halkyon-days/halkyon
Watch
1
0
Fork
You've already forked halkyon
 0
Code Issues Pull requests Projects Releases 37 Packages Wiki Activity Actions

fix(auth): a reset waits while its owner is held out, and devices show it

Browse source 
The full reading's H1: an owner could be kept from calling a reset off, and
the reset then went through. Whoever knew the password and had the mailbox
asked an authenticators' reset and kept the codes waiting, so the owner's
sign-ins were refused until it took effect; whoever had the mailbox filled
the address's proofs ceiling from three networks and completed an account
reset. Now every hold-out of the owner after a reset was asked (a wait
that begins, an attempt a wait refuses, a sign-in or proof refused by the
address's ceiling) moves the account's resets not carried out to take
effect no sooner than 72 hours after it ends (pushOutResets). A reset
carried out (the password alone signing in until an authenticator is
confirmed) is never pushed, nor a lapsed one brought back.

Signed-in devices are told too: SignInWays carries when a waiting reset
of each kind takes effect, the account section shows them with Call it
off, which takes the owner's proof (password and code; password.
callOffResets, forwarded by members) and calls every reset off, as no wait
holds a signed-in owner's proof back. Texts in English and German.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-10-21 13:17:30 +02:00
commit 9d0d037c86
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64
1 changed files with 1022 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

42
packages/halkyon_app/test/password/widget/password_sheets_test.dart
View file

@ -689,6 +689,48 @@ void main() {
return anna;
}
testWidgets('shows the resets waiting, called off only with the '
'password and a code', (tester) async {
final anna = await annaSignedIn();
anna
..authenticatorReset = DateTime.utc(2026, 10, 24, 12)
..accountReset = DateTime.utc(2026, 10, 25, 12);
await show(tester);
expect(find.text('A reset is waiting'), findsOneWidget);
expect(
find.textContaining('Your authenticators will be removed on'),
findsOneWidget,
);
expect(
find.textContaining('Your account will get a new password'),
findsOneWidget,
);
await tester.tap(find.widgetWithText(TextButton, 'Call it off'));
await tester.pumpAndSettle();
await tester.enterText(field('Current password'), 'correct horse');
await tester.enterText(
field('Code from your authenticator app'),
'000000',
);
await tapButton(tester, 'Call it off');
expect(
find.text("The address, the password or the code isn't right."),
findsOneWidget,
);
expect(anna.accountReset, isNotNull);
await tester.enterText(
field('Code from your authenticator app'),
fakeTotpCode,
);
await tapButton(tester, 'Call it off');
expect(find.text('A reset is waiting'), findsNothing);
expect(anna.authenticatorReset, isNull);
expect(anna.accountReset, isNull);
});
testWidgets('removes an authenticator only with the password and a code, '
'and never the last', (tester) async {
final anna = await annaSignedIn();