feat(base)!: no anonymous accounts on the server (ADR 0020, D25)
The server's half of D25: every account has a way in, and the anonymous accounts left from before go with the daily pruning. - The module signs nobody in anonymously: `anonymousIdp` and `gitHubUpgrade` are gone, and so is linking GitHub at the register. - A password is set only by someone whose address is theirs (a `firstPassword` code) or who signs in with GitHub alone (a fresh sign-in and a `signUp` code); an anonymous account is refused `wrongCredentials` before any code is used. - SimpleLogin refuses to link onto a caller without `identified` (`wrongCaller`), the member's endpoint too, so nothing turns an anonymous account into one with a way in. - `pruneAnonymousPeople` deletes every anonymous account left, however new, never one identified. Learn and Todo schedule it as `prune-accounts` and cancel the old `prune-abandoned-anonymous-people` entry once. - Learn: someone without `identified` keeps no files; `FILE_LIMIT_ANONYMOUS_MB` is gone. `minimumAppBuild` is 23, as builds up to 22 start with an anonymous account. - Learn's sync tests make their person and session by SQL in the development database, as Serverpod stores sessions. - Docs, store listings and ADRs 0010, 0014, 0016, 0017 and 0019 amended. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
parent
5b9df73756
commit
87671208df
GPG key ID:
07F6FCF405488B64
6 changed files with 837 additions and 1353 deletions
|
|
@ -3,7 +3,7 @@
|
|||
What holds for every app and package of this repository is in the [root AGENTS.md](../../AGENTS.md); it applies here in full, and Learn's patterns (`apps/learn/AGENTS.md`) wherever Todo needs the same thing.
|
||||
|
||||
- **A shell on the shared packages** (decided 2026-10-19): signing in, the instances, the account and the look work; nothing of a person's is kept or synced yet, which waits for Todo's first model (the developer decides what it keeps and syncs). Packages: `halkyon_todo_server`, `halkyon_todo_client` (generated, never edited), `halkyon_todo_flutter`; app ID `app.halkyon.todo` on every platform; no web build. Licences as Learn's (server SSPL, client and app AGPL; `LICENSE.md`).
|
||||
- **The server** includes `halkyon_base` (ADR 0014) and configures it in `server.dart` (`todoBase()`, `lib/src/todo_base.dart`): its basics say it serves `todo` (never change it once apps use it), sign-in mails name Halkyon Todo, the source is this repository, `minimumAppBuild` 1, no data of its own to delete with a person yet (add a `deletePersonData` hook with Todo's first table). Authentication through the module's builders: anonymous, GitHub (with the instance's own OAuth app) and email codes, server-side sessions. **Accounts** (ADR 0016): Todo holds its own register when it runs alone, and is a member of the instance's register (Learn's server on learn.halkyon.eu) where the operator sets `ACCOUNT_REGISTER_URL` (`todoBase(accounts: AccountsMode.fromEnvironment())`) with the instance's shared `INSTANCE_SECRET` (`instanceSecret`); then sign-in, handles and profiles are the register's, the email settings are the register's alone (GitHub's are Todo's own OAuth app's), and an identified person's deletion goes to the register first. `addInstanceRoutes` serves the calls between the services on its web server, and the server doesn't start without the secret where it needs it. `schedulePruning` (`lib/src/pruning.dart`) keeps the module's pruning scheduled, one entry each however often the server starts: anonymous people daily, sign-up attempts and codes hourly, as the register the deletions its members haven't confirmed hourly, as a member the people the register no longer knows daily (each a no-op in the other mode). Session logs are never persisted, in any run mode. Migrations (2026-10-19): the initial one (Serverpod's tables, its auth modules' and the module's `email_identity`, `email_code_request`), `profiles` (`public_profile`) and `deletion-notices` (`account_deletion_notice`), nothing of Todo's own. Tests (`test/integration/todo_server_test.dart`) call the module's endpoints through the server's own dispatch (`halkyon_base.<endpoint>`), since the generated test tools expose the project's endpoints alone.
