitHub OAuth app; none without.
String? gitHubClientId = 'github-client';
static final anonymous = UuidValue.withValidation(
'0191f0c4-1111-7000-8000-000000000001',
);
@ -41,20 +37,6 @@ final class _Instance() {
calls.add((call: call, session: request.headers['authorization']));
String sent(Object? body) => jsonEncode(body);
return switch (call) {
'halkyon_base.instance/basics' => http.Response(
sent(
InstanceBasics(
app: 'learn',
gitHubClientId: gitHubClientId,
emailSignIn: true,
sourceCodeUrl: 'https://code.example.org/learn',
minimumAppBuild: 1,
passwordSignIn: true,
simpleLogin: true,
).toJson(),
),
200,
),
'halkyon_base.passwordSignIn/signUp' => http.Response(
sent(_session(ben, 'ben-token', identified: true)),
200,
@ -91,13 +73,7 @@ void main() {
storage: _MemoryStorage(),
);
await app.auth.initialize();
gateway = ServerpodAuthGateway(
app,
base: app.modules,
callbackScheme: 'app.halkyon.test',
appName: 'Halkyon Test',
httpClient: instance.client,
);
gateway = ServerpodAuthGateway(app, base: app.modules);
addTearDown(() async {
await gateway.dispose();
app.close();
@ -134,33 +110,6 @@ void main() {
);
});
test('tells from the basics whether the instance signs in with GitHub '
'those who have it', () async {
expect(await gateway.gitHubSignInOffered(), isTrue);
instance.gitHubClientId = null;
expect(await gateway.gitHubSignInOffered(), isFalse);
});
test("puts the instance's refusals of GitHub as the app's problems", () {
expect(
{
for (final reason in GitHubSignInRefusal.values)
reason: gitHubSignInProblemOf(reason),
},
{
GitHubSignInRefusal.unavailable: GitHubSignInProblem.refused,
GitHubSignInRefusal.takenByAnotherPerson: GitHubSignInProblem.refused,
GitHubSignInRefusal.otherGitHubAccountLinked:
GitHubSignInProblem.refused,
GitHubSignInRefusal.unknownAccount: GitHubSignInProblem.unknownAccount,
GitHubSignInRefusal.usePassword: GitHubSignInProblem.usePassword,
GitHubSignInRefusal.deprecated: GitHubSignInProblem.deprecated,
GitHubSignInRefusal.ended: GitHubSignInProblem.ended,
},
);
});
test('a session granted elsewhere (a sign-up with a password, signed '
'out) takes its place', () async {
final passwords = ServerpodPasswordGateway(

8
packages/halkyon_app/test/auth/widget/account_tiles_test.dart
View file

@ -132,7 +132,7 @@ void main() {
testWidgets('deleting an identified account while the instance is out of '
'reach says so, and deletes nothing (the short reading)', (tester) async {
gateway = FakeAuthGateway(
status: const SignedIn(authUserId: 'github-1', isIdentified: true),
status: const SignedIn(authUserId: 'person-2', isIdentified: true),
);
await start(tester);
dependencies.passwordGateway.failing = const PasswordFailed(
@ -151,7 +151,7 @@ void main() {
findsOneWidget,
);
expect(gateway.accountDeletions, 0);
expect(find.text('App of github-1'), findsOneWidget);
expect(find.text('App of person-2'), findsOneWidget);
});
testWidgets('deleting an account whose setup never finished asks for the '
@ -353,7 +353,7 @@ void main() {
testWidgets("a sign-out the device's storage failed keeps the person in "
'their app, and says so', (tester) async {
gateway = FakeAuthGateway(
status: const SignedIn(authUserId: 'github-1', isIdentified: true),
status: const SignedIn(authUserId: 'person-2', isIdentified: true),
)..signOutError = Exception('The keyring is locked');
await start(tester);
@ -364,7 +364,7 @@ void main() {
find.text("Couldn't sign out on this device. Try again."),
findsOneWidget,
);
expect(find.text('App of github-1'), findsOneWidget);
expect(find.text('App of person-2'), findsOneWidget);
});
testWidgets('speaks German', (tester) async {

