halkyon-days/halkyon
Watch
1
0
Fork
You've already forked halkyon
 0
Code Issues Pull requests Projects Releases 37 Packages Wiki Activity Actions

feat(base): SimpleLogin's forwarding page and Learn's App Links statement (ADR 0020, step 1)

Browse source 
SimpleLogin takes only https redirect addresses, each registered exactly,
so the instance's SimpleLogin app registers one page on the register's
web server, /simplelogin-callback, which sends the browser on to the app
that began the sign-in: a 303 to the desktop's loopback (127.0.0.1, a port
per app) or the phone's scheme, chosen by the marker the state begins with
(`<app>-<platform>.<rest>`, the rest 1 to 512 characters of base64url),
from a fixed table, so it sends nobody anywhere else. It forwards the code
or SimpleLogin's error (`deny`) with the state and nothing else, refuses
anything malformed, repeated or not a GET with a page that repeats nothing
it was given, and keeps and logs nothing (no-store, no referrer). It is
built ahead of the sign-in itself so development can sign in through
learn.halkyon.eu's page, which the development app registers too.

Android's assetlinks.json for Halkyon Learn signed with the release key
is answered by the Caddyfile on learn.halkyon.eu alone: the one domain the
project's builds name, and the server knows no app's key. A root test
holds its fingerprint to tool/release/android-certificate.sha256. The
app's intent filter comes with the sign-in; iOS's association waits for
an Apple team ID.

The profile page's language choice and look move to common/web_page.dart,
shared by both pages.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-10-23 15:27:56 +02:00
commit 8d6785f5c6
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64
1 changed files with 582 additions and 47 deletions
Download patch file Download diff file Expand all files Collapse all files

14
packages/halkyon_base_server/README.md
View file

@ -43,6 +43,15 @@ Endpoints, under the nickname `base` in a host's client (`client.modules.base.em
`https://<account domain>/@handle` (`ACCOUNT_DOMAIN`, else the server's public host),
served by `addProfilePageRoute`, in English or German, its foot what the host's
`profilePageNote` says.
- SimpleLogin's forwarding page (Halkyon Learn's ADR 0020; `addSimpleLoginCallbackRoute`,
on the register): `/simplelogin-callback`, the one address the instance's SimpleLogin
app registers, as SimpleLogin takes only https addresses, each registered exactly. It
answers a 303 to the app that began the sign-in, with SimpleLogin's `code` (or its
`error`) and the `state`, and nothing else: the state is `<app>-<platform>.<rest>`, the
marker one of `simpleLoginReturns` (the desktop's loopback, `127.0.0.1` on a port of each
app's own, or the phone's scheme, the app's ID), the rest 1 to 512 characters of
base64url; anything else gets a page saying the sign-in can't go on, repeating nothing
it was given. It keeps and logs nothing.
- **Per-network limits** (new anonymous accounts, codes by mail, password sign-ins,
proofs of the recovery phrase) count by the visitor's IP address (`networkOf`): the
connection's, or, for a connection from a proxy the operator trusts
@ -399,8 +408,9 @@ Built on the three parts above, on the register (members forward every step thro
```
Serve the calls between the instance's services on its web server:
`addInstanceRoutes(pod)`; and the profile pages: `addProfilePageRoute(pod)`, after any
literal routes of its own.
`addInstanceRoutes(pod)`; on the register, SimpleLogin's forwarding page:
`addSimpleLoginCallbackRoute(pod)`; and the profile pages: `addProfilePageRoute(pod)`,
after any literal routes of its own.
Then schedule the pruning in a future call of the host's own: daily
`pruneAbandonedAnonymousPeople`, `forgetGitHubAccounts` (the register's),