|
||||
- **The app** is halkyon_app's `InstanceGate` and `SessionGate` with Todo's frame (`todoFrame`: "Todo" under "Halkyon", its icon, `todo.example.org`, its own sentence) and `ServerpodInstanceChecker(app: 'todo')`; `TodoDependencies` (`AppDependencies<TodoPerson>`) on one instance, `TodoPerson` (empty) per person; a person's app with an empty home and the account sheet: halkyon_app's `AccountTiles` (whose account on which instance, Switch account, Sign out, which asks first for an anonymous account as it deletes it, Delete account, which asks first) in Todo's words, and halkyon_app's About (`showAppAbout`: the source of what the instance runs, from `TodoDependencies.sourceCodeUrl`, and the licence list). Texts through gen-l10n in British English (the template), German (informal du), an empty `en_US` and `en_GB` (`test/l10n/arb_files_test.dart` keeps them in step). The look follows the system's theme mode and language until Todo has settings. Countries in where an instance keeps its data are named by halkyon_app's CLDR names (`AssetCountryNames`), its language picked by halkyon_app's `resolveAppLocale`. Widget tests start Todo's whole tree with halkyon_app's fakes (`test/app/todo_app_test.dart`).
|
||||
- **The server** includes `halkyon_base` (ADR 0014) and configures it in `server.dart` (`todoBase()`, `lib/src/todo_base.dart`): its basics say it serves `todo` (never change it once apps use it), sign-in mails name Halkyon Todo, the source is this repository, `minimumAppBuild` 1, no data of its own to delete with a person yet (add a `deletePersonData` hook with Todo's first table). Authentication through the module's builders: a password, SimpleLogin on the register, GitHub (with the instance's own OAuth app) until it ends, email codes proving an address, server-side sessions; no anonymous accounts (ADR 0020, D25). **Accounts** (ADR 0016): Todo holds its own register when it runs alone, and is a member of the instance's register (Learn's server on learn.halkyon.eu) where the operator sets `ACCOUNT_REGISTER_URL` (`todoBase(accounts: AccountsMode.fromEnvironment())`) with the instance's shared `INSTANCE_SECRET` (`instanceSecret`); then sign-in, handles and profiles are the register's, the email settings are the register's alone (GitHub's are Todo's own OAuth app's), and an identified person's deletion goes to the register first. `addInstanceRoutes` serves the calls between the services on its web server, and the server doesn't start without the secret where it needs it. `schedulePruning` (`lib/src/pruning.dart`) keeps the module's pruning scheduled, one entry each however often the server starts (and cancels the one under the pruning's name before ADR 0020, D25): the anonymous accounts left from before daily, sign-up attempts and codes hourly, as the register the deletions its members haven't confirmed hourly, as a member the people the register no longer knows daily (each a no-op in the other mode). Session logs are never persisted, in any run mode. Migrations (2026-10-19): the initial one (Serverpod's tables, its auth modules' and the module's `email_identity`, `email_code_request`), `profiles` (`public_profile`) and `deletion-notices` (`account_deletion_notice`), nothing of Todo's own. Tests (`test/integration/todo_server_test.dart`) call the module's endpoints through the server's own dispatch (`halkyon_base.<endpoint>`), since the generated test tools expose the project's endpoints alone.
|
||||
- **The app** is halkyon_app's `InstanceGate` and `SessionGate` with Todo's frame (`todoFrame`: "Todo" under "Halkyon", its icon, `todo.example.org`, its own sentence) and `ServerpodInstanceChecker(app: 'todo')`; `TodoDependencies` (`AppDependencies<TodoPerson>`) on one instance, `TodoPerson` (empty) per person; a person's app with an empty home and the account sheet: halkyon_app's `AccountTiles` (whose account on which instance, Switch account, Sign out, Delete account, which asks first) in Todo's words, and halkyon_app's About (`showAppAbout`: the source of what the instance runs, from `TodoDependencies.sourceCodeUrl`, and the licence list). Texts through gen-l10n in British English (the template), German (informal du), an empty `en_US` and `en_GB` (`test/l10n/arb_files_test.dart` keeps them in step). The look follows the system's theme mode and language until Todo has settings. Countries in where an instance keeps its data are named by halkyon_app's CLDR names (`AssetCountryNames`), its language picked by halkyon_app's `resolveAppLocale`. Widget tests start Todo's whole tree with halkyon_app's fakes (`test/app/todo_app_test.dart`).