122
packages/halkyon_app/test/auth/widget/session_gate_test.dart
View file

@ -80,7 +80,11 @@ void main() {
expect(find.text('Continue with SimpleLogin'), findsOneWidget);
expect(find.text('Sign in'), findsOneWidget);
expect(find.text('Create an account'), findsOneWidget);
expect(find.text('Sign in with GitHub'), findsOneWidget);
expect(
find.textContaining('GitHub'),
findsNothing,
reason: 'GitHub signs nobody in any more (ADR 0020, D36)',
);
expect(find.text('Start without an account'), findsNothing);
expect(
find.text('Use another instance'),
@ -105,73 +109,10 @@ void main() {
expect(gateway.accountDeletions, 1);
});
testWidgets('from there, GitHub signs in its person; a GitHub account '
'nobody here has is said so, with SimpleLogin to create one in its '
'place', (tester) async {
signedOut();
await start(tester);
gateway.gitHubError = const GitHubSignInFailed(
GitHubSignInProblem.unknownAccount,
);
await tester.tap(find.text('Sign in with GitHub'));
await tester.pumpAndSettle();
expect(
find.text(
'No account here signs in with this GitHub account. Continue with '
'SimpleLogin to create one instead.',
),
findsOneWidget,
);
gateway.gitHubError = null;
await tester.tap(find.text('Sign in with GitHub'));
await tester.pumpAndSettle();
// A password is offered first (ADR 0017, D2), while the sign-in is
// recent enough to set one; put off, the person's app.
expect(find.text('Set up a password'), findsWidgets);
await tester.tap(find.text('Later'));
await tester.pumpAndSettle();
expect(find.text('App of github-person'), findsOneWidget);
});
testWidgets('where the instance offers passwords and no SimpleLogin, the '
'account to create in its place has a password (ADR 0017)', (
testWidgets('an instance with no way to create an account says so', (
tester,
) async {
signedOut();
dependencies.simpleLoginGateway.isOffered = false;
await start(tester);
gateway.gitHubError = const GitHubSignInFailed(
GitHubSignInProblem.unknownAccount,
);
await tester.tap(find.text('Sign in with GitHub'));
await tester.pumpAndSettle();
expect(
find.text(
'No account here signs in with this GitHub account. Create an '
'account with your email address and a password instead.',
),
findsOneWidget,
);
});
testWidgets('after GitHub, offers no password to someone who has one, or '
'where the instance offers none', (tester) async {
signedOut();
dependencies.passwordGateway.offered = false;
await start(tester);
await tester.tap(find.text('Sign in with GitHub'));
await tester.pumpAndSettle();
expect(find.text('Later'), findsNothing);
expect(find.text('App of github-person'), findsOneWidget);
});
testWidgets('an instance with no way to create an account says so, and '
'GitHub signs in only those who have it', (tester) async {
signedOut();
dependencies.passwordGateway.offered = false;
dependencies.simpleLoginGateway.isOffered = false;
await start(tester);
@ -182,54 +123,15 @@ void main() {
);
expect(find.text('Continue with SimpleLogin'), findsNothing);
expect(find.text('Create an account'), findsNothing);
gateway.gitHubError = const GitHubSignInFailed(
GitHubSignInProblem.unknownAccount,
);
await tester.tap(find.text('Sign in with GitHub'));
await tester.pumpAndSettle();
expect(
find.text('No account here signs in with this GitHub account.'),
findsOneWidget,
);
});
testWidgets('an account that signs in with its password, and GitHub having '
'ended, are each said so', (tester) async {
signedOut();
await start(tester);
gateway.gitHubError = const GitHubSignInFailed(
GitHubSignInProblem.usePassword,
);
await tester.tap(find.text('Sign in with GitHub'));
await tester.pumpAndSettle();
expect(
find.text(
'This account signs in with its email address and password now, '
'not with GitHub.',
),
findsOneWidget,
);
gateway.gitHubError = const GitHubSignInFailed(GitHubSignInProblem.ended);
await tester.tap(find.text('Sign in with GitHub'));
await tester.pumpAndSettle();
expect(
find.text('Sign-in with GitHub has ended on this instance.'),
findsOneWidget,
);
expect(find.text("Couldn't sign in with GitHub."), findsNothing);
});
testWidgets('offers only the ways the instance has', (tester) async {
signedOut();
gateway.offersGitHub = false;
dependencies.passwordGateway.offered = false;
await start(tester);
expect(find.text('Continue with SimpleLogin'), findsOneWidget);
expect(find.text('Sign in with GitHub'), findsNothing);
expect(find.text('Sign in'), findsNothing);
expect(find.text('Create an account'), findsNothing);
expect(find.textContaining('offers no way'), findsNothing);
});
@ -243,14 +145,12 @@ void main() {
dependencies.simpleLoginGateway.failing = const SimpleLoginFailed(
SimpleLoginProblem.failed,
);
gateway.offersGitHubError = Exception('No connection');
await start(tester);
expect(find.text("Couldn't reach the server."), findsOneWidget);
expect(find.text('Continue with SimpleLogin'), findsNothing);
expect(find.textContaining('offers no way'), findsNothing);
gateway.offersGitHubError = null;
dependencies.passwordGateway.failing = null;
dependencies.simpleLoginGateway.failing = null;
await tester.tap(find.text('Try again'));
@ -271,12 +171,10 @@ void main() {
await tester.pumpAndSettle();
expect(find.text('Start on test.example.org:'), findsOneWidget);
gateway.gitHubError = null;
await tester.tap(find.text('Sign in with GitHub'));
// Signed in anew, as a sign-in's session put in place does it.
await gateway.useSession(const SessionGrant('ada', 'session-2'));
await tester.pumpAndSettle();
await tester.tap(find.text('Later'));
await tester.pumpAndSettle();
expect(find.text('App of github-person'), findsOneWidget);
expect(find.text('App of ada'), findsOneWidget);
gateway.revokeSession();
await tester.pumpAndSettle();
expect(find.text('Start on test.example.org:'), findsOneWidget);

