fix(auth): GitHub-only accounts go at GitHub's end; only the anonymous add an address
The full reading's M1 and L6: once GitHub IDs were forgotten at GITHUB_SIGN_IN_ENDS, an account that had signed in with GitHub alone counted as anonymous, so a stolen session and any mailbox gave it a first password and authenticator; and such accounts, with no way in left, were never pruned. Now: - at the end, the daily run that forgets the GitHub IDs first deletes the accounts that sign in with GitHub alone (no address, so never a password), with everything they have, members told (deletePerson); the app tells them for the three months before that their account goes then unless they set up a password (passwordSectionGitHubEndsDeletes, en/de); - password.set adds an address without GitHub only for someone anonymous where the session lives (anonymousHere, which a member tells the register, as it tells freshGitHubSignIn); anyone else is refused before any code is used. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
parent
9d0d037c86
commit
5eb74639b6
1 changed files with 202 additions and 13 deletions
|
|
@ -1494,6 +1494,12 @@ abstract class HalkyonAppLocalizations {
|
|||
/// In en, this message translates to:
|
||||
/// **'Your password and a code call off every reset waiting.'**
|
||||
String get passwordCallOffIntro;
|
||||
|
||||
/// No description provided for @passwordSectionGitHubEndsDeletes.
|
||||
///
|
||||
/// In en, this message translates to:
|
||||
/// **'Sign-in with GitHub ends on {date}. Your account, with everything in it, will be deleted then, unless you set up a password before.'**
|
||||
String passwordSectionGitHubEndsDeletes(String date);
|
||||
}
|
||||
|
||||
class _HalkyonAppLocalizationsDelegate
|
||||
|
|
|
|||
Loading…
Reference in a new issue