feat(base): the changes of SimpleLogin accounts' keys, each with the password and a fresh sign-in (ADR 0020, D20)
Every change takes the password's proof by its own proof key (the recovery phrase's for a lost password) and a SimpleLogin sign-in of the last ten minutes on the device (`KeysOwnerProof`, its attempt), as ADR 0017's take the password and a code. The sign-in is checked before the proof and taken with the change, so a wrong proof leaves it standing and each sign-in serves one change. - `keys.set(attempt, setup, handle?)`: the first keys of an account that SimpleLogin was added to (anonymous before, or signing in with GitHub or a code), with the handle where it has none; the sign-in alone, as there is no password to prove yet. - `keys.changePassword`, `keys.beginPhrase` and `keys.resetPassword` (a lost password, with the phrase): every other session ends, in every service, as ADR 0017's change has it. - `keys.setRecoveryKeys`: a new phrase. - `account.delete(keysProof)`: an account without SRP's verifier deletes itself with the proof and the sign-in; `requireOwnerToDelete` no longer asks such an account for SRP. - `newKeysPasswordDigest` on both sides, held to each other by a test; a challenge purpose of its own for the phrase's proof while signed in. - Members ask the register for all of it; `RemoteRegister` and the instance API carry the five new operations and the deletion's proof. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
parent
090d901e92
commit
7c58d23424
GPG key ID:
07F6FCF405488B64
1 changed files with 3163 additions and 78 deletions
|
|
@ -1,8 +1,12 @@
|
|||
import 'dart:typed_data';
|
||||
|
||||
import 'package:clock/clock.dart';
|
||||
import 'package:cryptography/cryptography.dart';
|
||||
import 'package:halkyon_base_server/base.dart';
|
||||
import 'package:halkyon_base_server/src/password/passwords.dart'
|
||||
show passwordRowOf;
|
||||
import 'package:halkyon_oidc_server/oidc.dart';
|
||||
import 'package:halkyon_oidc_server/testing.dart';
|
||||
import 'package:serverpod/serverpod.dart';
|
||||
import 'package:serverpod_auth_idp_server/core.dart';
|
||||
import 'package:test/test.dart';
|
||||
|
|
@ -15,12 +19,19 @@ import '../support/password_support.dart';
|
|||
import '../test_tools/serverpod_test_tools.dart';
|
||||
|
||||
// The keys of an account that signs in with SimpleLogin on a signed-in
|
||||
// device (Halkyon Learn's ADR 0020, 7 and D19): the password proven with
|
||||
// its own proof key, a signature over the register's nonce, before the
|
||||
// device gets the keys wrapped under it. Every way a proof is refused, and
|
||||
// a session's wrong proofs ending it as ADR 0017's do.
|
||||
// device (Halkyon Learn's ADR 0020, 7, D19 and D20): the password proven
|
||||
// with its own proof key, a signature over the register's nonce, before the
|
||||
// device gets the keys wrapped under it; the changes, each with that proof
|
||||
// (the phrase's for a lost password) and a SimpleLogin sign-in of the last
|
||||
// ten minutes, against a fake SimpleLogin (halkyon_oidc's testing.dart).
|
||||
// Every way a proof is refused, and a session's wrong proofs ending it as
|
||||
// ADR 0017's do.
|
||||
|
||||
void main() {
|
||||
late TestKey key;
|
||||
|
||||
setUpAll(() => key = TestKey.generate('sl', seed: 13));
|
||||
|
||||
withServerpod(
|
||||
'The keys of an account that signs in with SimpleLogin',
|
||||
// Sessions ended for wrong proofs, in transactions of their own: these
|
||||
|
|
@ -29,20 +40,29 @@ void main() {
|
|||
(sessionBuilder, endpoints) {
|
||||
late Session session;
|
||||
late KeysDevice device;
|
||||
late FakeProvider simpleLogin;
|
||||
|
||||
/// With keys, signed in on her phone and her laptop.
|
||||
/// With keys, signed in on her phone and her laptop; SimpleLogin's
|
||||
/// `sl-anna`.