10
packages/halkyon_app/test/base/base_client_test.dart
View file

@ -12,8 +12,6 @@ import 'package:http/testing.dart';
String sent(SerializableException refusal) => jsonEncode({
'className': switch (refusal) {
EmailSignInRefusedException() => 'halkyon_base.EmailSignInRefusedException',
GitHubSignInRefusedException() =>
'halkyon_base.GitHubSignInRefusedException',
PasswordRefusedException() => 'halkyon_base.PasswordRefusedException',
OidcRefusedException() => 'halkyon_oidc.OidcRefusedException',
_ => throw ArgumentError.value(refusal),
@ -41,15 +39,13 @@ void main() {
expect(
protocol.decodeWithType(
sent(
GitHubSignInRefusedException(
reason: GitHubSignInRefusal.unknownAccount,
),
PasswordRefusedException(reason: PasswordRefusal.wrongCredentials),
),
),
isA<GitHubSignInRefusedException>().having(
isA<PasswordRefusedException>().having(
(refusal) => refusal.reason,
'reason',
GitHubSignInRefusal.unknownAccount,
PasswordRefusal.wrongCredentials,
),
);
});

77
packages/halkyon_app/test/password/bloc/account_setup_cubit_test.dart
View file

@ -42,7 +42,6 @@ void main() {
AccountSetupCubit setUpAs(
AccountSetupMode mode, {
String? address,
bool hasAddress = false,
bool hasHandle = false,
String? phrase,
}) {
@ -51,7 +50,6 @@ void main() {
mode: mode,
language: 'en',
address: address,
hasAddress: hasAddress,
hasHandle: hasHandle,
phrase: phrase,
);
@ -239,11 +237,19 @@ void main() {
expect(auth.status, const SignedOut());
});
test('gives one signed in with GitHub a password with an address a code '
'proves, the session staying theirs (ADR 0017, D2), and their first '
/// Signs in the person of an account at [address] without a password,
/// as codes by mail left accounts; their id.
Future<String> signedInWithAddress(String address) async {
final person = gateway.addAddressOnly(address).person;
await auth.useSession(SessionGrant(person, 'session-1'));
return person;
}
test('gives a signed-in person with an address a password, a code mailed '
'there proving them, the session staying theirs, and their first '
'handle (ADR 0020, D28)', () async {
await auth.switchToGitHub();
final person = (auth.status as SignedIn).authUserId;
final person = await signedInWithAddress('anna@example.org');
// The device doesn't know the address: it asks for it.
final cubit = setUpAs(AccountSetupMode.setPassword)
..addressEntered('anna@example.org');
await cubit.passwordEntered('correct horse', 'correct horse');
@ -255,6 +261,7 @@ void main() {
expect(gateway.calls.last, 'checkHandle');
cubit.handleEntered('anna');
expect(cubit.state, at(AccountSetupStep.mailCode));
expect(gateway.mailed.last.purpose, MailCodePurpose.firstPassword);
await cubit.mailCodeEntered(gateway.codeFor('anna@example.org'));
await cubit.authenticatorCodeEntered(fakeTotpCode);
@ -268,8 +275,7 @@ void main() {
test('asks no handle of a signed-in person who has one, and sends '
'none', () async {
await auth.switchToGitHub();
final person = (auth.status as SignedIn).authUserId;
final person = await signedInWithAddress('anna@example.org');
gateway.handles[person] = 'anna';
final cubit = setUpAs(AccountSetupMode.setPassword, hasHandle: true)
..addressEntered('anna@example.org');
@ -283,27 +289,14 @@ void main() {
expect(gateway.handles[person], 'anna');
});
test('gives a signed-in person with an address their first password only '
'with a code mailed to that address for it, never with the session '
'alone (the fourth reading)', () async {
await auth.switchToGitHub();
