feat(base,app)!: GitHub signs nobody in any more (ADR 0020, D36)
Every account signs in with SimpleLogin or a password now, so GitHub goes from the module, the shared app package, Learn and Todo, ahead of ADR 0017's GITHUB_SIGN_IN_ENDS. - halkyon_base: no `gitHubSignIn` endpoint, GitHub identity provider or GitHub refusals; no `githubClientId`/`githubClientSecret`, no `GITHUB_SIGN_IN_ENDS` and no `forgetGitHubAccounts`; the register loses `account-with-github`. `SignInWays.gitHub`, the basics' `gitHubClientId` and `gitHubSignInEnds`, and `PasswordRefusal`'s `signInAgain` and `noAddress` go. A first password takes a code mailed to the person's own address; an account without one sets none (`wrongCredentials`). - Learn's server: `instance.info()` without `gitHubClientId`, the pruning without GitHub, and `minimumAppBuild` 24, as builds up to 23 (v0.20.0) require `SignInWays.gitHub`: the server deploys with the release of build 24. - halkyon_app: no GitHub button or problems on the start screen, no password offered after a GitHub sign-in, and `ServerpodAuthGateway` without the browser half only GitHub used (`(client, base:)`). The account section offers a first password only to an account with an address. `LoopbackWebAuth` and the apps' schemes stay, SimpleLogin's ways back. - Learn's Profile lists no GitHub; the texts go (English, German). - Serverpod's `serverpod_auth_idp_github_account` stays, as its migrations make it; a row goes with its account, and ADR 0020's D36 gives operators the SQL to delete those left. - deploy/: compose.yaml and .env.example without GitHub. The READMEs, AGENTS.md files and ADR 0017 amended. BREAKING CHANGE: builds up to 23 can't read the instance's answers about an account's ways in; minimumAppBuild is 24. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
parent
ab5b7cd015
commit
4e33133733
GPG key ID:
07F6FCF405488B64
9 changed files with 564 additions and 3570 deletions
|
|
@ -87,6 +87,7 @@ void main() {
|
|||
createdAt: DateTime.now().toUtc(),
|
||||
),
|
||||
]);
|
||||
// A GitHub ID left from before (ADR 0020, D36) goes too.
|
||||
await GitHubAccount.db.insertRow(
|
||||
session,
|
||||
GitHubAccount(userIdentifier: '4711', authUserId: anna),
|
||||
|
|
|
|||
|
|
@ -94,9 +94,6 @@ void main() {
|
|||
/// Identified, signing in with ben@example.org.
|
||||
late UuidValue ben;
|
||||
|
||||
/// Identified, signing in with GitHub.
|
||||
late UuidValue carla;
|
||||
|
||||
setUp(() async {
|
||||
useBase(sessionBuilder);
|
||||
session = sessionBuilder.build();
|
||||
|
|
@ -123,19 +120,6 @@ void main() {
|
|||
ben,
|
||||
scopes: {identified},
|
||||
);
|
||||
carla = (await AuthServices.instance.authUsers.create(
|
||||
session,
|
||||
scopes: {identified},
|
||||
)).id;
|
||||
await GitHubAccount.db.insertRow(
|
||||
session,
|
||||
GitHubAccount(userIdentifier: '1001', authUserId: carla),
|
||||
);
|
||||
await signInNewDevice(
|
||||
session,
|
||||
carla,
|
||||
scopes: {identified},
|
||||
);
|
||||
});
|
||||
tearDown(() async {
|
||||
EmailCodes.of(session.serverpod).mailer = null;
|
||||
|
|
@ -179,7 +163,7 @@ void main() {
|
|||
addressHash(session.serverpod, 'anna@example.org'),
|
||||
);
|
||||
expect(await _addressesOf(session, anna), isEmpty);
|
||||
expect(await ServerSideSession.db.count(session), 3);
|
||||
expect(await ServerSideSession.db.count(session), 2);
|
||||
expect(await EmailCodeRequest.db.count(session), 0);
|
||||
});
|
||||
|
||||
|
|
|
|||
|
|
@ -1,315 +0,0 @@
|
|||
import 'package:clock/clock.dart';
|
||||
import 'package:halkyon_base_server/base.dart';
|
||||
import 'package:serverpod/serverpod.dart';
|
||||
import 'package:serverpod_auth_idp_server/core.dart';
|
||||
import 'package:test/test.dart';
|
||||
|
||||
import '../support/fixtures.dart';
|
||||
import '../support/password_device.dart';
|
||||
import '../test_tools/serverpod_test_tools.dart';
|
||||
|
||||
void main() {
|
||||
withServerpod('GitHub sign-in', (sessionBuilder, endpoints) {
|
||||
late Session session;
|
||||
|
||||
/// Identified, with the GitHub account 1001.
|
||||
late UuidValue ben;
|
||||
|
||||
setUp(() async {
|
||||
useBase(sessionBuilder);
|
||||
session = sessionBuilder.build();
|
||||
ben = (await AuthServices.instance.authUsers.create(
|
||||
session,
|
||||
scopes: {identified},
|
||||
)).id;
|
||||
await GitHubAccount.db.insertRow(
|
||||
session,
|
||||
GitHubAccount(userIdentifier: '1001', authUserId: ben),
|
||||
);
|
||||
});
|
||||
|
||||
TestSessionBuilder notSignedIn() => sessionBuilder.copyWith(
|
||||
authentication: AuthenticationOverride.unauthenticated(),
|
||||
);
|
||||
|
||||
group('refuses', () {
|
||||
test('signing in on an instance without a GitHub OAuth app', () async {
|
||||
// The test configuration has no githubClientId/githubClientSecret.
