halkyon-days/halkyon
Watch
1
0
Fork
You've already forked halkyon
 0
Code Issues Pull requests Projects Releases 37 Packages Wiki Activity Actions

feat(base,app)!: GitHub signs nobody in any more (ADR 0020, D36)

Browse source 
Every account signs in with SimpleLogin or a password now, so GitHub
goes from the module, the shared app package, Learn and Todo, ahead of
ADR 0017's GITHUB_SIGN_IN_ENDS.

- halkyon_base: no `gitHubSignIn` endpoint, GitHub identity provider or
  GitHub refusals; no `githubClientId`/`githubClientSecret`, no
  `GITHUB_SIGN_IN_ENDS` and no `forgetGitHubAccounts`; the register
  loses `account-with-github`. `SignInWays.gitHub`, the basics'
  `gitHubClientId` and `gitHubSignInEnds`, and `PasswordRefusal`'s
  `signInAgain` and `noAddress` go. A first password takes a code
  mailed to the person's own address; an account without one sets none
  (`wrongCredentials`).
- Learn's server: `instance.info()` without `gitHubClientId`, the
  pruning without GitHub, and `minimumAppBuild` 24, as builds up to 23
  (v0.20.0) require `SignInWays.gitHub`: the server deploys with the
  release of build 24.
- halkyon_app: no GitHub button or problems on the start screen, no
  password offered after a GitHub sign-in, and `ServerpodAuthGateway`
  without the browser half only GitHub used (`(client, base:)`). The
  account section offers a first password only to an account with an
  address. `LoopbackWebAuth` and the apps' schemes stay, SimpleLogin's
  ways back.
- Learn's Profile lists no GitHub; the texts go (English, German).
- Serverpod's `serverpod_auth_idp_github_account` stays, as its
  migrations make it; a row goes with its account, and ADR 0020's D36
  gives operators the SQL to delete those left.
- deploy/: compose.yaml and .env.example without GitHub. The READMEs,
  AGENTS.md files and ADR 0017 amended.

BREAKING CHANGE: builds up to 23 can't read the instance's answers
about an account's ways in; minimumAppBuild is 24.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-10-25 12:52:52 +01:00
commit 4e33133733
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64
3 changed files with 564 additions and 3570 deletions
Download patch file Download diff file Expand all files Collapse all files

1
packages/halkyon_base_server/test/integration/auth/account_test.dart
View file

@ -87,6 +87,7 @@ void main() {
createdAt: DateTime.now().toUtc(),
),
]);
// A GitHub ID left from before (ADR 0020, D36) goes too.
await GitHubAccount.db.insertRow(
session,
GitHubAccount(userIdentifier: '4711', authUserId: anna),

18
packages/halkyon_base_server/test/integration/auth/email_test.dart
View file

@ -94,9 +94,6 @@ void main() {
/// Identified, signing in with ben@example.org.
late UuidValue ben;
/// Identified, signing in with GitHub.
late UuidValue carla;
setUp(() async {
useBase(sessionBuilder);
session = sessionBuilder.build();
@ -123,19 +120,6 @@ void main() {
ben,
scopes: {identified},
);
carla = (await AuthServices.instance.authUsers.create(
session,
scopes: {identified},
)).id;
await GitHubAccount.db.insertRow(
session,
GitHubAccount(userIdentifier: '1001', authUserId: carla),
);
await signInNewDevice(
session,
carla,
scopes: {identified},
);
});
tearDown(() async {
EmailCodes.of(session.serverpod).mailer = null;
@ -179,7 +163,7 @@ void main() {
addressHash(session.serverpod, 'anna@example.org'),
);
expect(await _addressesOf(session, anna), isEmpty);
expect(await ServerSideSession.db.count(session), 3);
expect(await ServerSideSession.db.count(session), 2);
expect(await EmailCodeRequest.db.count(session), 0);
});

315
packages/halkyon_base_server/test/integration/auth/github_test.dart
View file