|
||||
late UuidValue anna;
|
||||
late UuidValue annasPhone;
|
||||
late UuidValue annasLaptop;
|
||||
|
||||
/// Without keys, signed in on his laptop.
|
||||
/// Without keys, signed in on his laptop; SimpleLogin's `sl-ben`.
|
||||
late UuidValue ben;
|
||||
late UuidValue bensLaptop;
|
||||
|
||||
setUp(() async {
|
||||
useBase(sessionBuilder);
|
||||
useBase(sessionBuilder, app: 'learn');
|
||||
session = sessionBuilder.build();
|
||||
await deleteAll(session);
|
||||
await _deleteAll(session);
|
||||
simpleLogin = FakeProvider.simpleLogin(
|
||||
key: key,
|
||||
clientId: 'halkyon-learn',
|
||||
clientSecret: 'a secret of the app',
|
||||
callbackUrl: Uri.parse('https://learn.test/simplelogin-callback'),
|
||||
);
|
||||
useSimpleLogin(sessionBuilder, simpleLogin);
|
||||
device = await KeysDevice.make();
|
||||
anna = (await AuthServices.instance.authUsers.create(
|
||||
session,
|
||||
|
|
@ -64,8 +84,21 @@ void main() {
|
|||
scopes: {identified},
|
||||
)).id;
|
||||
bensLaptop = await signInNewDevice(session, ben, method: 'simplelogin');
|
||||
for (final (person, subject) in [(anna, 'sl-anna'), (ben, 'sl-ben')]) {
|
||||
await OidcIdentity.db.insertRow(
|
||||
session,
|
||||
OidcIdentity(
|
||||
authUserId: person,
|
||||
provider: simpleLoginProvider,
|
||||
subject: subject,
|
||||
),
|
||||
);
|
||||
}
|
||||
});
|
||||
tearDown(() async {
|
||||
useSimpleLoginApp(session.serverpod, null);
|
||||
await _deleteAll(sessionBuilder.build());
|
||||
});
|
||||
tearDown(() => deleteAll(sessionBuilder.build()));
|
||||
|
||||
TestSessionBuilder signedIn(UuidValue person, UuidValue on) =>
|
||||
sessionBuilder.copyWith(
|
||||
|
|
@ -77,6 +110,37 @@ void main() {
|
|||
);
|
||||
TestSessionBuilder onPhone() => signedIn(anna, annasPhone);
|
||||
|
||||
OidcIdp idp() => AuthServices.instance.oidcIdp;
|
||||
|
||||
Matcher refusedAsOidc(OidcRefusal reason) => throwsA(
|
||||
isA<OidcRefusedException>().having((e) => e.reason, 'reason', reason),
|
||||
);
|
||||
Matcher refusedAsProfile(ProfileRefusal reason) => throwsA(
|
||||
isA<ProfileRefusedException>().having(
|
||||
(e) => e.reason,
|
||||
'reason',
|
||||
reason,
|
||||
),
|
||||
);
|
||||
|
||||
/// A SimpleLogin sign-in on [as], as [subject], just now: its attempt,
|
||||
/// which stands for it ten minutes (D20).
