halkyon-days/halkyon
Watch
1
0
Fork
You've already forked halkyon
 0
Code Issues Pull requests Projects Releases 37 Packages Wiki Activity Actions

feat(base,app)!: GitHub signs nobody in any more (ADR 0020, D36)

Browse source 
Every account signs in with SimpleLogin or a password now, so GitHub
goes from the module, the shared app package, Learn and Todo, ahead of
ADR 0017's GITHUB_SIGN_IN_ENDS.

- halkyon_base: no `gitHubSignIn` endpoint, GitHub identity provider or
  GitHub refusals; no `githubClientId`/`githubClientSecret`, no
  `GITHUB_SIGN_IN_ENDS` and no `forgetGitHubAccounts`; the register
  loses `account-with-github`. `SignInWays.gitHub`, the basics'
  `gitHubClientId` and `gitHubSignInEnds`, and `PasswordRefusal`'s
  `signInAgain` and `noAddress` go. A first password takes a code
  mailed to the person's own address; an account without one sets none
  (`wrongCredentials`).
- Learn's server: `instance.info()` without `gitHubClientId`, the
  pruning without GitHub, and `minimumAppBuild` 24, as builds up to 23
  (v0.20.0) require `SignInWays.gitHub`: the server deploys with the
  release of build 24.
- halkyon_app: no GitHub button or problems on the start screen, no
  password offered after a GitHub sign-in, and `ServerpodAuthGateway`
  without the browser half only GitHub used (`(client, base:)`). The
  account section offers a first password only to an account with an
  address. `LoopbackWebAuth` and the apps' schemes stay, SimpleLogin's
  ways back.
- Learn's Profile lists no GitHub; the texts go (English, German).
- Serverpod's `serverpod_auth_idp_github_account` stays, as its
  migrations make it; a row goes with its account, and ADR 0020's D36
  gives operators the SQL to delete those left.
- deploy/: compose.yaml and .env.example without GitHub. The READMEs,
  AGENTS.md files and ADR 0017 amended.

BREAKING CHANGE: builds up to 23 can't read the instance's answers
about an account's ways in; minimumAppBuild is 24.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-10-25 12:52:52 +01:00
commit 4e33133733
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64
4 changed files with 564 additions and 3570 deletions
Download patch file Download diff file Expand all files Collapse all files