|
||||
await expectLater(
|
||||
endpoints.gitHubSignIn.signIn(
|
||||
notSignedIn(),
|
||||
code: 'code',
|
||||
codeVerifier: 'verifier',
|
||||
redirectUri: _redirectUri,
|
||||
),
|
||||
throwsA(_refusal(GitHubSignInRefusal.unavailable)),
|
||||
);
|
||||
});
|
||||
|
||||
test('signing in with a GitHub account nobody has; nobody is '
|
||||
'created', () async {
|
||||
final people = await AuthUser.db.count(session);
|
||||
|
||||
// The endpoint refuses it (unknownAccount): nobody has it.
|
||||
expect(
|
||||
await accountWithGitHub(session, gitHubUserId: '3003'),
|
||||
isNull,
|
||||
);
|
||||
|
||||
expect(await AuthUser.db.count(session), people);
|
||||
});
|
||||
});
|
||||
|
||||
test('adds GitHub to nobody: the module has no way to (ADR 0020, '
|
||||
'D25)', () {
|
||||
final pod = session.serverpod;
|
||||
|
||||
expect(pod.endpoints.getConnectorByName('gitHubUpgrade'), isNull);
|
||||
expect(pod.endpoints.getConnectorByName('gitHubSignIn'), isNotNull);
|
||||
});
|
||||
|
||||
test('signing in with a known GitHub account starts a session for that '
|
||||
'person', () async {
|
||||
final account = await accountWithGitHub(session, gitHubUserId: '1001');
|
||||
final authSuccess = await issueSession(
|
||||
session,
|
||||
account!,
|
||||
method: gitHubMethod,
|
||||
);
|
||||
|
||||
expect(authSuccess.authUserId, ben);
|
||||
expect(authSuccess.scopeNames, contains(identified.name));
|
||||
});
|
||||
|
||||
test('tells the app that this instance has no GitHub OAuth app', () async {
|
||||
final info = await endpoints.instance.basics(notSignedIn());
|
||||
|
||||
expect(info.gitHubClientId, isNull);
|
||||
});
|
||||
|
||||
group('deprecated (ADR 0017)', () {
|
||||
tearDown(() {
|
||||
usePasswordKeys(session.serverpod, null);
|
||||
EmailCodes.of(session.serverpod).mailer = null;
|
||||
useGitHubSignInEnds(session.serverpod, null);
|
||||
});
|
||||
|
||||
test('still signs in those who have it where people sign in with a '
|
||||
'password', () async {
|
||||
usePasswordKeys(session.serverpod, testPasswordKeys);
|
||||
EmailCodes.of(session.serverpod).mailer = const LogCodeMailer();
|
||||
|
||||
expect(await gitHubAccountToSignIn(session, '1001'), ben);
|
||||
});
|
||||
|
||||
test('signs nobody in from the day it ends, after '
|
||||
'which pruning forgets every GitHub ID', () async {
|
||||
final ends = DateTime.utc(2027, 1, 22);
|
||||
useGitHubSignInEnds(session.serverpod, ends);
|
||||
|
||||
expect(
|
||||
await forgetGitHubAccounts(
|
||||
session,
|
||||
now: ends.subtract(const Duration(seconds: 1)),
|
||||
),
|
||||
0,
|
||||
);
|
||||
await withClock(Clock.fixed(ends), () async {
|
||||
await expectLater(
|
||||
endpoints.gitHubSignIn.signIn(
|
||||
notSignedIn(),
|
||||
code: 'code',
|
||||
codeVerifier: 'verifier',
|
||||
redirectUri: _redirectUri,
|
||||
),
|
||||
throwsA(_refusal(GitHubSignInRefusal.ended)),
|
||||
);
|
||||
});
|
||||
// For 30 days after, nothing goes: a date set wrong can be put
|
||||
// right meanwhile.
|
||||
expect(
|
||||
await forgetGitHubAccounts(
|
||||
session,
|
||||
now: ends.add(
|
||||
gitHubAccountsKeptAfterEnd - const Duration(minutes: 1),
|
||||
),
|
||||
),
|
||||
0,
|
||||
);
|
||||
expect(await AuthUser.db.findById(session, ben), isNotNull);
|
||||
expect(await GitHubAccount.db.count(session), 1);
|
||||
expect(
|
||||
await forgetGitHubAccounts(
|
||||
session,
|
||||
now: ends.add(gitHubAccountsKeptAfterEnd),
|
||||
),
|
||||
1,
|
||||
);
|
||||
expect(await GitHubAccount.db.count(session), 0);
|
||||
// Ben signed in with GitHub alone and never set a password up: his
|
||||
// account goes with it (the full reading's M1), no way in left.