|
||||
Future<UuidValue> signInAgain(
|
||||
TestSessionBuilder as,
|
||||
String subject,
|
||||
) async {
|
||||
final start = await endpoints.simpleLogin.begin(
|
||||
as,
|
||||
platform: SimpleLoginPlatform.desktop,
|
||||
);
|
||||
await endpoints.simpleLogin.complete(
|
||||
as,
|
||||
attempt: start.attempt,
|
||||
code: simpleLogin.authorize(start.authorizationUrl, subject: subject),
|
||||
);
|
||||
return start.attempt;
|
||||
}
|
||||
|
||||
Future<Set<UuidValue>> sessionsOf(UuidValue person) async => {
|
||||
for (final row in await ServerSideSession.db.find(
|
||||
session,
|
||||
|
|
@ -279,6 +343,566 @@ void main() {
|
|||
});
|
||||
});
|
||||
|
||||
group('first keys, for an account SimpleLogin was added to (D20)', () {
|
||||
late KeysDevice bens;
|
||||
|
||||
setUp(() async => bens = await KeysDevice.make(seed: 3));
|
||||
|
||||
TestSessionBuilder onBensLaptop() => signedIn(ben, bensLaptop);
|
||||
|
||||
Future<void> setWith(
|
||||
UuidValue attempt, {
|
||||
KeysSetup? setup,
|
||||
String? handle = 'ben',
|
||||
}) => endpoints.keys.set(
|
||||
onBensLaptop(),
|
||||
attempt: attempt,
|
||||
setup: setup ?? bens.setup(),
|
||||
handle: handle,
|
||||
);
|
||||
|
||||
test('are set with a SimpleLogin sign-in of the last ten minutes, '
|
||||
'taken, with a handle for an account without one, and then '
|
||||
'unlock', () async {
|
||||
final attempt = await signInAgain(onBensLaptop(), 'sl-ben');
|
||||
|
||||
await setWith(attempt, handle: 'Ben');
|
||||
|
||||
final row = (await AccountPassword.db.findFirstRow(
|
||||
session,
|
||||
where: (t) => t.authUserId.equals(ben),
|
||||
))!;
|
||||
expect(row.verifier, isNull);
|
||||
expect(
|
||||
Uint8List.sublistView(row.passwordProofKey!),
|
||||
bens.passwordProofKey,
|
||||
);
|
||||
expect(
|
||||
(await PublicProfile.db.findFirstRow(
|
||||
session,
|
||||
where: (t) => t.authUserId.equals(ben),
|
||||
))!.handle,
|
||||
'Ben',
|
||||
);
|
||||
expect(
|
||||
(await endpoints.account.signInWays(onBensLaptop())).keys,
|
||||
isTrue,
|
||||
);
|
||||
expect(
|
||||
await idp().isKept(session, attempt: attempt, caller: ben),
|
||||
isFalse,
|
||||
);
|
||||
await endpoints.keys.unlock(
|
||||
onBensLaptop(),
|
||||
await bens.prove(await endpoints.keys.begin(onBensLaptop())),
|
||||
);
|
||||
});
|
||||
|
||||
test('keep the handle an account has, refusing another', () async {
|
||||
await AccountRegister.of(session.serverpod).saveProfile(
|
||||
session,
|
||||
ben,
|
||||
handle: 'Ben',
|
||||
displayName: '',
|
||||
bio: '',
|
||||
links: const [],
|
||||
);
|
||||
final attempt = await signInAgain(onBensLaptop(), 'sl-ben');
|
||||
|
||||
await expectLater(
|
||||
setWith(attempt, handle: 'Benjamin'),
|
||||
refusedAsProfile(ProfileRefusal.handleInvalid),
|
||||
);
|
||||
await setWith(attempt, handle: null);
|
||||
expect(
|
||||
(await PublicProfile.db.findFirstRow(
|
||||
session,
|
||||
where: (t) => t.authUserId.equals(ben),
|
||||
))!.handle,
|
||||
'Ben',
|
||||
);