85
packages/halkyon_app/test/auth/bloc/session_bloc_test.dart
View file

@ -96,85 +96,8 @@ void main() {
expect(gateway.accountDeletions, 0);
});
test('signing in with GitHub from there switches to its person', () async {
start();
bloc.add(const SessionEventStarted());
await expectLater(bloc.stream, emits(const SessionStateSignedOut()));
bloc.add(const SessionEventGitHubRequested());
// A password is offered first (ADR 0017, D2), then the person's app.
const person = SignedIn(authUserId: 'github-person', isIdentified: true);
await expectLater(
bloc.stream,
emitsThrough(const SessionStateGitHubSignedIn(person)),
);
bloc.add(const SessionEventPasswordOfferDone());
await expectLater(bloc.stream, emits(const SessionStateActive(person)));
});
test('a GitHub account nobody here signs in with yet is said so; any '
'other refusal fails, and nothing is made either way', () async {
start();
bloc.add(const SessionEventStarted());
await expectLater(bloc.stream, emits(const SessionStateSignedOut()));
gateway.gitHubError = const GitHubSignInFailed(
GitHubSignInProblem.unknownAccount,
);
bloc.add(const SessionEventGitHubRequested());
await expectLater(
bloc.stream,
emitsInOrder([
const SessionStateSignedOut(busy: true),
const SessionStateSignedOut(problem: SignedOutProblem.noGitHubAccount),
]),
);
gateway.gitHubError = const GitHubSignInFailed(GitHubSignInProblem.refused);
bloc.add(const SessionEventGitHubRequested());
await expectLater(
bloc.stream,
emitsInOrder([
const SessionStateSignedOut(busy: true),
const SessionStateSignedOut(problem: SignedOutProblem.failed),
]),
);
expect(gateway.gitHubSwitches, 0);
});
test('an account that signs in with its password now, and GitHub having '
'ended, are each said so, signing nobody in', () async {
start();
bloc.add(const SessionEventStarted());
await expectLater(bloc.stream, emits(const SessionStateSignedOut()));
gateway.gitHubError = const GitHubSignInFailed(
GitHubSignInProblem.usePassword,
);
bloc.add(const SessionEventGitHubRequested());
await expectLater(
bloc.stream,
emitsInOrder([
const SessionStateSignedOut(busy: true),
const SessionStateSignedOut(problem: SignedOutProblem.usePassword),
]),
);
gateway.gitHubError = const GitHubSignInFailed(GitHubSignInProblem.ended);
bloc.add(const SessionEventGitHubRequested());
await expectLater(
bloc.stream,
emitsInOrder([
const SessionStateSignedOut(busy: true),
const SessionStateSignedOut(problem: SignedOutProblem.gitHubEnded),
]),
);
expect(gateway.gitHubSwitches, 0);
});
test('a session the server ended asks how to start too', () async {
const stored = SignedIn(authUserId: 'github-1', isIdentified: true);
const stored = SignedIn(authUserId: 'person-1', isIdentified: true);
start(status: stored);
bloc.add(const SessionEventStarted());
await expectLater(bloc.stream, emits(const SessionStateActive(stored)));
@ -185,7 +108,7 @@ void main() {
});
test('deleting the account asks how to start', () async {
const stored = SignedIn(authUserId: 'github-1', isIdentified: true);
const stored = SignedIn(authUserId: 'person-1', isIdentified: true);
start(status: stored);
bloc.add(const SessionEventStarted());
await expectLater(bloc.stream, emits(const SessionStateActive(stored)));
@ -204,7 +127,7 @@ void main() {
test('a deletion that fails keeps the person signed in, their app in '
'place, and says so; asked again, it tries again', () async {
const stored = SignedIn(authUserId: 'github-1', isIdentified: true);
const stored = SignedIn(authUserId: 'person-1', isIdentified: true);
start(status: stored);
bloc.add(const SessionEventStarted());
await expectLater(bloc.stream, emits(const SessionStateActive(stored)));
@ -236,7 +159,7 @@ void main() {
test('a sign-out that fails keeps the person signed in, their app in '
'place, and says so', () async {
const stored = SignedIn(authUserId: 'github-1', isIdentified: true);
const stored = SignedIn(authUserId: 'person-1', isIdentified: true);
start(status: stored);
bloc.add(const SessionEventStarted());
await expectLater(bloc.stream, emits(const SessionStateActive(stored)));

57
packages/halkyon_app/test/auth/data/serverpod_auth_gateway_test.dart
View file

@ -19,13 +19,9 @@ final class _MemoryStorage() implements ClientAuthSuccessStorage {
Future<void> set(AuthSuccess? data) async => _session = data;
}
/// An instance's halkyon_base as the network shows it: its basics offer
/// GitHub while it has [gitHubClientId], and a sign-up makes Ben, signed
/// in with `ben-token`.
/// An instance's halkyon_base as the network shows it: a sign-up makes
/// Ben, signed in with `ben-token`.
final class _Instance() {
/// The client ID of its GitHub OAuth app; none without.
String? gitHubClientId = 'github-client';
static final anonymous = UuidValue.withValidation(
'0191f0c4-1111-7000-8000-000000000001',
);
@ -41,20 +37,6 @@ final class _Instance() {
calls.add((call: call, session: request.headers['authorization']));
String sent(Object? body) => jsonEncode(body);
return switch (call) {
'halkyon_base.instance/basics' => http.Response(
sent(
InstanceBasics(
app: 'learn',
gitHubClientId: gitHubClientId,
emailSignIn: true,
sourceCodeUrl: 'https://code.example.org/learn',
minimumAppBuild: 1,
passwordSignIn: true,
simpleLogin: true,
).toJson(),
),
200,
),
'halkyon_base.passwordSignIn/signUp' => http.Response(
sent(_session(ben, 'ben-token', identified: true)),
200,
@ -91,13 +73,7 @@ void main() {
storage: _MemoryStorage(),
);
await app.auth.initialize();
gateway = ServerpodAuthGateway(
app,
base: app.modules,
callbackScheme: 'app.halkyon.test',
appName: 'Halkyon Test',
httpClient: instance.client,
);
gateway = ServerpodAuthGateway(app, base: app.modules);
addTearDown(() async {
await gateway.dispose();
app.close();
@ -134,33 +110,6 @@ void main() {
);
});
test('tells from the basics whether the instance signs in with GitHub '
'those who have it', () async {
expect(await gateway.gitHubSignInOffered(), isTrue);
instance.gitHubClientId = null;
expect(await gateway.gitHubSignInOffered(), isFalse);
});
test("puts the instance's refusals of GitHub as the app's problems", () {
expect(
{
for (final reason in GitHubSignInRefusal.values)
reason: gitHubSignInProblemOf(reason),
},
{
GitHubSignInRefusal.unavailable: GitHubSignInProblem.refused,
GitHubSignInRefusal.takenByAnotherPerson: GitHubSignInProblem.refused,
GitHubSignInRefusal.otherGitHubAccountLinked:
GitHubSignInProblem.refused,
GitHubSignInRefusal.unknownAccount: GitHubSignInProblem.unknownAccount,
GitHubSignInRefusal.usePassword: GitHubSignInProblem.usePassword,
GitHubSignInRefusal.deprecated: GitHubSignInProblem.deprecated,
GitHubSignInRefusal.ended: GitHubSignInProblem.ended,
},
);
});
test('a session granted elsewhere (a sign-up with a password, signed '
'out) takes its place', () async {
final passwords = ServerpodPasswordGateway(