final person = (auth.status as SignedIn).authUserId;
final first = setUpAs(AccountSetupMode.setPassword)
..addressEntered('anna@example.org');
await first.passwordEntered('correct horse', 'correct horse');
first.phraseWrittenDown();
await first.phraseChecked(wordsAsked(first.state));
first.handleEntered('anna');
await first.mailCodeEntered(gateway.codeFor('anna@example.org'));
// An address and no password, as codes by mail left accounts.
gateway.accountOf(person)
..password = null
..authenticators.clear();
test('where the device knows the address, starts at the password and '
'mails the code there for a first password', () async {
final person = await signedInWithAddress('anna@example.org');
gateway.handles[person] = 'anna';
final cubit = setUpAs(
AccountSetupMode.setPassword,
address: 'anna@example.org',
hasAddress: true,
hasHandle: true,
);
expect(cubit.state, at(AccountSetupStep.password));
@ -320,43 +313,40 @@ void main() {
test('asks for the address a signed-in person has where the device '
"doesn't know it", () {
final cubit = setUpAs(AccountSetupMode.setPassword, hasAddress: true);
final cubit = setUpAs(AccountSetupMode.setPassword);
expect(cubit.state, at(AccountSetupStep.address));
});
test('asks GitHub people to sign in with GitHub again where theirs is '
'too old, keeping the code for after', () async {
await auth.switchToGitHub();
gateway
..gitHubPeople.add('github-person')
..staleGitHubSignIns.add('github-person');
test('refuses a password to a signed-in person without an address, '
'whatever address they type: a code mailed to their own is the only '
'proof (ADR 0020, D36)', () async {
// Someone with no account at an address, as GitHub alone left them.
await auth.useSession(const SessionGrant('person-1', 'session-1'));
final cubit = setUpAs(AccountSetupMode.setPassword)
..addressEntered('gina@example.org');
await cubit.passwordEntered('correct horse', 'correct horse');
cubit.phraseWrittenDown();
await cubit.phraseChecked(wordsAsked(cubit.state));
cubit.handleEntered('gina');
final code = gateway.codeFor('gina@example.org');
await cubit.mailCodeEntered(code);
await cubit.mailCodeEntered(gateway.codeFor('gina@example.org'));
expect(
cubit.state,
at(AccountSetupStep.mailCode, problem: PasswordProblem.signInAgain),
at(AccountSetupStep.mailCode, problem: PasswordProblem.wrongCredentials),
);
gateway.staleGitHubSignIns.clear();
await cubit.mailCodeEntered(code);
expect(cubit.state, at(AccountSetupStep.authenticator));
expect(gateway.accounts, isEmpty);
expect(gateway.handles, isEmpty);
});
test("refuses another account's address to a signed-in person, back at "
'the address', () async {
test('refuses another address than their own to a signed-in person, back '
'at the address', () async {
gateway.addAccount(
'anna@example.org',
password: 'correct horse',
crypto: crypto,
);
await auth.switchToGitHub();
final person = await signedInWithAddress('ben@example.org');
final cubit = setUpAs(AccountSetupMode.setPassword)
..addressEntered('anna@example.org');
await cubit.passwordEntered('another horse', 'another horse');
@ -368,8 +358,9 @@ void main() {
expect(
cubit.state,
at(AccountSetupStep.address, problem: PasswordProblem.addressTaken),
at(AccountSetupStep.address, problem: PasswordProblem.otherAddressLinked),
);
expect(gateway.accountOf(person).password, isNull);
});
group("finishing an account's reset", () {

4
packages/halkyon_app/test/password/bloc/unexpected_failures_test.dart
View file