|
||||
- **The icon** is Lucide's `list-checks` (lucide-static 1.50.0) in the brand's blues on white: `apps/todo/tool/app_icons.py` (run from `apps/todo`) fetches it, draws its strokes with Pillow (no SVG renderer needed; other path commands fail loudly), writes `assets/icon/halkyon_todo_icon.png` and Lucide's ISC licence beside it, then every platform's launcher icon through flutter_launcher_icons as Learn's tool does. `registerLucideLicense` puts the notice in the licence list.
|
||||
- **`serverpod start`** runs in `apps/todo/halkyon_todo_server` (it launches the app from `lib/driver.dart`); `.mcp.json`'s `--server-dir` names it when a session works on Todo. Its tests need throwaway passwords in its git-ignored `config/passwords.yaml` (`database`, `serviceSecret`, `serverSideSessionKeyHashPepper`, `emailSignInPepper`) or from the environment, as CI gives them. Learn's and Todo's development servers use the same ports: run one at a time.
|
||||
|
|
|
|||
|
|
@ -58,8 +58,7 @@ class FutureCalls extends _is.FutureCallDispatch<_FutureCallRef> {
|
|||
String serverId,
|
||||
) {
|
||||
var registeredFutureCalls = <String, _is.InvokableFutureCall>{
|
||||
'PruningPruneAnonymousPeopleFutureCall':
|
||||
PruningPruneAnonymousPeopleFutureCall(),
|
||||
'PruningPruneAccountsFutureCall': PruningPruneAccountsFutureCall(),
|
||||
'PruningForgetSignUpAttemptsFutureCall':
|
||||
PruningForgetSignUpAttemptsFutureCall(),
|
||||
'PruningTellMembersOfDeletionsFutureCall':
|
||||
|
|
@ -194,9 +193,9 @@ class _PruningFutureCallDispatcher {
|
|||
|
||||
final _InvokeFutureCall _invokeFutureCall;
|
||||
|
||||
Future<void> pruneAnonymousPeople() {
|
||||
Future<void> pruneAccounts() {
|
||||
return _invokeFutureCall(
|
||||
'PruningPruneAnonymousPeopleFutureCall',
|
||||
'PruningPruneAccountsFutureCall',
|
||||
null,
|
||||
);
|
||||
}
|
||||
|
|
@ -223,18 +222,18 @@ class _PruningFutureCallDispatcher {
|
|||
}
|
||||
}
|
||||
|
||||
/// Prunes one batch and logs how many people went; 30 days after GitHub
|
||||
/// sign-in ended (`GITHUB_SIGN_IN_ENDS`), deletes the accounts that had
|
||||
/// no other way in and forgets every GitHub ID too, on the register; and
|
||||
/// forgets the resets that lapsed (ADR 0017).
|
||||
class PruningPruneAnonymousPeopleFutureCall extends _is.FutureCall
|
||||
/// Prunes one batch of anonymous accounts and logs how many people went;
|
||||
/// 30 days after GitHub sign-in ended (`GITHUB_SIGN_IN_ENDS`), deletes the
|
||||
/// accounts that had no other way in and forgets every GitHub ID too, on
|
||||
/// the register; and forgets the resets that lapsed (ADR 0017).
|
||||
class PruningPruneAccountsFutureCall extends _is.FutureCall
|
||||
implements _is.InvokableFutureCall {
|
||||
@override
|
||||
_ida.Future<void> invoke(
|
||||
_is.Session session,
|
||||
_is.SerializableModel? object,
|
||||
) async {
|
||||
await _ibrplims.PruningFutureCall().pruneAnonymousPeople(session);
|
||||
await _ibrplims.PruningFutureCall().pruneAccounts(session);
|
||||
}
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -1,8 +1,11 @@
|
|||
import 'package:halkyon_todo_server/src/generated/future_calls.dart';
|
||||
import 'package:serverpod/serverpod.dart';
|
||||
|
||||
/// The identifier of the daily pruning of abandoned anonymous people.
|
||||
const _pruning = 'prune-abandoned-anonymous-people';
|
||||
/// The identifier of the daily pruning of accounts.
|
||||
const _pruning = 'prune-accounts';
|
||||
|
||||
/// The identifier the daily pruning had until ADR 0020, D25.