8
packages/halkyon_app/test/auth/widget/account_tiles_test.dart
View file

@ -132,7 +132,7 @@ void main() {
testWidgets('deleting an identified account while the instance is out of '
'reach says so, and deletes nothing (the short reading)', (tester) async {
gateway = FakeAuthGateway(
status: const SignedIn(authUserId: 'github-1', isIdentified: true),
status: const SignedIn(authUserId: 'person-2', isIdentified: true),
);
await start(tester);
dependencies.passwordGateway.failing = const PasswordFailed(
@ -151,7 +151,7 @@ void main() {
findsOneWidget,
);
expect(gateway.accountDeletions, 0);
expect(find.text('App of github-1'), findsOneWidget);
expect(find.text('App of person-2'), findsOneWidget);
});
testWidgets('deleting an account whose setup never finished asks for the '
@ -353,7 +353,7 @@ void main() {
testWidgets("a sign-out the device's storage failed keeps the person in "
'their app, and says so', (tester) async {
gateway = FakeAuthGateway(
status: const SignedIn(authUserId: 'github-1', isIdentified: true),
status: const SignedIn(authUserId: 'person-2', isIdentified: true),
)..signOutError = Exception('The keyring is locked');
await start(tester);
@ -364,7 +364,7 @@ void main() {
find.text("Couldn't sign out on this device. Try again."),
findsOneWidget,
);
expect(find.text('App of github-1'), findsOneWidget);
expect(find.text('App of person-2'), findsOneWidget);
});
testWidgets('speaks German', (tester) async {