|
||||
expect(await AuthUser.db.findById(session, ben), isNull);
|
||||
});
|
||||
|
||||
test('a member forgets nothing and deletes nobody: it keeps no '
|
||||
"addresses, so everyone there would look GitHub's alone (the "
|
||||
"reading of the fixes' D1)", () async {
|
||||
useBase(
|
||||
sessionBuilder,
|
||||
accounts: MemberOfRegister(Uri.parse('http://learn.test:8082')),
|
||||
);
|
||||
final ends = DateTime.utc(2027, 1, 22);
|
||||
useGitHubSignInEnds(session.serverpod, ends);
|
||||
|
||||
expect(
|
||||
await forgetGitHubAccounts(
|
||||
session,
|
||||
now: ends.add(gitHubAccountsKeptAfterEnd),
|
||||
),
|
||||
0,
|
||||
);
|
||||
expect(await AuthUser.db.findById(session, ben), isNotNull);
|
||||
expect(await GitHubAccount.db.count(session), 1);
|
||||
});
|
||||
|
||||
test('a deletion that fails holds back nobody else, keeps that '
|
||||
"person's GitHub ID for the next run, and members are tried once "
|
||||
'for each account, not once per account deleted (the reading of '
|
||||
"the fixes' D2)", () async {
|
||||
final notifier = _HangingMembers();
|
||||
useBase(
|
||||
sessionBuilder,
|
||||
accounts: HoldsRegister(members: [Uri.parse('http://todo.test')]),
|
||||
deletePersonData: [
|
||||
(session, person, transaction) async {
|
||||
if (person == ben) {
|
||||
throw StateError('the host failed');
|
||||
}
|
||||
return null;
|
||||
},
|
||||
],
|
||||
);
|
||||
MemberNotifier.use(session.serverpod, notifier);
|
||||
addTearDown(() => MemberNotifier.use(session.serverpod, null));
|
||||
final dana = (await AuthServices.instance.authUsers.create(
|
||||
session,
|
||||
scopes: {identified},
|
||||
)).id;
|
||||
final emil = (await AuthServices.instance.authUsers.create(
|
||||
session,
|
||||
scopes: {identified},
|
||||
)).id;
|
||||
await GitHubAccount.db.insert(session, [
|
||||
GitHubAccount(userIdentifier: '4004', authUserId: dana),
|
||||
GitHubAccount(userIdentifier: '5005', authUserId: emil),
|
||||
]);
|
||||
final ends = DateTime.utc(2027, 1, 22);
|
||||
useGitHubSignInEnds(session.serverpod, ends);
|
||||
|
||||
await forgetGitHubAccounts(
|
||||
session,
|
||||
now: ends.add(gitHubAccountsKeptAfterEnd),
|
||||
);
|
||||
|
||||
expect(await AuthUser.db.findById(session, dana), isNull);
|
||||
expect(await AuthUser.db.findById(session, emil), isNull);
|
||||
expect(await AuthUser.db.findById(session, ben), isNotNull);
|
||||
expect(await _gitHubAccount(session, '1001'), isNotNull);
|
||||
expect(await GitHubAccount.db.count(session), 1);
|
||||
// Dana's notice and Emil's, each tried once.
|
||||
expect(notifier.told, hasLength(2));
|
||||
expect(notifier.told.toSet(), {dana, emil});
|
||||
});
|
||||
|
||||
test('an account deleted whose step afterwards failed counts as '
|
||||
'deleted, not as one to try again (the short reading)', () async {
|
||||
useBase(
|
||||
sessionBuilder,
|
||||
deletePersonData: [
|
||||
(session, person, transaction) => Future.value(
|
||||
() => Future<void>.error(StateError('cleaning up failed')),
|
||||
),
|
||||
],
|
||||
);
|
||||
final ends = DateTime.utc(2027, 1, 22);
|
||||
useGitHubSignInEnds(session.serverpod, ends);
|
||||
|
||||
final forgotten = await forgetGitHubAccounts(
|
||||
session,
|
||||
now: ends.add(gitHubAccountsKeptAfterEnd),
|
||||
);
|
||||
|
||||
expect(await AuthUser.db.findById(session, ben), isNull);
|
||||
expect(await GitHubAccount.db.count(session), 0);
|
||||
expect(forgotten, 1);
|
||||
});
|
||||
|
||||
test('at its end keeps the account of someone with an address too, '
|
||||
'forgetting only the GitHub ID', () async {
|
||||
final carl = (await AuthServices.instance.authUsers.create(
|
||||
session,
|
||||
scopes: {identified},
|
||||
)).id;
|
||||
await GitHubAccount.db.insertRow(
|
||||
session,
|
||||
GitHubAccount(userIdentifier: '3003', authUserId: carl),
|
||||
);
|
||||
await EmailIdentity.db.insertRow(
|
||||
session,
|
||||
EmailIdentity(
|
||||
authUserId: carl,
|
||||
addressHash: addressHash(session.serverpod, 'carl@example.org'),
|
||||
createdAt: DateTime.utc(2026, 10),
|
||||
),
|
||||
);
|
||||
final ends = DateTime.utc(2027, 1, 22);
|
||||
useGitHubSignInEnds(session.serverpod, ends);
|
||||
expect(
|
||||
await forgetGitHubAccounts(
|
||||
session,
|
||||
now: ends.add(gitHubAccountsKeptAfterEnd),
|
||||
),
|
||||
2,
|
||||
);
|
||||
expect(await AuthUser.db.findById(session, carl), isNotNull);
|
||||
expect(await AuthUser.db.findById(session, ben), isNull);
|
||||
expect(await GitHubAccount.db.count(session), 0);
|
||||
});
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
/// Members that never answer, noting each account they were told is gone.
|
||||
final class _HangingMembers implements MemberNotifier {
|
||||
final told = <UuidValue>[];
|
||||
|
||||
@override
|
||||
Future<bool> accountGone(Uri member, UuidValue account) async {
|
||||
told.add(account);
|
||||
return false;
|
||||
}
|
||||
|
||||
@override
|
||||
Future<bool> sessionsEnded(
|
||||
Uri member,
|
||||
UuidValue account, {
|
||||
required DateTime endedBefore,
|
||||
UuidValue? keepSession,
|
||||
}) async => false;
|
||||
}
|
||||
|
||||
/// The loopback callback the desktop apps use.