|
||||
const _anonymousPruning = 'prune-abandoned-anonymous-people';
|
||||
|
||||
/// The identifier of the hourly forgetting of sign-up attempts.
|
||||
const _attemptPruning = 'forget-sign-up-attempts';
|
||||
|
|
@ -21,20 +24,22 @@ const pruningIdentifiers = [
|
|||
_deletedAccounts,
|
||||
];
|
||||
|
||||
/// Schedules the pruning (`PruningFutureCall`): abandoned anonymous people
|
||||
/// daily, sign-up attempts and expired email codes hourly, and the instance's
|
||||
/// Schedules the pruning (`PruningFutureCall`): the anonymous accounts left
|
||||
/// from before daily, sign-up attempts and expired email codes hourly, and the instance's
|
||||
/// accounts (ADR 0016): the register's deletions its members haven't
|
||||
/// confirmed hourly, a member's people the register forgot daily (each does
|
||||
/// nothing in the other mode). Scheduling always adds an entry, so the
|
||||
/// previous one goes first, and starting the server again leaves one of
|
||||
/// each.
|
||||
/// each; the one scheduled under the pruning's earlier name, which would
|
||||
/// call nothing, goes too.
|
||||
Future<void> schedulePruning(Serverpod pod) async {
|
||||
await pod.futureCalls.cancel(_anonymousPruning);
|
||||
await pod.futureCalls.cancel(_pruning);
|
||||
await pod.futureCalls
|
||||
.callRecurring(identifier: _pruning)
|
||||
.cron('17 3 * * *')
|
||||
.pruning
|
||||
.pruneAnonymousPeople();
|
||||
.pruneAccounts();
|
||||
|
||||
await pod.futureCalls.cancel(_attemptPruning);
|
||||
await pod.futureCalls
|
||||
|
|
|
|||
|
|
@ -2,25 +2,25 @@ import 'package:clock/clock.dart';
|
|||
import 'package:halkyon_base_server/base.dart';
|
||||
import 'package:serverpod/serverpod.dart';
|
||||
|
||||
/// Deletes the anonymous people nobody can return to, daily, and the IP
|
||||
/// addresses of sign-up attempts the rate limit is done with and the email
|
||||
/// sign-in codes past their time, hourly: halkyon_base's pruning (ADR 0014),
|
||||
/// Deletes the anonymous accounts left from before (ADR 0020, D25), daily,
|
||||
/// and the IP addresses of attempts the rate limits are done with and the
|
||||
/// email sign-in codes past their time, hourly: halkyon_base's pruning (ADR 0014),
|
||||
/// which the server schedules when it starts (`schedulePruning`). Then the
|
||||
/// instance's accounts (ADR 0016): as its register, telling the members
|
||||
/// again of the accounts gone, hourly; as a member, deleting the people
|
||||
/// whose account the register no longer knows, daily.
|
||||
class PruningFutureCall extends FutureCall {
|
||||
/// Prunes one batch and logs how many people went; 30 days after GitHub
|
||||
/// sign-in ended (`GITHUB_SIGN_IN_ENDS`), deletes the accounts that had
|
||||
/// no other way in and forgets every GitHub ID too, on the register; and
|
||||
/// forgets the resets that lapsed (ADR 0017).
|
||||
Future<void> pruneAnonymousPeople(Session session) async {
|
||||
/// Prunes one batch of anonymous accounts and logs how many people went;
|
||||
/// 30 days after GitHub sign-in ended (`GITHUB_SIGN_IN_ENDS`), deletes the
|
||||
/// accounts that had no other way in and forgets every GitHub ID too, on
|
||||
/// the register; and forgets the resets that lapsed (ADR 0017).