@ -1,315 +0,0 @@
import 'package:clock/clock.dart';
import 'package:halkyon_base_server/base.dart';
import 'package:serverpod/serverpod.dart';
import 'package:serverpod_auth_idp_server/core.dart';
import 'package:test/test.dart';
import '../support/fixtures.dart';
import '../support/password_device.dart';
import '../test_tools/serverpod_test_tools.dart';
void main() {
withServerpod('GitHub sign-in', (sessionBuilder, endpoints) {
late Session session;
/// Identified, with the GitHub account 1001.
late UuidValue ben;
setUp(() async {
useBase(sessionBuilder);
session = sessionBuilder.build();
ben = (await AuthServices.instance.authUsers.create(
session,
scopes: {identified},
)).id;
await GitHubAccount.db.insertRow(
session,
GitHubAccount(userIdentifier: '1001', authUserId: ben),
);
});
TestSessionBuilder notSignedIn() => sessionBuilder.copyWith(
authentication: AuthenticationOverride.unauthenticated(),
);
group('refuses', () {
test('signing in on an instance without a GitHub OAuth app', () async {
// The test configuration has no githubClientId/githubClientSecret.
await expectLater(
endpoints.gitHubSignIn.signIn(
notSignedIn(),
code: 'code',
codeVerifier: 'verifier',
redirectUri: _redirectUri,
),
throwsA(_refusal(GitHubSignInRefusal.unavailable)),
);
});
test('signing in with a GitHub account nobody has; nobody is '
'created', () async {
final people = await AuthUser.db.count(session);
// The endpoint refuses it (unknownAccount): nobody has it.
expect(
await accountWithGitHub(session, gitHubUserId: '3003'),
isNull,
);
expect(await AuthUser.db.count(session), people);
});
});
test('adds GitHub to nobody: the module has no way to (ADR 0020, '
'D25)', () {
final pod = session.serverpod;
expect(pod.endpoints.getConnectorByName('gitHubUpgrade'), isNull);
expect(pod.endpoints.getConnectorByName('gitHubSignIn'), isNotNull);
});
test('signing in with a known GitHub account starts a session for that '
'person', () async {
final account = await accountWithGitHub(session, gitHubUserId: '1001');
final authSuccess = await issueSession(
session,
account!,
method: gitHubMethod,
);
expect(authSuccess.authUserId, ben);
expect(authSuccess.scopeNames, contains(identified.name));
});
test('tells the app that this instance has no GitHub OAuth app', () async {
final info = await endpoints.instance.basics(notSignedIn());
expect(info.gitHubClientId, isNull);
});
group('deprecated (ADR 0017)', () {
tearDown(() {
usePasswordKeys(session.serverpod, null);
EmailCodes.of(session.serverpod).mailer = null;
useGitHubSignInEnds(session.serverpod, null);
});
test('still signs in those who have it where people sign in with a '
'password', () async {
usePasswordKeys(session.serverpod, testPasswordKeys);
EmailCodes.of(session.serverpod).mailer = const LogCodeMailer();
expect(await gitHubAccountToSignIn(session, '1001'), ben);
});
test('signs nobody in from the day it ends, after '
'which pruning forgets every GitHub ID', () async {
final ends = DateTime.utc(2027, 1, 22);
useGitHubSignInEnds(session.serverpod, ends);
expect(
await forgetGitHubAccounts(
session,
now: ends.subtract(const Duration(seconds: 1)),
),
0,
);
await withClock(Clock.fixed(ends), () async {
await expectLater(
endpoints.gitHubSignIn.signIn(
notSignedIn(),
code: 'code',
codeVerifier: 'verifier',
redirectUri: _redirectUri,
),
throwsA(_refusal(GitHubSignInRefusal.ended)),
);
});
// For 30 days after, nothing goes: a date set wrong can be put
// right meanwhile.
expect(
await forgetGitHubAccounts(
session,
now: ends.add(
gitHubAccountsKeptAfterEnd - const Duration(minutes: 1),
),
),
0,
);
expect(await AuthUser.db.findById(session, ben), isNotNull);
expect(await GitHubAccount.db.count(session), 1);
expect(
await forgetGitHubAccounts(
session,
now: ends.add(gitHubAccountsKeptAfterEnd),
),
1,
);
expect(await GitHubAccount.db.count(session), 0);
// Ben signed in with GitHub alone and never set a password up: his
// account goes with it (the full reading's M1), no way in left.
expect(await AuthUser.db.findById(session, ben), isNull);
});
test('a member forgets nothing and deletes nobody: it keeps no '
"addresses, so everyone there would look GitHub's alone (the "
"reading of the fixes' D1)", () async {
useBase(
sessionBuilder,