|
||||
const _redirectUri = 'http://127.0.0.1:43823/github-callback';
|
||||
|
||||
Matcher _refusal(GitHubSignInRefusal reason) =>
|
||||
isA<GitHubSignInRefusedException>().having(
|
||||
(exception) => exception.reason,
|
||||
'reason',
|
||||
reason,
|
||||
);
|
||||
|
||||
Future<GitHubAccount?> _gitHubAccount(Session session, String gitHubUserId) =>
|
||||
GitHubAccount.db.findFirstRow(
|
||||
session,
|
||||
where: (t) => t.userIdentifier.equals(gitHubUserId),
|
||||
);
|
||||
|
|
@ -1,4 +1,3 @@
|
|||
import 'package:clock/clock.dart';
|
||||
import 'package:halkyon_base_server/base.dart';
|
||||
import 'package:serverpod/serverpod.dart';
|
||||
import 'package:test/test.dart';
|
||||
|
|
@ -73,35 +72,10 @@ void main() {
|
|||
expect(basics.backupLocation, isNull);
|
||||
});
|
||||
|
||||
test('offers no GitHub sign-in without an OAuth app of its own', () {
|
||||
// The tests' passwords hold no githubClientId.
|
||||
expect(basics.gitHubClientId, isNull);
|
||||
});
|
||||
|
||||
test('says when GitHub sign-in ends, until it has', () async {
|
||||
test('serves no GitHub sign-in: GitHub signs nobody in any more (ADR '
|
||||
'0020, D36)', () {
|
||||
final pod = sessionBuilder.build().serverpod;
|
||||
final unauthenticated = sessionBuilder.copyWith(
|
||||
authentication: AuthenticationOverride.unauthenticated(),
|
||||
);
|
||||
addTearDown(() => useGitHubSignInEnds(pod, null));
|
||||
expect(basics.gitHubSignInEnds, isNull);
|
||||
|
||||
final ends = DateTime.utc(2027, 1, 22);
|
||||
useGitHubSignInEnds(pod, ends);
|
||||
expect(
|
||||
(await withClock(
|
||||
Clock.fixed(DateTime.utc(2026, 10, 22)),
|
||||
() => endpoints.instance.basics(unauthenticated),
|
||||
)).gitHubSignInEnds,
|
||||
ends,
|
||||
);
|
||||
expect(
|
||||
(await withClock(
|
||||
Clock.fixed(ends),
|
||||
() => endpoints.instance.basics(unauthenticated),
|
||||
)).gitHubSignInEnds,
|
||||
isNull,
|
||||
);
|
||||
expect(pod.server.endpoints.getConnectorByName('gitHubSignIn'), isNull);
|
||||
});
|
||||
|
||||
test('offers email sign-in only where it can mail codes', () async {
|
||||
|
|
|
|||
|
|
@ -491,130 +491,53 @@ void main() {
|
|||
});
|
||||
});
|
||||
|
||||
group('for someone who signs in with GitHub alone', () {
|
||||
setUp(() async {
|
||||
// Anna has no address here: GitHub is her only way in.
|
||||
await EmailIdentity.db.deleteWhere(
|
||||
session,
|
||||
where: (t) => t.authUserId.equals(anna),
|
||||
);
|
||||
await GitHubAccount.db.insertRow(
|
||||
session,
|
||||
GitHubAccount(userIdentifier: '1001', authUserId: anna),
|
||||
);
|
||||
});
|
||||
|
||||
TestSessionBuilder from(UuidValue device) => sessionBuilder.copyWith(
|
||||
authentication: AuthenticationOverride.authenticationInfo(
|
||||
anna.uuid,
|
||||
{identified},
|
||||
authId: device.uuid,
|
||||
),
|
||||
test('is refused to someone with only a GitHub ID left from before, '
|
||||
'even signed in with GitHub just now: GitHub signs nobody in '
|
||||
'any more, so it proves nothing (ADR 0020, D36)', () async {
|
||||
await EmailIdentity.db.deleteWhere(
|
||||
session,
|
||||
where: (t) => t.authUserId.equals(anna),
|
||||
);
|
||||
await GitHubAccount.db.insertRow(
|
||||
session,
|
||||
GitHubAccount(userIdentifier: '1001', authUserId: anna),
|
||||
);
|
||||
final code = await mailedCode('anna.new@example.org');
|
||||
final justNow = await atNow(
|
||||
() => signInNewDevice(session, anna, method: 'github'),
|
||||
);
|
||||
|
||||
test('is refused to a session not made by a GitHub sign-in of the '
|
||||
'last ten minutes, before the code is used, so a stolen '
|
||||
'session claims nothing (the fourth reading)', () async {
|
||||
final thief = await PasswordDevice.make(seed: 99);
|
||||
final code = await mailedCode('thief@example.org');
|
||||
final stale = await atNow(
|
||||
() => signInNewDevice(session, anna, method: gitHubMethod),
|
||||
);
|
||||
now = now.add(gitHubSignInFreshFor + const Duration(seconds: 1));
|
||||
for (final device in [annasPhone, stale]) {
|
||||
await expectLater(
|
||||
atNow(
|
||||
() => endpoints.password.set(
|
||||
from(device),
|
||||
setup: thief.setup(),
|
||||
request: code.request,
|
||||
code: code.code,
|
||||
await expectLater(
|
||||
atNow(
|
||||
() => endpoints.password.set(
|
||||
sessionBuilder.copyWith(
|
||||
authentication: AuthenticationOverride.authenticationInfo(
|
||||
anna.uuid,
|
||||
{identified},
|
||||
authId: justNow.uuid,
|
||||
),
|
||||
),
|
||||
refused(PasswordRefusal.signInAgain),
|
||||
);
|
||||
}
|
||||
expect(await AccountPassword.db.count(session), 0);
|
||||
expect(
|
||||
await EmailIdentity.db.count(
|
||||
session,
|
||||
where: (t) => t.authUserId.equals(anna),
|
||||
),
|
||||
0,
|
||||
);
|
||||
expect(await gitHubAccountToSignIn(session, '1001'), anna);
|
||||
|
||||
// Signed in with GitHub just now, the same code still serves.