|
||||
});
|
||||
|
||||
test(
|
||||
'refuse a handle missing or refused as saving a profile refuses '
|
||||
'it, and a setup out of range, the sign-in still standing',
|
||||
() async {
|
||||
await AccountRegister.of(session.serverpod).saveProfile(
|
||||
session,
|
||||
anna,
|
||||
handle: 'Anna',
|
||||
displayName: '',
|
||||
bio: '',
|
||||
links: const [],
|
||||
);
|
||||
final attempt = await signInAgain(onBensLaptop(), 'sl-ben');
|
||||
|
||||
for (final (handle, reason) in [
|
||||
(null, ProfileRefusal.handleInvalid),
|
||||
('ANNA', ProfileRefusal.handleTaken),
|
||||
('admin', ProfileRefusal.handleReserved),
|
||||
('ben!', ProfileRefusal.handleInvalid),
|
||||
]) {
|
||||
await expectLater(
|
||||
setWith(attempt, handle: handle),
|
||||
refusedAsProfile(reason),
|
||||
reason: '$handle',
|
||||
);
|
||||
}
|
||||
await expectLater(
|
||||
setWith(
|
||||
attempt,
|
||||
setup: bens.setup().copyWith(salt: ByteData(15)),
|
||||
),
|
||||
refused(PasswordRefusal.invalidSetup),
|
||||
);
|
||||
await setWith(attempt);
|
||||
},
|
||||
);
|
||||
|
||||
test('refuse an account with keys already, under either kind of '
|
||||
'password', () async {
|
||||
final annas = await signInAgain(onPhone(), 'sl-anna');
|
||||
await expectLater(
|
||||
endpoints.keys.set(onPhone(), attempt: annas, setup: bens.setup()),
|
||||
refused(PasswordRefusal.passwordExists),
|
||||
);
|
||||
await AccountPassword.db.insertRow(
|
||||
session,
|
||||
passwordRowOf(
|
||||
ben,
|
||||
(await PasswordDevice.make()).setup(),
|
||||
now: DateTime.now().toUtc(),
|
||||
),
|
||||
);
|
||||
await expectLater(
|
||||
setWith(await signInAgain(onBensLaptop(), 'sl-ben')),
|
||||
refused(PasswordRefusal.passwordExists),
|
||||
);
|
||||
});
|
||||
|
||||
test("refuse without a SimpleLogin sign-in of the account's: none, "
|
||||
"past its ten minutes, or another account's, which stands for "
|
||||
'it still', () async {
|
||||
final annas = await signInAgain(onPhone(), 'sl-anna');
|
||||
final attempt = await signInAgain(onBensLaptop(), 'sl-ben');
|
||||
|
||||
await expectLater(
|
||||
setWith(const Uuid().v4obj()),
|
||||
refusedAsOidc(OidcRefusal.unknownAttempt),
|
||||
);
|
||||
await expectLater(
|
||||
withClock(
|
||||
Clock.fixed(DateTime.now().add(const Duration(minutes: 11))),
|
||||
() => setWith(attempt),
|
||||
),
|
||||
refusedAsOidc(OidcRefusal.unknownAttempt),
|
||||
);
|
||||
await expectLater(
|
||||
setWith(annas),
|
||||
refusedAsOidc(OidcRefusal.wrongCaller),
|
||||
);
|
||||
expect(
|
||||
await idp().isKept(session, attempt: annas, caller: anna),
|
||||
isTrue,
|
||||
);
|
||||
await setWith(attempt);
|
||||
});
|
||||
});
|
||||
|
||||
group('a new password (D20)', () {
|
||||
late KeysDevice next;
|
||||
|
||||
setUp(() async => next = await KeysDevice.make(seed: 7));
|
||||
|
||||
/// The proof for a new password ([binding], else [next]'s) by
|
||||
/// [keys] (the password's proof key unless given), with the
|
||||
/// sign-in under [attempt].
