halkyon-days/halkyon
Watch
1
0
Fork
You've already forked halkyon
 0
Code Issues Pull requests Projects Releases 37 Packages Wiki Activity Actions

feat(base): SimpleLogin's sign-in comes back by the app's scheme or the loopback (ADR 0020, D9 corrected)

Browse source 
simpleLogin.begin takes the way back (SimpleLoginReturn: loopback,
scheme) rather than the platform, so macOS can come back through its
scheme as iOS and Android do; the markers become learn-loopback,
learn-scheme, todo-loopback and todo-scheme. Not breaking: the
endpoint has never been released.

D9 corrected by the developer after research: Android, iOS and macOS
come back through the app's scheme, Linux and Windows through the
loopback. Verified links protected nothing here: a code caught on its
way is worthless without the attempt's ID, and a hostile app beginning
an attempt of its own can ask for a way back that other platforms need
open. The ADR notes the residual risk and the check of prompt=consent
still to do. assetlinks.json stays served.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-10-23 23:35:46 +02:00
commit 7ea9f16904
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64
2 changed files with 201 additions and 182 deletions
Download patch file Download diff file Expand all files Collapse all files

16
packages/halkyon_base_server/test/unit/simplelogin/simplelogin_callback_test.dart
View file

@ -18,13 +18,13 @@ OidcCallbackRequest _get(
);
void main() {
test("names Halkyon's apps on the desktop's loopback and the phones' "
'schemes alone', () {
test("names Halkyon's apps on the loopback (Linux, Windows) and their "
'schemes (Android, iOS, macOS) alone', () {
expect(simpleLoginReturns, {
'learn-desktop': 'http://127.0.0.1:43823/simplelogin-callback',
'learn-phone': 'app.halkyon.learn://simplelogin-callback',
'todo-desktop': 'http://127.0.0.1:43824/simplelogin-callback',
'todo-phone': 'app.halkyon.todo://simplelogin-callback',
'learn-loopback': 'http://127.0.0.1:43823/simplelogin-callback',
'learn-scheme': 'app.halkyon.learn://simplelogin-callback',
'todo-loopback': 'http://127.0.0.1:43824/simplelogin-callback',
'todo-scheme': 'app.halkyon.todo://simplelogin-callback',
});
});
@ -48,8 +48,8 @@ void main() {
test('refuses a marker of no Halkyon app', () {
for (final state in [
'evil-desktop.abc',
'Learn-desktop.abc',
'evil-loopback.abc',
'Learn-loopback.abc',
'learn.abc',
]) {
final answer = simpleLoginCallback(_get({'code': 'abc', 'state': state}));

15
packages/halkyon_base_server/test/unit/simplelogin/simplelogin_config_test.dart
View file

@ -102,18 +102,21 @@ void main() {
expect(simpleLoginAppFrom((name) => null, webServer: null), isNull);
});
test('marks a sign-in with the app and the platform, which the forwarding '
test('marks a sign-in with the app and its way back, which the forwarding '
'page knows', () {
expect(
simpleLoginMarker('learn', SimpleLoginPlatform.desktop),
'learn-desktop',
simpleLoginMarker('learn', SimpleLoginReturn.loopback),
'learn-loopback',
);
expect(
simpleLoginMarker('todo', SimpleLoginReturn.scheme),
'todo-scheme',
);
expect(simpleLoginMarker('todo', SimpleLoginPlatform.phone), 'todo-phone');
for (final app in ['learn', 'todo']) {
for (final platform in SimpleLoginPlatform.values) {
for (final back in SimpleLoginReturn.values) {
expect(
simpleLoginReturns,
contains(simpleLoginMarker(app, platform)),
contains(simpleLoginMarker(app, back)),
);
}
}