|
||||
final fresh = await atNow(
|
||||
() => signInNewDevice(session, anna, method: gitHubMethod),
|
||||
);
|
||||
await atNow(
|
||||
() => endpoints.password.set(
|
||||
from(fresh),
|
||||
setup: device.setup(),
|
||||
request: code.request,
|
||||
code: code.code,
|
||||
),
|
||||
);
|
||||
expect(
|
||||
await AccountPassword.db.count(
|
||||
session,
|
||||
where: (t) => t.authUserId.equals(anna),
|
||||
),
|
||||
1,
|
||||
);
|
||||
});
|
||||
|
||||
test('is refused without an address, keeping nothing', () async {
|
||||
final fresh = await atNow(
|
||||
() => signInNewDevice(session, anna, method: gitHubMethod),
|
||||
);
|
||||
|
||||
await expectLater(
|
||||
atNow(
|
||||
() =>
|
||||
endpoints.password.set(from(fresh), setup: device.setup()),
|
||||
),
|
||||
refused(PasswordRefusal.noAddress),
|
||||
);
|
||||
expect(await AccountPassword.db.count(session), 0);
|
||||
});
|
||||
|
||||
test('is refused for an address another account has, keeping '
|
||||
'nothing', () async {
|
||||
await newPersonWithAddress(session, 'ben@example.org');
|
||||
final code = await mailedCode('ben@example.org');
|
||||
final fresh = await atNow(
|
||||
() => signInNewDevice(session, anna, method: gitHubMethod),
|
||||
);
|
||||
|
||||
await expectLater(
|
||||
atNow(
|
||||
() => endpoints.password.set(
|
||||
from(fresh),
|
||||
setup: device.setup(),
|
||||
request: code.request,
|
||||
code: code.code,
|
||||
),
|
||||
),
|
||||
refused(PasswordRefusal.addressTaken),
|
||||
);
|
||||
expect(
|
||||
await EmailIdentity.db.count(
|
||||
session,
|
||||
where: (t) => t.authUserId.equals(anna),
|
||||
),
|
||||
0,
|
||||
);
|
||||
expect(await AccountPassword.db.count(session), 0);
|
||||
});
|
||||
),
|
||||
refused(PasswordRefusal.wrongCredentials),
|
||||
);
|
||||
expect(await AccountPassword.db.count(session), 0);
|
||||
expect(
|
||||
await EmailIdentity.db.count(
|
||||
session,
|
||||
where: (t) => t.authUserId.equals(anna),
|
||||
),
|
||||
0,
|
||||
);
|
||||
});
|
||||
|
||||
test('is refused to someone without a way in (a GitHub ID '
|
||||
'forgotten): a session alone and a code to any address set '
|
||||
'nothing', () async {
|
||||
// Anna, identified, without an address, her GitHub ID forgotten
|
||||
// (the full reading's M1): a session of hers, stolen, outlived it.
|
||||
test('is refused to someone without a way in: a session alone and '
|
||||
'a code to any address set nothing', () async {
|
||||
// Anna, identified, without an address or any other way in: a
|
||||
// session of hers, stolen, outlived it.
|
||||
await EmailIdentity.db.deleteWhere(
|
||||
session,
|
||||
where: (t) => t.authUserId.equals(anna),
|
||||
|
|
@ -1480,43 +1403,6 @@ void main() {
|
|||
9,
|
||||
);
|
||||
});
|
||||
|
||||
test('refuses GitHub for an account that signs in with a password '
|
||||
'and an authenticator, not before', () async {
|
||||
await annaSetsPassword();
|
||||
await GitHubAccount.db.insertRow(
|
||||
session,
|
||||
GitHubAccount(userIdentifier: '1001', authUserId: anna),
|
||||
);
|
||||
expect(await signsInWithPassword(session, anna), isFalse);
|
||||
expect(await gitHubAccountToSignIn(session, '1001'), anna);
|
||||
|
||||
await atNow(() async {
|
||||
final enrolment = await endpoints.authenticator.enrol(
|
||||
asAnna(),
|
||||
name: 'Phone',
|
||||
label: 'anna@example.org',
|
||||
);
|
||||
await endpoints.authenticator.confirm(
|
||||
asAnna(),
|
||||
authenticator: enrolment.authenticator,
|
||||
code: codeOf(enrolment),
|
||||
proof: await passwordAlone(enrolment.authenticator),
|
||||
);
|
||||
});
|
||||
|
||||
expect(await signsInWithPassword(session, anna), isTrue);
|
||||
await expectLater(
|
||||
gitHubAccountToSignIn(session, '1001'),
|
||||
throwsA(
|
||||
isA<GitHubSignInRefusedException>().having(
|
||||
(error) => error.reason,
|
||||
'reason',
|
||||
GitHubSignInRefusal.usePassword,
|
||||
),
|
||||
),
|
||||
);
|
||||
});
|
||||
});
|
||||
|
||||
group('authenticators', () {
|
||||
|
|
@ -2612,10 +2498,6 @@ void main() {
|
|||
'the account to its password, until one is confirmed '
|
||||
'again', () async {
|
||||
await annaComplete();
|
||||
await GitHubAccount.db.insertRow(
|
||||
session,
|
||||
GitHubAccount(userIdentifier: '1001', authUserId: anna),
|
||||
);
|
||||
await resetByMail();
|
||||
now = now.add(resetDelay);
|
||||
expect((await signIn()).needsAuthenticator, isTrue);
|
||||
|
|
@ -2635,18 +2517,8 @@ void main() {
|
|||
),
|
||||
Uint8List.sublistView(device.verifier),
|
||||
);
|
||||
// Nor does a code by mail or GitHub sign in in its place.