|
||||
Future<KeysOwnerProof> changeProof(
|
||||
UuidValue attempt, {
|
||||
KeysPassword? binding,
|
||||
SimpleKeyPair? keys,
|
||||
KeyProofPurpose purpose = KeyProofPurpose.newPassword,
|
||||
KeysChallenge? challenge,
|
||||
}) async => await device.ownerProof(
|
||||
attempt,
|
||||
challenge: challenge ?? await endpoints.keys.begin(onPhone()),
|
||||
purpose: purpose,
|
||||
digest: newKeysPasswordDigest(binding ?? next.password()),
|
||||
keys: keys,
|
||||
);
|
||||
|
||||
Future<void> changeWith(KeysOwnerProof proof, {KeysPassword? to}) =>
|
||||
endpoints.keys.changePassword(
|
||||
onPhone(),
|
||||
proof: proof,
|
||||
password: to ?? next.password(),
|
||||
);
|
||||
|
||||
test("takes the old password's proof and a SimpleLogin sign-in: the "
|
||||
'keys open with the new one alone, and every other session '
|
||||
'ends', () async {
|
||||
final attempt = await signInAgain(onPhone(), 'sl-anna');
|
||||
|
||||
await changeWith(await changeProof(attempt));
|
||||
|
||||
expect(await sessionsOf(anna), {annasPhone});
|
||||
final challenge = await endpoints.keys.begin(onPhone());
|
||||
expect(Uint8List.sublistView(challenge.salt), next.salt);
|
||||
final keys = await endpoints.keys.unlock(
|
||||
onPhone(),
|
||||
await next.prove(challenge),
|
||||
);
|
||||
expect(keys.passwordKeys.toJson(), next.passwordKeys.toJson());
|
||||
await expectLater(
|
||||
endpoints.keys.unlock(
|
||||
onPhone(),
|
||||
await device.prove(await endpoints.keys.begin(onPhone())),
|
||||
),
|
||||
refused(PasswordRefusal.wrongCredentials),
|
||||
);
|
||||
});
|
||||
|
||||
test('refuses a proof by another key, for another password or '
|
||||
'purpose, and a password out of range, the sign-in still '
|
||||
'standing', () async {
|
||||
final attempt = await signInAgain(onPhone(), 'sl-anna');
|
||||
|
||||
for (final proof in [
|
||||
await changeProof(attempt, keys: device.recoveryProofKeys),
|
||||
await changeProof(
|
||||
attempt,
|
||||
binding: (await KeysDevice.make(seed: 9)).password(),
|
||||
),
|
||||
await changeProof(attempt, purpose: KeyProofPurpose.newPhrase),
|
||||
]) {
|
||||
await expectLater(
|
||||
changeWith(proof),
|
||||
refused(PasswordRefusal.wrongCredentials),
|
||||
);
|
||||
}
|
||||
await expectLater(
|
||||
changeWith(
|
||||
await changeProof(attempt),
|
||||
to: next.password().copyWith(passwordProofKey: ByteData(31)),
|
||||
),
|
||||
refused(PasswordRefusal.invalidSetup),
|
||||
);
|
||||
expect(await sessionsOf(anna), {annasPhone, annasLaptop});
|
||||
await changeWith(await changeProof(attempt));
|
||||
});
|
||||
|
||||
test('refuses without a SimpleLogin sign-in of hers, checking no '
|
||||
"proof: none, another account's, past its ten minutes, or one a "
|
||||
'change took', () async {
|
||||
final bens = await signInAgain(signedIn(ben, bensLaptop), 'sl-ben');
|
||||
final challenge = await endpoints.keys.begin(onPhone());
|
||||
|
||||
for (final attempt in [const Uuid().v4obj(), bens]) {
|
||||
await expectLater(
|
||||
changeWith(await changeProof(attempt, challenge: challenge)),
|
||||
refusedAsOidc(OidcRefusal.unknownAttempt),
|
||||
);
|
||||
}
|
||||
final annas = await signInAgain(onPhone(), 'sl-anna');
|
||||
await expectLater(
|
||||
withClock(
|
||||
Clock.fixed(DateTime.now().add(const Duration(minutes: 11))),
|
||||
() async => await changeWith(
|
||||
await changeProof(annas, challenge: challenge),
|
||||
),
|
||||
),
|
||||
refusedAsOidc(OidcRefusal.unknownAttempt),
|
||||
);
|
||||
// The challenge still answers: no proof was taken.
|
||||
await changeWith(await changeProof(annas, challenge: challenge));
|
||||
// One change for each sign-in.