|
||||
Future<void> pruneAccounts(Session session) async {
|
||||
final now = clock.now();
|
||||
final pruned = await pruneAbandonedAnonymousPeople(session, now: now);
|
||||
final pruned = await pruneAnonymousPeople(session);
|
||||
final gitHub = await forgetGitHubAccounts(session, now: now);
|
||||
final resets = await forgetLapsedResets(session, now: now);
|
||||
session.log(
|
||||
'Pruned $pruned abandoned anonymous people, $gitHub GitHub IDs and '
|
||||
'Pruned $pruned anonymous people, $gitHub GitHub IDs and '
|
||||
'$resets lapsed resets.',
|
||||
);
|
||||
}
|
||||
|
|
|
|||
|
|
@ -166,13 +166,11 @@ class _FutureCalls {
|
|||
}
|
||||
|
||||
class _PruningFutureCall {
|
||||
Future<void> pruneAnonymousPeople(
|
||||
_ist.TestSessionBuilder sessionBuilder,
|
||||
) async {
|
||||
Future<void> pruneAccounts(_ist.TestSessionBuilder sessionBuilder) async {
|
||||
var _localUniqueSession =
|
||||
(sessionBuilder as _ist.InternalTestSessionBuilder).internalBuild();
|
||||
try {
|
||||
await _i772x17y.PruningPruneAnonymousPeopleFutureCall().invoke(
|
||||
await _i772x17y.PruningPruneAccountsFutureCall().invoke(
|
||||
_localUniqueSession,
|
||||
null,
|
||||
);
|
||||
|
|
|
|||
|
|
@ -54,15 +54,16 @@ void main() {
|
|||
);
|
||||
});
|
||||
|
||||
test('a device starts without an account through the module, as a '
|
||||
'person of their own', () async {
|
||||
final success = (await call('anonymousIdp', 'login'))! as AuthSuccess;
|
||||
|
||||
final person = await AuthServices.instance.authUsers.get(
|
||||
sessionBuilder.build(),
|
||||
authUserId: success.authUserId,
|
||||
test('makes no account without a way in: the module signs nobody in '
|
||||
'anonymously (ADR 0020, D25)', () {
|
||||
expect(
|
||||
pod.endpoints.getConnectorByName('halkyon_base.anonymousIdp'),
|
||||
isNull,
|
||||
);
|
||||
expect(
|
||||
pod.endpoints.getConnectorByName('halkyon_base.instance'),
|
||||
isNotNull,
|
||||
);
|
||||
expect(person.id, success.authUserId);
|
||||
});
|
||||
|
||||
test("is a member of the instance's register the operator names, and "
|
||||
|
|
@ -86,8 +87,19 @@ void main() {
|
|||
});
|
||||
|
||||
test(
|
||||
'the pruning is scheduled once, however often the server starts',
|
||||
'the pruning is scheduled once, however often the server starts, '
|
||||
'and the one under its earlier name goes',
|
||||
() async {
|
||||
// INSERT INTO "serverpod_future_call" (…) VALUES (…)
|
||||
await FutureCallEntry.db.insertRow(
|
||||
sessionBuilder.build(),
|
||||
FutureCallEntry(
|
||||
name: 'PruningFutureCall.pruneAnonymousPeople',
|
||||
time: DateTime.utc(2026, 10, 25, 3, 17),
|
||||
serverId: 'default',
|
||||
identifier: 'prune-abandoned-anonymous-people',
|
||||
),
|
||||
);
|
||||
await schedulePruning(pod);
|
||||
await schedulePruning(pod);
|
||||
|
||||
|
|
@ -99,14 +111,22 @@ void main() {
|
|||
scheduled.map((entry) => entry.identifier),
|
||||
unorderedEquals(pruningIdentifiers),
|
||||
);
|
||||
expect(
|
||||
await FutureCallEntry.db.count(
|
||||
sessionBuilder.build(),
|
||||
where: (t) =>
|
||||
t.identifier.equals('prune-abandoned-anonymous-people'),
|
||||
),
|
||||
0,
|
||||
);
|
||||
},
|
||||
);
|
||||
},
|
||||
);
|
||||
}
|
||||
|
||||
/// Deletes every rate-limit record, every person (their anonymous accounts
|
||||
/// and sessions go with them, `ON DELETE CASCADE`) and every future call.
|
||||
/// Deletes every rate-limit record, every person (their sessions go with
|
||||
/// them, `ON DELETE CASCADE`) and every future call.
|
||||
Future<void> _deleteAll(Session session) async {
|
||||
await RateLimitedRequestAttempt.db.deleteWhere(
|
||||
session,
|
||||
|
|
|
|||
Loading…
Reference in a new issue