fix(app): no state logs an authenticator's key, codes or the address

Equatable's own text lists every field, and a debug build's bloc observer
logs every state, so an authenticator's otpauth URI with its secret, the
recovery codes and the address went into the log. The password states
(signing in, getting back in, adding an authenticator, a step of the
account section) and AuthenticatorSetup now say only where they stand, as
the setup and new-phrase states did; Learn's observer takes a writer so
its test holds what it logs to that.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_app/lib/src/password/bloc/account_recovery_cubit.dart

@@ -69,6 +69,11 @@ final class const AccountRecoveryState({
     address,
     resetAt,
   ];
+
+  // Never the address (Equatable's own text lists every field, which a
+  // debug build's bloc observer logs).
+  @override
+  String toString() => 'AccountRecoveryState($step, busy: $busy, $problem)';
 }
 
 /// Getting back into an account without its password (ADR 0017): with the

packages/halkyon_app/lib/src/password/bloc/account_security_cubit.dart

@@ -67,6 +67,14 @@ final class const SecurityStepState<T>({
 }) with Equatable {
   @override
   List<Object?> get props => [busy, problem, result, mismatch];
+
+  // Never the result, which may be recovery codes or an authenticator's
+  // secret (Equatable's own text lists every field, which a debug build's
+  // bloc observer logs).
+  @override
+  String toString() =>
+      'SecurityStepState(busy: $busy, $problem, '
+      'result: ${result == null ? 'none' : 'kept'}, mismatch: $mismatch)';
 }
 
 /// A step of the account section ([run]), busy meanwhile, its refusal or
@@ -121,6 +129,11 @@ final class const AddAuthenticatorState({
 }) with Equatable {
   @override
   List<Object?> get props => [step, busy, problem, setup, recoveryCodes];
+
+  // Never the authenticator's secret or the recovery codes (Equatable's own
+  // text lists every field, which a debug build's bloc observer logs).
+  @override
+  String toString() => 'AddAuthenticatorState($step, busy: $busy, $problem)';
 }
 
 /// Adds an authenticator to the signed-in person's account: enrolled as it

packages/halkyon_app/lib/src/password/bloc/password_sign_in_cubit.dart

@@ -96,6 +96,12 @@ final class const PasswordSignInState({
     resetAt,
     sessionEndedAt,
   ];
+
+  // Never the authenticator's secret, the recovery codes or the address
+  // (Equatable's own text lists every field, which a debug build's bloc
+  // observer logs).
+  @override
+  String toString() => 'PasswordSignInState($step, busy: $busy, $problem)';
 }
 
 /// Signing in with an address, a password and a code from an authenticator

packages/halkyon_app/lib/src/password/model/account_authenticator.dart

@@ -29,4 +29,9 @@ final class const AuthenticatorSetup({
 
   @override
   List<Object?> get props => [id, uri];
+
+  // Never the URI, which holds the secret (Equatable's own text lists every
+  // field, which a debug build's bloc observer logs).
+  @override
+  String toString() => 'AuthenticatorSetup($id)';
 }

packages/halkyon_app/test/password/bloc/state_texts_test.dart

@@ -0,0 +1,57 @@
+import 'package:flutter_test/flutter_test.dart';
+import 'package:halkyon_app/halkyon_app.dart';
+
+/// What a debug build's bloc observer logs of every state must never hold a
+/// secret: Equatable's own text lists every field.
+void main() {
+  const secret = 'JBSWY3DPEHPK3PXP';
+  const authenticator = AuthenticatorSetup(
+    id: 'a1',
+    uri: 'otpauth://totp/learn.halkyon.eu:anna?secret=$secret&issuer=x',
+  );
+  const codes = ['K7QX-M2PD', 'AAAA-0001'];
+  const address = 'anna@example.org';
+
+  void expectNoSecret(Object state) {
+    final text = '$state';
+    for (final kept in [secret, ...codes, address]) {
+      expect(text, isNot(contains(kept)), reason: text);
+    }
+  }
+
+  test('no state of signing in, setting up, getting back in or the account '
+      'section says a secret, a code or the address', () {
+    expectNoSecret(authenticator);
+    expectNoSecret(
+      const PasswordSignInState(
+        step: PasswordSignInStep.recoveryCodes,
+        address: address,
+        authenticator: authenticator,
+        recoveryCodes: codes,
+      ),
+    );
+    expectNoSecret(const AccountRecoveryState(address: address));
+    expectNoSecret(
+      const AddAuthenticatorState(
+        step: AddAuthenticatorStep.recoveryCodes,
+        setup: authenticator,
+        recoveryCodes: codes,
+      ),
+    );
+    expectNoSecret(const SecurityStepState<List<String>>(result: codes));
+    expectNoSecret(
+      const SecurityStepState<AuthenticatorSetup>(result: authenticator),
+    );
+  });
+
+  test('they still say where they stand', () {
+    expect(
+      '${const PasswordSignInState(step: PasswordSignInStep.secondFactor, busy: true)}',
+      contains('secondFactor'),
+    );
+    expect(
+      '${const SecurityStepState<List<String>>(result: codes)}',
+      contains('result'),
+    );
+  });
+}