|
||||
await expectLater(
|
||||
changeWith(
|
||||
await next.ownerProof(
|
||||
annas,
|
||||
challenge: await endpoints.keys.begin(onPhone()),
|
||||
purpose: KeyProofPurpose.newPassword,
|
||||
digest: newKeysPasswordDigest(device.password()),
|
||||
),
|
||||
to: device.password(),
|
||||
),
|
||||
refusedAsOidc(OidcRefusal.unknownAttempt),
|
||||
);
|
||||
});
|
||||
|
||||
test("counts the session's wrong proofs, as unlocking does: the "
|
||||
'tenth in a row ends it', () async {
|
||||
final attempt = await signInAgain(onPhone(), 'sl-anna');
|
||||
|
||||
for (var i = 0; i < 10; i++) {
|
||||
await expectLater(
|
||||
changeWith(
|
||||
await changeProof(attempt, keys: device.recoveryProofKeys),
|
||||
),
|
||||
refused(
|
||||
i < 9
|
||||
? PasswordRefusal.wrongCredentials
|
||||
: PasswordRefusal.sessionEnded,
|
||||
),
|
||||
);
|
||||
}
|
||||
expect(await sessionsOf(anna), {annasLaptop});
|
||||
});
|
||||
});
|
||||
|
||||
group('a lost password (D20)', () {
|
||||
late KeysDevice next;
|
||||
|
||||
setUp(() async => next = await KeysDevice.make(seed: 7));
|
||||
|
||||
Future<void> resetWith(KeysOwnerProof proof) => endpoints.keys
|
||||
.resetPassword(onPhone(), proof: proof, password: next.password());
|
||||
|
||||
test("is set anew with the recovery phrase's proof and a SimpleLogin "
|
||||
'sign-in, every other session ending', () async {
|
||||
final phrase = await endpoints.keys.beginPhrase(onPhone());
|
||||
expect(phrase.recoveryKeys.toJson(), device.recoveryKeys.toJson());
|
||||
expect(
|
||||
Uint8List.sublistView(phrase.signingPublicKey),
|
||||
device.signingPublicKey,
|
||||
);
|
||||
expect(phrase.nonce.lengthInBytes, 32);
|
||||
final attempt = await signInAgain(onPhone(), 'sl-anna');
|
||||
|
||||
await resetWith(
|
||||
await device.ownerProof(
|
||||
attempt,
|
||||
phrase: phrase,
|
||||
purpose: KeyProofPurpose.passwordReset,
|
||||
digest: newKeysPasswordDigest(next.password()),
|
||||
),
|
||||
);
|
||||
|
||||
expect(await sessionsOf(anna), {annasPhone});
|
||||
await endpoints.keys.unlock(
|
||||
onPhone(),
|
||||
await next.prove(await endpoints.keys.begin(onPhone())),
|
||||
);
|
||||
});
|
||||
|
||||
test("refuses the password's proof key, a challenge of keys.begin, "
|
||||
'and a proof for another purpose', () async {
|
||||
final attempt = await signInAgain(onPhone(), 'sl-anna');
|
||||
final digest = newKeysPasswordDigest(next.password());
|
||||
|
||||
await expectLater(
|
||||
resetWith(
|
||||
await device.ownerProof(
|
||||
attempt,
|
||||
phrase: await endpoints.keys.beginPhrase(onPhone()),
|
||||
keys: device.passwordProofKeys,
|
||||
purpose: KeyProofPurpose.passwordReset,
|
||||
digest: digest,
|
||||
),
|
||||
),
|
||||
refused(PasswordRefusal.wrongCredentials),
|
||||
);
|
||||
await expectLater(
|
||||
resetWith(
|
||||
await device.ownerProof(
|
||||
attempt,
|
||||
challenge: await endpoints.keys.begin(onPhone()),
|
||||
keys: device.recoveryProofKeys,
|
||||
purpose: KeyProofPurpose.passwordReset,
|
||||
digest: digest,
|
||||
),
|
||||
),
|
||||
refused(PasswordRefusal.challengeExpired),
|
||||
);
|
||||
await expectLater(
|
||||