|
||||
// Nor does a code by mail sign in in its place.
|
||||
expect(await signsInWithPassword(session, anna), isTrue);
|
||||
await expectLater(
|
||||
gitHubAccountToSignIn(session, '1001'),
|
||||
throwsA(
|
||||
isA<GitHubSignInRefusedException>().having(
|
||||
(error) => error.reason,
|
||||
'reason',
|
||||
GitHubSignInRefusal.usePassword,
|
||||
),
|
||||
),
|
||||
);
|
||||
});
|
||||
|
||||
test('is called off by signing in with a code meanwhile', () async {
|
||||
|
|
|
|||
|
|
@ -1,7 +1,6 @@
|
|||
import 'dart:convert';
|
||||
import 'dart:typed_data';
|
||||
|
||||
import 'package:clock/clock.dart';
|
||||
import 'package:halkyon_base_server/base.dart';
|
||||
import 'package:halkyon_base_server/src/register/deletion_notices.dart';
|
||||
import 'package:halkyon_base_server/src/register/instance_api.dart';
|
||||
|
|
@ -25,7 +24,6 @@ final _learn = Uri.parse('http://learn.test:8082');
|
|||
final class _Register implements AccountRegister {
|
||||
final accounts = <UuidValue>{};
|
||||
final addresses = <String, UuidValue>{};
|
||||
final gitHub = <String, UuidValue>{};
|
||||
final profiles = <UuidValue, Profile>{};
|
||||
final codes = <UuidValue, ({String address, String code})>{};
|
||||
|
||||
|
|
@ -60,10 +58,6 @@ final class _Register implements AccountRegister {
|
|||
final passwords = <UuidValue>{};
|
||||
final authenticated = <UuidValue>{};
|
||||
|
||||
/// The people a password was set for with a GitHub sign-in of the
|
||||
/// member's made just now.
|
||||
final freshGitHubSignIns = <UuidValue>{};
|
||||
|
||||
/// When the session dismissing a warning was made, by person.
|
||||
final dismissedMadeAt = <UuidValue, DateTime?>{};
|
||||
|
||||
|
|
@ -221,15 +215,10 @@ final class _Register implements AccountRegister {
|
|||
return request;
|
||||
});
|
||||
|
||||
@override
|
||||
Future<UuidValue?> accountWithGitHub(Session session, String gitHubUserId) =>
|
||||
_answer('accountWithGitHub', () => gitHub[gitHubUserId]);
|
||||
|
||||
@override
|
||||
Future<SignInWays> signInWaysOf(Session session, UuidValue person) => _answer(
|
||||
'signInWaysOf',
|
||||
() => SignInWays(
|
||||
gitHub: gitHub.containsValue(person),
|
||||
email: addresses.containsValue(person),
|
||||
simpleLogin: simpleLoginLinked.contains(person),
|
||||
password: passwords.contains(person),
|
||||
|
|
@ -525,7 +514,6 @@ final class _Register implements AccountRegister {
|
|||
String? code,
|
||||
String? handle,
|
||||
required String network,
|
||||
bool freshGitHubSignIn = false,
|
||||
UuidValue? keepSession,
|
||||
}) => _answer('setPassword', () {
|
||||
networks.add(network);
|
||||
|
|
@ -534,9 +522,6 @@ final class _Register implements AccountRegister {
|
|||
}
|
||||
add(person);
|
||||
passwords.add(person);
|
||||
if (freshGitHubSignIn) {
|
||||
freshGitHubSignIns.add(person);
|
||||
}
|
||||
});
|
||||
|
||||
@override
|
||||
|
|
@ -974,11 +959,14 @@ void main() {
|
|||
});
|
||||
|
||||
test('the ways in are those the register knows', () async {
|
||||
register.gitHub['1001'] = ben;
|
||||
register.simpleLoginLinked.add(ben);
|
||||
|
||||
final ways = await endpoints.account.signInWays(asBen());
|
||||
|
||||
expect(ways.toJson(), SignInWays(gitHub: true, email: true).toJson());
|
||||
expect(
|
||||
ways.toJson(),
|
||||
SignInWays(email: true, simpleLogin: true).toJson(),
|
||||
);
|
||||
});
|
||||
});
|
||||
|
||||
|
|
@ -1181,42 +1169,9 @@ void main() {
|
|||
);
|
||||
|
||||
expect(register.passwords, {anna});
|
||||
expect(register.freshGitHubSignIns, isEmpty);
|