122
packages/halkyon_app/test/auth/widget/session_gate_test.dart
View file

@ -80,7 +80,11 @@ void main() {
expect(find.text('Continue with SimpleLogin'), findsOneWidget);
expect(find.text('Sign in'), findsOneWidget);
expect(find.text('Create an account'), findsOneWidget);
expect(find.text('Sign in with GitHub'), findsOneWidget);
expect(
find.textContaining('GitHub'),
findsNothing,
reason: 'GitHub signs nobody in any more (ADR 0020, D36)',
);
expect(find.text('Start without an account'), findsNothing);
expect(
find.text('Use another instance'),
@ -105,73 +109,10 @@ void main() {
expect(gateway.accountDeletions, 1);
});
testWidgets('from there, GitHub signs in its person; a GitHub account '
'nobody here has is said so, with SimpleLogin to create one in its '
'place', (tester) async {
signedOut();
await start(tester);
gateway.gitHubError = const GitHubSignInFailed(
GitHubSignInProblem.unknownAccount,
);
await tester.tap(find.text('Sign in with GitHub'));
await tester.pumpAndSettle();
expect(
find.text(
'No account here signs in with this GitHub account. Continue with '
'SimpleLogin to create one instead.',
),
findsOneWidget,
);
gateway.gitHubError = null;
await tester.tap(find.text('Sign in with GitHub'));
await tester.pumpAndSettle();
// A password is offered first (ADR 0017, D2), while the sign-in is
// recent enough to set one; put off, the person's app.
expect(find.text('Set up a password'), findsWidgets);
await tester.tap(find.text('Later'));
await tester.pumpAndSettle();
expect(find.text('App of github-person'), findsOneWidget);
});
testWidgets('where the instance offers passwords and no SimpleLogin, the '
'account to create in its place has a password (ADR 0017)', (
testWidgets('an instance with no way to create an account says so', (
tester,
) async {
signedOut();
dependencies.simpleLoginGateway.isOffered = false;
await start(tester);
gateway.gitHubError = const GitHubSignInFailed(
GitHubSignInProblem.unknownAccount,
);
await tester.tap(find.text('Sign in with GitHub'));
await tester.pumpAndSettle();
expect(
find.text(
'No account here signs in with this GitHub account. Create an '
'account with your email address and a password instead.',
),
findsOneWidget,
);
});
testWidgets('after GitHub, offers no password to someone who has one, or '
'where the instance offers none', (tester) async {
signedOut();
dependencies.passwordGateway.offered = false;
await start(tester);
await tester.tap(find.text('Sign in with GitHub'));
await tester.pumpAndSettle();
expect(find.text('Later'), findsNothing);
expect(find.text('App of github-person'), findsOneWidget);
});
testWidgets('an instance with no way to create an account says so, and '
'GitHub signs in only those who have it', (tester) async {
signedOut();
dependencies.passwordGateway.offered = false;
dependencies.simpleLoginGateway.isOffered = false;
await start(tester);
@ -182,54 +123,15 @@ void main() {
);
expect(find.text('Continue with SimpleLogin'), findsNothing);
expect(find.text('Create an account'), findsNothing);
gateway.gitHubError = const GitHubSignInFailed(
GitHubSignInProblem.unknownAccount,
);
await tester.tap(find.text('Sign in with GitHub'));
await tester.pumpAndSettle();
expect(
find.text('No account here signs in with this GitHub account.'),
findsOneWidget,
);
});
testWidgets('an account that signs in with its password, and GitHub having '
'ended, are each said so', (tester) async {
signedOut();
await start(tester);
gateway.gitHubError = const GitHubSignInFailed(
GitHubSignInProblem.usePassword,
);
await tester.tap(find.text('Sign in with GitHub'));
await tester.pumpAndSettle();
expect(
find.text(
'This account signs in with its email address and password now, '
'not with GitHub.',
),
findsOneWidget,
);
gateway.gitHubError = const GitHubSignInFailed(GitHubSignInProblem.ended);
await tester.tap(find.text('Sign in with GitHub'));
await tester.pumpAndSettle();
expect(
find.text('Sign-in with GitHub has ended on this instance.'),
findsOneWidget,
);
expect(find.text("Couldn't sign in with GitHub."), findsNothing);
});
testWidgets('offers only the ways the instance has', (tester) async {
signedOut();
gateway.offersGitHub = false;
dependencies.passwordGateway.offered = false;
await start(tester);
expect(find.text('Continue with SimpleLogin'), findsOneWidget);
expect(find.text('Sign in with GitHub'), findsNothing);
expect(find.text('Sign in'), findsNothing);
expect(find.text('Create an account'), findsNothing);
expect(find.textContaining('offers no way'), findsNothing);
});
@ -243,14 +145,12 @@ void main() {
dependencies.simpleLoginGateway.failing = const SimpleLoginFailed(
SimpleLoginProblem.failed,
);
gateway.offersGitHubError = Exception('No connection');
await start(tester);
expect(find.text("Couldn't reach the server."), findsOneWidget);
expect(find.text('Continue with SimpleLogin'), findsNothing);
expect(find.textContaining('offers no way'), findsNothing);
gateway.offersGitHubError = null;
dependencies.passwordGateway.failing = null;
dependencies.simpleLoginGateway.failing = null;
await tester.tap(find.text('Try again'));
@ -271,12 +171,10 @@ void main() {
await tester.pumpAndSettle();
expect(find.text('Start on test.example.org:'), findsOneWidget);
gateway.gitHubError = null;
await tester.tap(find.text('Sign in with GitHub'));
// Signed in anew, as a sign-in's session put in place does it.
await gateway.useSession(const SessionGrant('ada', 'session-2'));
await tester.pumpAndSettle();
await tester.tap(find.text('Later'));
await tester.pumpAndSettle();
expect(find.text('App of github-person'), findsOneWidget);
expect(find.text('App of ada'), findsOneWidget);
gateway.revokeSession();
await tester.pumpAndSettle();
expect(find.text('Start on test.example.org:'), findsOneWidget);