resetWith(
|
||||
await device.ownerProof(
|
||||
attempt,
|
||||
phrase: await endpoints.keys.beginPhrase(onPhone()),
|
||||
purpose: KeyProofPurpose.newPassword,
|
||||
digest: digest,
|
||||
),
|
||||
),
|
||||
refused(PasswordRefusal.wrongCredentials),
|
||||
);
|
||||
await resetWith(
|
||||
await device.ownerProof(
|
||||
attempt,
|
||||
phrase: await endpoints.keys.beginPhrase(onPhone()),
|
||||
purpose: KeyProofPurpose.passwordReset,
|
||||
digest: digest,
|
||||
),
|
||||
);
|
||||
});
|
||||
|
||||
test('is for an account with such keys alone', () async {
|
||||
final bens = signedIn(ben, bensLaptop);
|
||||
await expectLater(
|
||||
endpoints.keys.beginPhrase(bens),
|
||||
refused(PasswordRefusal.noPassword),
|
||||
);
|
||||
await AccountPassword.db.insertRow(
|
||||
session,
|
||||
passwordRowOf(
|
||||
ben,
|
||||
(await PasswordDevice.make()).setup(),
|
||||
now: DateTime.now().toUtc(),
|
||||
),
|
||||
);
|
||||
await expectLater(
|
||||
endpoints.keys.beginPhrase(bens),
|
||||
refused(PasswordRefusal.noPassword),
|
||||
);
|
||||
});
|
||||
});
|
||||
|
||||
group('a new recovery phrase (D20)', () {
|
||||
late KeysDevice next;
|
||||
|
||||
setUp(() async => next = await KeysDevice.make(seed: 7));
|
||||
|
||||
Future<void> setPhrase(
|
||||
KeysOwnerProof proof, {
|
||||
WrappedKeys? recoveryKeys,
|
||||
}) => endpoints.keys.setRecoveryKeys(
|
||||
onPhone(),
|
||||
proof: proof,
|
||||
recoveryKeys: recoveryKeys ?? next.recoveryKeys,
|
||||
recoveryProofKey: ByteData.sublistView(next.recoveryProofKey),
|
||||
);
|
||||
|
||||
Future<KeysOwnerProof> phraseProof(UuidValue attempt) async =>
|
||||
await device.ownerProof(
|
||||
attempt,
|
||||
challenge: await endpoints.keys.begin(onPhone()),
|
||||
purpose: KeyProofPurpose.newPhrase,
|
||||
digest: newPhraseDigest(
|
||||
next.recoveryKeys,
|
||||
ByteData.sublistView(next.recoveryProofKey),
|
||||
),
|
||||
);
|
||||
|
||||
test("takes the password's proof and a SimpleLogin sign-in, the old "
|
||||
'phrase proving nothing then, the sessions staying', () async {
|
||||
await setPhrase(
|
||||
await phraseProof(await signInAgain(onPhone(), 'sl-anna')),
|
||||
);
|
||||
|
||||
final phrase = await endpoints.keys.beginPhrase(onPhone());
|
||||
expect(phrase.recoveryKeys.toJson(), next.recoveryKeys.toJson());
|
||||
expect(await sessionsOf(anna), {annasPhone, annasLaptop});
|
||||
final again = await signInAgain(onPhone(), 'sl-anna');
|
||||
final digest = newKeysPasswordDigest(next.password());
|
||||
await expectLater(
|
||||
endpoints.keys.resetPassword(
|
||||
onPhone(),
|
||||
proof: await device.ownerProof(
|
||||
again,
|
||||
phrase: phrase,
|
||||
purpose: KeyProofPurpose.passwordReset,
|
||||
digest: digest,
|
||||
),
|
||||
password: next.password(),
|
||||
),
|
||||
refused(PasswordRefusal.wrongCredentials),
|
||||
);
|
||||
await endpoints.keys.resetPassword(
|
||||
onPhone(),
|
||||
proof: await next.ownerProof(
|
||||
again,
|
||||
phrase: await endpoints.keys.beginPhrase(onPhone()),
|
||||
purpose: KeyProofPurpose.passwordReset,
|
||||
digest: digest,
|
||||
),
|
||||
password: next.password(),
|
||||
);
|
||||
});
|