@ -34,7 +34,7 @@ class _BrokenCrypto() extends FakeAccountCrypto {
/// A gateway failing as nothing above expects.
class _BrokenGateway(super.auth) extends FakePasswordGateway {
@override
Future<({bool offered, DateTime? gitHubEnds})> offers() async =>
Future<bool> offers() async =>
throw const FormatException('an answer no client reads');
}
@ -135,7 +135,7 @@ void main() {
final gateway = _BrokenGateway(auth);
final broken = repository(gateway: gateway, crypto: FakeAccountCrypto());
addTearDown(broken.dispose);
await auth.switchToGitHub();
auth.signIn('ada');
final section = AccountSecurityCubit(broken);
addTearDown(section.close);
final states = await statesOf(section, section.load);

27
packages/halkyon_app/test/password/data/password_repository_test.dart
View file

@ -61,7 +61,7 @@ void main() {
);
addTearDown(locked.dispose);
await auth.switchToGitHub();
auth.signIn('ada');
await settle();
await auth.signOut();
await settle();
@ -367,13 +367,15 @@ void main() {
});
group('signed in', () {
test('one who signs in with GitHub given a password keeps the account, '
'the keys and the address kept (ADR 0017, D2)', () async {
await auth.switchToGitHub();
test('one with an address and no password given one keeps the account, '
'a code mailed there proving them, the keys and the address '
'kept', () async {
final dana = gateway.addAddressOnly('dana@example.org').person;
auth.signIn(dana);
final request = await passwords.sendCode(
'dana@example.org',
language: 'en',
purpose: MailCodePurpose.signUp,
purpose: MailCodePurpose.firstPassword,
);
final material = await passwords.makePassword('her password');
@ -396,13 +398,10 @@ void main() {
handle: 'dana',
);
expect(
auth.status,
const SignedIn(authUserId: 'github-person', isIdentified: true),
);
expect(keys.kept['github-person'], material.keys);
expect(addresses.addresses['github-person'], 'dana@example.org');
expect(gateway.handles['github-person'], 'dana');
expect(auth.status, SignedIn(authUserId: dana, isIdentified: true));
expect(keys.kept[dana], material.keys);
expect(addresses.addresses[dana], 'dana@example.org');
expect(gateway.handles[dana], 'dana');
});
test('someone signed up anew gets new keys, never the keys kept on the '
@ -416,8 +415,8 @@ void main() {
test("keeps only the signed-in person's keys: another signing in, or "
'signing out, takes the others away', () async {
await auth.switchToGitHub();
await keys.keep('github-person', crypto.keysNumbered(1));
auth.signIn('ada');
await keys.keep('ada', crypto.keysNumbered(1));
await keys.keep('someone-else', crypto.keysNumbered(2));
await auth.signOut();

39
packages/halkyon_app/test/password/widget/password_sheets_test.dart
View file

@ -575,17 +575,36 @@ void main() {
await tester.pumpAndSettle();
}
testWidgets('offers one signed in with GitHub a password (ADR 0017, '
'D2)', (tester) async {
await gateway.switchToGitHub();
/// Signs in the person of an account at gina@example.org without a
/// password, as codes by mail left accounts; their id.
String signInGina() {
final person = dependencies.passwordGateway
.addAddressOnly('gina@example.org')
.person;
gateway.signIn(person);
return person;
}
testWidgets('offers a password to one signed in with an address and '
'none yet', (tester) async {
signInGina();
await show(tester);
expect(find.text('Set up a password'), findsOneWidget);
expect(find.text('Change password'), findsNothing);
});
/// Sets up a password for the GitHub account signed in, up to the step
/// after the phrase.
testWidgets('offers none to one without an address: a code mailed to '
'their own is the only proof (ADR 0020, D36)', (tester) async {
gateway.signIn('ada');
await show(tester);
expect(find.text('Set up a password'), findsNothing);
expect(find.text('Change password'), findsNothing);
});
/// Sets up a password for the person signed in, up to the step after
/// the phrase, typing the address the device doesn't know.
Future<void> setUpPassword(WidgetTester tester) async {
await show(tester);
await tester.tap(find.text('Set up a password'));
@ -600,10 +619,9 @@ void main() {
await tapButton(tester, 'Continue');
}
testWidgets('asks one signed in with GitHub without a handle for their '
'first with the password (ADR 0020, D28)', (tester) async {
await gateway.switchToGitHub();
final person = (gateway.status as SignedIn).authUserId;
testWidgets('asks one signed in without a handle for their first with '
'the password (ADR 0020, D28)', (tester) async {
final person = signInGina();
await setUpPassword(tester);
await tester.enterText(field('Handle'), 'gina');
@ -622,8 +640,7 @@ void main() {
});
testWidgets('asks no handle of one who has one', (tester) async {
await gateway.switchToGitHub();
final person = (gateway.status as SignedIn).authUserId;
final person = signInGina();
dependencies.passwordGateway.handles[person] = 'gina';
await setUpPassword(tester);

