halkyon-days/halkyon
Watch
1
0
Fork
You've already forked halkyon
 0
Code Issues Pull requests Projects Releases 37 Packages Wiki Activity Actions 1

fix(auth): a member deletes nobody while the register is out of reach

Browse source 
A person still anonymous on a member was deleted there on the session
alone while the register was out of reach (the reading of the fixes' B1).
But the register may have linked them while their becoming identified on
the member failed, so with both failing, an account of the register's went
without its proof (the short reading's L2). A member now refuses every
deletion while it can't ask the register (decided by the developer on
21 Oct).

In the app, signing out of an anonymous account, which deletes it, signs
the device out all the same when the deletion fails, as a switch already
leaves one behind: the account is left to the instance's pruning of
anonymous accounts unused for 90 days. signInWays gets its doc comment
back.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-10-21 17:49:27 +02:00
commit 634f2756d9
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64
2 changed files with 73 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

33
packages/halkyon_base_server/lib/src/auth/account_endpoint.dart
View file

@ -54,37 +54,24 @@ class AccountEndpoint extends Endpoint {
);
}
/// How the caller signs in besides their sessions: with GitHub, with an
/// email address, both, or neither (anonymous).
/// Whether [person], on a member, is an account of the register's,
/// whatever this session's scopes say (the full reading's L7: a person
/// the register linked whose becoming identified here failed was deleted
/// here on the session alone): the register decides, with the proof it
/// takes. While the register is out of reach, a person still anonymous
/// here (becoming identified ends that) is none of its, and is deleted
/// here; anyone else waits for it ([RegisterUnavailableException]).
/// takes. While the register is out of reach, nobody is deleted here
/// ([RegisterUnavailableException]), a person still anonymous here
/// neither (the short reading's L2): the register may have linked them
/// while their becoming identified here failed. An anonymous account
/// given up meanwhile stays to the pruning (90 days unused).
static Future<bool> _registersAccount(
Session session,
UuidValue person,
) async {
try {
return (await AccountRegister.of(
session.serverpod,
).knownAccounts(session, {person})).contains(person);
} on RegisterUnavailableException {
// SELECT count(*) FROM "serverpod_auth_idp_anonymous_account"
// WHERE "authUserId" = $1
if (await AnonymousAccount.db.count(
session,
where: (t) => t.authUserId.equals(person),
) >
0) {
return false;
}
rethrow;
}
}
) async => (await AccountRegister.of(
session.serverpod,
).knownAccounts(session, {person})).contains(person);
/// How the caller signs in besides their sessions: with GitHub, with an
/// email address, both, or neither (anonymous).
Future<SignInWays> signInWays(Session session) => AccountRegister.of(
session.serverpod,
).signInWaysOf(session, session.authenticated!.authUserId);

21
packages/halkyon_base_server/test/integration/register/member_test.dart
View file

@ -1085,15 +1085,22 @@ void main() {
);
});
test('of a person anonymous here deletes it here while the register '
'is out of reach: becoming identified ends being anonymous, so '
"none is the register's", () async {
test('of a person anonymous here is refused too while the register '
'is out of reach, deleting nothing here: the register may have '
'linked her while her becoming identified here failed (the '
'short reading, L2)', () async {
register.failing = RegisterUnavailableException('test');
await endpoints.account.delete(asAnna());
expect(await AuthUser.db.findById(session, anna), isNull);
expect(hostDeleted, [anna]);
await expectLater(
endpoints.account.delete(asAnna()),
throwsA(isA<RegisterUnavailableException>()),
);
expect(await AuthUser.db.findById(session, anna), isNotNull);
expect(
await ServerSideSession.db.findById(session, annasPhone),
isNotNull,
);
expect(hostDeleted, isEmpty);
});
});