||||
|
||||
test('refuses a phrase out of range, or a proof for another '
|
||||
'one', () async {
|
||||
final attempt = await signInAgain(onPhone(), 'sl-anna');
|
||||
|
||||
await expectLater(
|
||||
setPhrase(
|
||||
await phraseProof(attempt),
|
||||
recoveryKeys: next.recoveryKeys.copyWith(nonce: ByteData(12)),
|
||||
),
|
||||
refused(PasswordRefusal.invalidSetup),
|
||||
);
|
||||
await expectLater(
|
||||
setPhrase(
|
||||
await phraseProof(attempt),
|
||||
recoveryKeys: device.recoveryKeys,
|
||||
),
|
||||
refused(PasswordRefusal.wrongCredentials),
|
||||
);
|
||||
await setPhrase(await phraseProof(attempt));
|
||||
});
|
||||
});
|
||||
|
||||
group('deleting the account (D20)', () {
|
||||
Future<KeysOwnerProof> deletionProof(
|
||||
UuidValue attempt, {
|
||||
KeyProofPurpose purpose = KeyProofPurpose.deleteAccount,
|
||||
}) async => await device.ownerProof(
|
||||
attempt,
|
||||
challenge: await endpoints.keys.begin(onPhone()),
|
||||
purpose: purpose,
|
||||
);
|
||||
|
||||
test("takes the password's proof and a SimpleLogin sign-in", () async {
|
||||
await endpoints.account.delete(
|
||||
onPhone(),
|
||||
keysProof: await deletionProof(
|
||||
await signInAgain(onPhone(), 'sl-anna'),
|
||||
),
|
||||
);
|
||||
|
||||
expect(await AuthUser.db.findById(session, anna), isNull);
|
||||
});
|
||||
|
||||
test('refuses a session alone, the proof of a password that signs '
|
||||
'in, a proof for another purpose, and one without a sign-in, '
|
||||
'keeping the account', () async {
|
||||
await expectLater(
|
||||
endpoints.account.delete(onPhone()),
|
||||
refused(PasswordRefusal.wrongCredentials),
|
||||
);
|
||||
await expectLater(
|
||||
endpoints.account.delete(
|
||||
onPhone(),
|
||||
proof: DeletionProof(
|
||||
challenge: const Uuid().v4obj(),
|
||||
clientValue: ByteData(384),
|
||||
clientProof: ByteData(32),
|
||||
totpCode: '000000',
|
||||
instanceUrl: testInstanceUrl,
|
||||
),
|
||||
),
|
||||
refused(PasswordRefusal.wrongCredentials),
|
||||
);
|
||||
await expectLater(
|
||||
endpoints.account.delete(
|
||||
onPhone(),
|
||||
keysProof: await deletionProof(const Uuid().v4obj()),
|
||||
),
|
||||
refusedAsOidc(OidcRefusal.unknownAttempt),
|
||||
);
|
||||
await expectLater(
|
||||
endpoints.account.delete(
|
||||
onPhone(),
|
||||
keysProof: await deletionProof(
|
||||
await signInAgain(onPhone(), 'sl-anna'),
|
||||
purpose: KeyProofPurpose.newPassword,
|
||||
),
|
||||
),
|
||||
refused(PasswordRefusal.wrongCredentials),
|
||||
);
|
||||
expect(await AuthUser.db.findById(session, anna), isNotNull);
|
||||
});
|
||||
});
|
||||
|
||||
group('the ways in', () {
|
||||
test('say the account has keys, and no password that signs in, nor '
|
||||
'an authenticator to add', () async {
|
||||
|
|
@ -305,3 +929,9 @@ void main() {
|
|||
},
|
||||
);
|
||||
}
|
||||
|
||||
Future<void> _deleteAll(Session session) async {
|
||||
await OidcAttempt.db.deleteWhere(session, where: (t) => t.id.notEquals(null));
|
||||
await PublicProfile.db.deleteWhere(session, where: (t) => t.id > 0);
|
||||
await deleteAll(session);
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in a new issue