||||
expect(await scopesOf(anna), contains(identified.name));
|
||||
});
|
||||
|
||||
test(
|
||||
'tell the register whether the session asking was made by a '
|
||||
'GitHub sign-in of the last ten minutes (the fourth reading)',
|
||||
() async {
|
||||
final device = await PasswordDevice.make();
|
||||
Future<void> setFrom(UuidValue device_) => endpoints.password.set(
|
||||
sessionBuilder.copyWith(
|
||||
authentication: AuthenticationOverride.authenticationInfo(
|
||||
anna.uuid,
|
||||
{},
|
||||
authId: device_.uuid,
|
||||
),
|
||||
),
|
||||
setup: device.setup(),
|
||||
request: const Uuid().v7obj(),
|
||||
code: 'K7QX-M2PD',
|
||||
);
|
||||
final old = await withClock(
|
||||
Clock.fixed(DateTime.now().subtract(const Duration(minutes: 11))),
|
||||
() => signInNewDevice(session, anna, method: gitHubMethod),
|
||||
);
|
||||
await setFrom(old);
|
||||
expect(register.freshGitHubSignIns, isEmpty);
|
||||
await setFrom(annasPhone);
|
||||
expect(register.freshGitHubSignIns, isEmpty);
|
||||
await setFrom(
|
||||
await signInNewDevice(session, anna, method: gitHubMethod),
|
||||
);
|
||||
expect(register.freshGitHubSignIns, {anna});
|
||||
},
|
||||
);
|
||||
|
||||
test('are offered as the register offers them, and not while it is '
|
||||
'out of reach', () async {
|
||||
expect(
|
||||
|
|
@ -1236,27 +1191,6 @@ void main() {
|
|||
isFalse,
|
||||
);
|
||||
});
|
||||
|
||||
test('keep GitHub from signing into an account that has one, as '
|
||||
'the register knows it', () async {
|
||||
register.gitHub['1001'] = ben;
|
||||
expect(await gitHubAccountToSignIn(session, '1001'), ben);
|
||||
|
||||
register
|
||||
..passwords.add(ben)
|
||||
..authenticated.add(ben);
|
||||
|
||||
await expectLater(
|
||||
gitHubAccountToSignIn(session, '1001'),
|
||||
throwsA(
|
||||
isA<GitHubSignInRefusedException>().having(
|
||||
(error) => error.reason,
|
||||
'reason',
|
||||
GitHubSignInRefusal.usePassword,
|
||||
),
|
||||
),
|
||||
);
|
||||
});
|
||||
});
|
||||
|
||||
group('SimpleLogin, by asking the register (ADR 0020)', () {
|
||||
|
|
|
|||
|
|
@ -103,7 +103,8 @@ void main() {
|
|||
/// server's answers.
|
||||
late RemoteRegister remote;
|
||||
|
||||
/// Identified, signing in with ben@example.org and GitHub 1001.
|
||||
/// Identified, signing in with ben@example.org, with the GitHub ID 1001
|
||||
/// left from before (ADR 0020, D36).
|
||||
late UuidValue ben;
|
||||
|
||||
setUp(() async {
|
||||
|
|
@ -259,6 +260,17 @@ void main() {
|
|||
expect((await ask('drop-everything', {})).status, 404);
|
||||
expect(await AuthUser.db.findById(session, ben), isNotNull);
|
||||
});
|
||||
|
||||
test('asking whose a GitHub account is, which nothing needs since '
|
||||
'GitHub signs nobody in (ADR 0020, D36), as an operation it '
|
||||
'does not know', () async {
|
||||
final answer = await ask('account-with-github', {
|
||||
'gitHubUserId': '1001',
|
||||
});
|
||||
|
||||
expect(answer.status, 404);
|
||||
expect(jsonEncode(answer.body), isNot(contains(ben.uuid)));
|
||||
});
|
||||
});
|
||||
|
||||
group('profiles', () {
|
||||
|
|
@ -486,9 +498,8 @@ void main() {
|
|||
refused(EmailSignInRefusal.wrongCode),
|
||||
);
|
||||
expect(await annasPasswords(), 0);
|
||||
// Someone without a way in (an anonymous account left from
|
||||
// before, ADR 0020, D25, or a GitHub ID forgotten, the full
|
||||
// reading's M1) is refused before the code is used.
|
||||
// Someone without a way in (an account left from before, ADR
|
||||
// 0020, D25 and D36) is refused before the code is used.