accounts: MemberOfRegister(Uri.parse('http://learn.test:8082')),
);
final ends = DateTime.utc(2027, 1, 22);
useGitHubSignInEnds(session.serverpod, ends);
expect(
await forgetGitHubAccounts(
session,
now: ends.add(gitHubAccountsKeptAfterEnd),
),
0,
);
expect(await AuthUser.db.findById(session, ben), isNotNull);
expect(await GitHubAccount.db.count(session), 1);
});
test('a deletion that fails holds back nobody else, keeps that '
"person's GitHub ID for the next run, and members are tried once "
'for each account, not once per account deleted (the reading of '
"the fixes' D2)", () async {
final notifier = _HangingMembers();
useBase(
sessionBuilder,
accounts: HoldsRegister(members: [Uri.parse('http://todo.test')]),
deletePersonData: [
(session, person, transaction) async {
if (person == ben) {
throw StateError('the host failed');
}
return null;
},
],
);
MemberNotifier.use(session.serverpod, notifier);
addTearDown(() => MemberNotifier.use(session.serverpod, null));
final dana = (await AuthServices.instance.authUsers.create(
session,
scopes: {identified},
)).id;
final emil = (await AuthServices.instance.authUsers.create(
session,
scopes: {identified},
)).id;
await GitHubAccount.db.insert(session, [
GitHubAccount(userIdentifier: '4004', authUserId: dana),
GitHubAccount(userIdentifier: '5005', authUserId: emil),
]);
final ends = DateTime.utc(2027, 1, 22);
useGitHubSignInEnds(session.serverpod, ends);
await forgetGitHubAccounts(
session,
now: ends.add(gitHubAccountsKeptAfterEnd),
);
expect(await AuthUser.db.findById(session, dana), isNull);
expect(await AuthUser.db.findById(session, emil), isNull);
expect(await AuthUser.db.findById(session, ben), isNotNull);
expect(await _gitHubAccount(session, '1001'), isNotNull);
expect(await GitHubAccount.db.count(session), 1);
// Dana's notice and Emil's, each tried once.
expect(notifier.told, hasLength(2));
expect(notifier.told.toSet(), {dana, emil});
});
test('an account deleted whose step afterwards failed counts as '
'deleted, not as one to try again (the short reading)', () async {
useBase(
sessionBuilder,
deletePersonData: [
(session, person, transaction) => Future.value(
() => Future<void>.error(StateError('cleaning up failed')),
),
],
);
final ends = DateTime.utc(2027, 1, 22);
useGitHubSignInEnds(session.serverpod, ends);
final forgotten = await forgetGitHubAccounts(
session,
now: ends.add(gitHubAccountsKeptAfterEnd),
);
expect(await AuthUser.db.findById(session, ben), isNull);
expect(await GitHubAccount.db.count(session), 0);
expect(forgotten, 1);
});
test('at its end keeps the account of someone with an address too, '
'forgetting only the GitHub ID', () async {
final carl = (await AuthServices.instance.authUsers.create(
session,
scopes: {identified},
)).id;
await GitHubAccount.db.insertRow(
session,
GitHubAccount(userIdentifier: '3003', authUserId: carl),
);
await EmailIdentity.db.insertRow(
session,
EmailIdentity(
authUserId: carl,
addressHash: addressHash(session.serverpod, 'carl@example.org'),
createdAt: DateTime.utc(2026, 10),
),
);
final ends = DateTime.utc(2027, 1, 22);
useGitHubSignInEnds(session.serverpod, ends);
expect(
await forgetGitHubAccounts(
session,
now: ends.add(gitHubAccountsKeptAfterEnd),
),
2,
);
expect(await AuthUser.db.findById(session, carl), isNotNull);
expect(await AuthUser.db.findById(session, ben), isNull);
expect(await GitHubAccount.db.count(session), 0);
});
});
});
}
/// Members that never answer, noting each account they were told is gone.
final class _HangingMembers implements MemberNotifier {
final told = <UuidValue>[];
@override
Future<bool> accountGone(Uri member, UuidValue account) async {
told.add(account);
return false;
}
@override
Future<bool> sessionsEnded(
Uri member,
UuidValue account, {
required DateTime endedBefore,
UuidValue? keepSession,
}) async => false;
}
/// The loopback callback the desktop apps use.
const _redirectUri = 'http://127.0.0.1:43823/github-callback';
Matcher _refusal(GitHubSignInRefusal reason) =>
isA<GitHubSignInRefusedException>().having(
(exception) => exception.reason,
'reason',
reason,
);
Future<GitHubAccount?> _gitHubAccount(Session session, String gitHubUserId) =>
GitHubAccount.db.findFirstRow(
session,
where: (t) => t.userIdentifier.equals(gitHubUserId),
);