8
packages/halkyon_app/test/person/person_folders_test.dart
View file

@ -25,14 +25,14 @@ void main() {
test("opening a person's folder wipes everyone else's", () async {
await write('anonymous-1');
await write('github-1');
await write('person-1');
final folder = await folders.openOnly('github-1');
final folder = await folders.openOnly('person-1');
expect(await people(), ['github-1']);
expect(await people(), ['person-1']);
expect(
await File('${folder.path}/sync.sqlite').readAsString(),
'github-1',
'person-1',
reason: "the person's own data stays",
);
});

8
packages/halkyon_app/test/simplelogin/bloc/simplelogin_cubit_test.dart
View file

@ -516,9 +516,9 @@ void main() {
group("SimpleLogin added to the account of the device's person", () {
test('a person without keys keeps those their device holds, and their '
'session, once the keys are set', () async {
await auth.switchToGitHub();
auth.signIn('ada');
final deviceKeys = crypto.keysNumbered(1);
keys.kept['github-person'] = deviceKeys;
keys.kept['ada'] = deviceKeys;
final cubit = cubitFor(link: true);
await cubit.started();
@ -529,9 +529,9 @@ void main() {
expect(cubit.state, at(SimpleLoginStep.done));
expect(
auth.status,
const SignedIn(authUserId: 'github-person', isIdentified: true),
const SignedIn(authUserId: 'ada', isIdentified: true),
);
expect(keys.kept, {'github-person': deviceKeys});
expect(keys.kept, {'ada': deviceKeys});
expect(auth.usedSessions, isEmpty);
});

3
packages/halkyon_app/test/simplelogin/data/serverpod_simplelogin_gateway_test.dart
View file

@ -46,7 +46,7 @@ final class _Instance() {
);
/// The ways into the device's person's account.
SignInWays ways = SignInWays(gitHub: false, email: false);
SignInWays ways = SignInWays(email: false);
/// When a reset asked for takes effect.
static final resetAt = DateTime.utc(2026, 10, 27, 12);
@ -334,7 +334,6 @@ void main() {
test("says when a reset of the device's person's keys takes effect, only "
'for keys their password opens alone', () async {
instance.ways = SignInWays(
gitHub: false,
email: false,
simpleLogin: true,
keys: true,

20
packages/halkyon_app/test/simplelogin/data/simplelogin_repository_test.dart
View file

@ -667,8 +667,8 @@ void main() {
});
test('keeps no keys the device holds for someone else', () async {
await auth.switchToGitHub();
keys.kept['github-person'] = crypto.keysNumbered(1);
auth.signIn('ada');
keys.kept['ada'] = crypto.keysNumbered(1);
final made = await simpleLogin.makeKeys(password, into: account);
@ -736,14 +736,12 @@ void main() {
});
group("SimpleLogin added to the device's person's account", () {
setUp(() async {
await auth.switchToGitHub();
});
setUp(() => auth.signIn('ada'));
test('the person keeps the keys their device holds, which encrypt their '
'private studysets (ADR 0017, 9)', () async {
final deviceKeys = crypto.keysNumbered(1);
keys.kept['github-person'] = deviceKeys;
keys.kept['ada'] = deviceKeys;
final account =
(await simpleLogin.signIn(link: true))! as SimpleLoginAccount;
@ -763,11 +761,11 @@ void main() {
expect(auth.usedSessions, isEmpty);
expect(
auth.status,
const SignedIn(authUserId: 'github-person', isIdentified: true),
const SignedIn(authUserId: 'ada', isIdentified: true),
);
expect(keys.kept, {'github-person': deviceKeys});
expect(gateway.linked, {'simplelogin-anna': 'github-person'});
expect(gateway.accounts['github-person']!.keys, made.setup);
expect(keys.kept, {'ada': deviceKeys});
expect(gateway.linked, {'simplelogin-anna': 'ada'});
expect(gateway.accounts['ada']!.keys, made.setup);
});
test("is refused a SimpleLogin account that is someone else's", () async {
@ -839,7 +837,7 @@ void main() {
});
test('changes once SimpleLogin is added, and with the person', () async {
await auth.switchToGitHub();
auth.signIn('ada');
var changes = 0;
final following = simpleLogin.changes.listen((_) => changes++);
addTearDown(following.cancel);