|
||||
final carlOnTodo = const Uuid().v7obj();
|
||||
await expectLater(
|
||||
remote.setPassword(
|
||||
|
|
@ -518,14 +529,6 @@ void main() {
|
|||
});
|
||||
});
|
||||
|
||||
group('GitHub', () {
|
||||
test('finds the account a GitHub account signs into, and nobody for '
|
||||
'one nobody has', () async {
|
||||
expect(await remote.accountWithGitHub(session, '1001'), ben);
|
||||
expect(await remote.accountWithGitHub(session, '3003'), isNull);
|
||||
});
|
||||
});
|
||||
|
||||
group('SimpleLogin (ADR 0020)', () {
|
||||
late TestKey key;
|
||||
late FakeProvider simpleLogin;
|
||||
|
|
@ -1757,18 +1760,18 @@ void main() {
|
|||
test(
|
||||
'posts JSON to the operation with the secret as its bearer token',
|
||||
() async {
|
||||
final account = const Uuid().v7obj();
|
||||
final register = answering(200, '{"account": "${account.uuid}"}');
|
||||
final person = const Uuid().v7obj();
|
||||
final register = answering(200, '{"person": "${person.uuid}"}');
|
||||
|
||||
expect(await register.accountWithGitHub(_noSession, '1001'), account);
|
||||
expect(await register.personWithHandle(_noSession, 'ben'), person);
|
||||
final request = requests.single;
|
||||
expect(request.method, 'POST');
|
||||
expect(
|
||||
'${request.url}',
|
||||
'http://learn.test:8082/halkyon-base/register/account-with-github',
|
||||
'http://learn.test:8082/halkyon-base/register/person-with-handle',
|
||||
);
|
||||
expect(request.headers['authorization'], 'Bearer $_secret');
|
||||
expect(jsonDecode(request.body), {'gitHubUserId': '1001'});
|
||||
expect(jsonDecode(request.body), {'handle': 'ben'});
|
||||
},
|
||||
);
|
||||
|
||||
|
|
@ -1785,7 +1788,7 @@ void main() {
|
|||
(404, '{"error": "not here"}'),
|
||||
]) {
|
||||
await expectLater(
|
||||
answering(status, body).accountWithGitHub(_noSession, '1001'),
|
||||
answering(status, body).personWithHandle(_noSession, 'ben'),
|
||||
throwsA(isA<RegisterUnavailableException>()),
|
||||
reason: '$status $body',
|
||||
);
|
||||
|
|
@ -1797,7 +1800,7 @@ void main() {
|
|||
client: () => MockClient(
|
||||
(_) async => throw http.ClientException('Connection refused'),
|
||||
),
|
||||
).accountWithGitHub(_noSession, '1001'),
|
||||
).personWithHandle(_noSession, 'ben'),
|
||||
throwsA(isA<RegisterUnavailableException>()),
|
||||
);
|
||||
},
|
||||
|
|
|
|||
|
|
@ -204,8 +204,6 @@ class TestEndpoints {
|
|||
|
||||
late final _EmailCodeEndpoint emailCode;
|
||||
|
||||
late final _GitHubSignInEndpoint gitHubSignIn;
|
||||
|
||||
late final _InstanceEndpoint instance;
|
||||
|
||||
late final _KeysEndpoint keys;
|
||||
|
|
@ -240,10 +238,6 @@ class _InternalTestEndpoints extends TestEndpoints
|
|||
endpoints,
|
||||
serializationManager,
|
||||
);
|
||||
gitHubSignIn = _GitHubSignInEndpoint(
|
||||
endpoints,
|
||||
serializationManager,
|
||||
);
|
||||
instance = _InstanceEndpoint(
|
||||
endpoints,
|
||||
serializationManager,
|
||||
|
|
@ -407,54 +401,6 @@ class _EmailCodeEndpoint {
|
|||
}
|
||||
}
|
||||
|
||||
class _GitHubSignInEndpoint {
|
||||
_GitHubSignInEndpoint(
|
||||
this._endpointDispatch,
|
||||
this._serializationManager,
|
||||
);
|
||||
|
||||
final _is.EndpointDispatch _endpointDispatch;
|
||||
|
||||
final _is.SerializationManager _serializationManager;
|
||||
|
||||
_ida.Future<_iacs.AuthSuccess> signIn(
|
||||
_ist.TestSessionBuilder sessionBuilder, {
|
||||
required String code,
|
||||
required String codeVerifier,
|
||||
required String redirectUri,
|
||||
}) async {
|
||||
return _ist.callAwaitableFunctionAndHandleExceptions(() async {
|
||||
var _localUniqueSession =
|
||||
(sessionBuilder as _ist.InternalTestSessionBuilder).internalBuild(
|
||||
endpoint: 'gitHubSignIn',
|
||||
method: 'signIn',
|
||||
);
|
||||
try {
|
||||
var _localCallContext = await _endpointDispatch.getMethodCallContext(
|
||||
createSessionCallback: (_) => _localUniqueSession,
|
||||
endpointPath: 'gitHubSignIn',
|
||||
methodName: 'signIn',
|
||||
parameters: _ist.testObjectToJson({
|
||||
'code': code,
|
||||
'codeVerifier': codeVerifier,
|
||||
'redirectUri': redirectUri,
|
||||
}),
|
||||
serializationManager: _serializationManager,
|
||||
);
|
||||
var _localReturnValue =
|
||||
await (_localCallContext.method.call(
|
||||
_localUniqueSession,
|
||||
_localCallContext.arguments,
|
||||
)
|
||||
as _ida.Future<_iacs.AuthSuccess>);
|
||||
return _localReturnValue;
|
||||
} finally {
|
||||
await _localUniqueSession.close();
|
||||
}
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
class _InstanceEndpoint {
|
||||
_InstanceEndpoint(
|
||||
this._endpointDispatch,
|
||||
|
|
|
|||
|
|
@ -61,34 +61,6 @@ void main() {
|
|||
);
|
||||
});
|
||||
});
|
||||
|
||||
group('The end of GitHub sign-in', () {
|
||||
test('is the start, in UTC, of the day the operator names', () {
|
||||
expect(gitHubSignInEndsFrom('2027-01-22'), DateTime.utc(2027, 1, 22));
|
||||
expect(gitHubSignInEndsFrom(' 2027-01-22 '), DateTime.utc(2027, 1, 22));
|
||||
});
|
||||
|
||||
test('is none while unset or empty', () {
|
||||
expect(gitHubSignInEndsFrom(null), isNull);
|
||||
expect(gitHubSignInEndsFrom(''), isNull);
|
||||
});
|
||||
|
||||
test('is refused for anything but a day, so the server stops', () {
|
||||
for (final value in [
|
||||
'2027-1-22',
|
||||
'22.01.2027',
|
||||
'2027-02-30',
|
||||
'2027-01-22T00:00:00Z',
|
||||
'soon',
|
||||
]) {
|
||||
expect(
|
||||
() => gitHubSignInEndsFrom(value),
|
||||
throwsStateError,
|
||||
reason: value,
|
||||
);
|
||||
}
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
extension on Map<String, String> {
|
||||
|
|
|
|||
Loading…
Reference in a new issue