halkyon-days/halkyon
Watch
1
0
Fork
You've already forked halkyon
 0
Code Issues Pull requests Projects Releases 40 Packages Wiki Activity Actions

fix(app): every change of how an account is secured asks for the password

Browse source 
The app's side of the owner's proof (OwnerProof, the third reading): adding
an authenticator once one is confirmed, removing a confirmed one and new
recovery codes now ask for the current password beside the code, as
changing the password, a new phrase and deleting already did; one
challenge and one answer per sheet (OwnerAnswer). A wrong password or code
reads as the one refusal the instance gives.

Deleting chooses a code by mail from what the instance says
(secondFactorWorks), no longer from whether an authenticator was ever
confirmed: with the authenticators' reset taken effect but not carried
out, the app offered a code field the instance refused (the fourth
finding). Signed-in calls take no address any more, so a device that
doesn't know it changes the password as any other; deleting by mail asks
for the address only where the device doesn't know it, as the code goes
there (the fifth finding).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-10-21 10:42:55 +02:00
commit a0ae08f975
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64
1 changed files with 468 additions and 315 deletions
Download patch file Download diff file Expand all files Collapse all files

20
packages/halkyon_app/lib/l10n/halkyon_app_localizations.dart
View file

@ -805,6 +805,12 @@ abstract class HalkyonAppLocalizations {
/// **'Then enter the code it shows.'**
String get passwordAuthenticatorCodeIntro;
/// No description provided for @passwordAuthenticatorOwnerIntro.
///
/// In en, this message translates to:
/// **'To add it, confirm it is you: your password and a code from an authenticator you added before.'**
String get passwordAuthenticatorOwnerIntro;
/// No description provided for @passwordExistingCode.
///
/// In en, this message translates to:
@ -1072,7 +1078,7 @@ abstract class HalkyonAppLocalizations {
/// No description provided for @passwordSectionRemoveIntro.
///
/// In en, this message translates to:
/// **'Enter a code from one of your authenticators to confirm.'**
/// **'Enter your password and a code from one of your authenticators to confirm.'**
String get passwordSectionRemoveIntro;
/// No description provided for @passwordSectionRemoveAction.
@ -1138,7 +1144,7 @@ abstract class HalkyonAppLocalizations {
/// No description provided for @passwordNewCodesIntro.
///
/// In en, this message translates to:
/// **'Enter a code from your authenticator app. Your old recovery codes stop working.'**
/// **'Enter your password and a code from your authenticator app. Your old recovery codes stop working.'**
String get passwordNewCodesIntro;
/// No description provided for @passwordNewPhraseIntro.
@ -1219,12 +1225,6 @@ abstract class HalkyonAppLocalizations {
/// **'This code isn\'t right. Enter the one your app shows now.'**
String get passwordWrongCode;
/// No description provided for @passwordWrongExistingCode.
///
/// In en, this message translates to:
/// **'The code from your other authenticator isn\'t right.'**
String get passwordWrongExistingCode;
/// No description provided for @passwordLastAuthenticator.
///
/// In en, this message translates to:
@ -1378,13 +1378,13 @@ abstract class HalkyonAppLocalizations {
/// No description provided for @passwordAddressUnknown.
///
/// In en, this message translates to:
/// **'This device doesn\'t know your account\'s address, which this takes. Sign out, then sign in again with your address and password.'**
/// **'Enter your account\'s email address: the code goes there.'**
String get passwordAddressUnknown;
/// No description provided for @passwordDeleteIntroByMail.
///
/// In en, this message translates to:
/// **'Your account goes with everything in it, in every service of this instance. Its authenticator isn\'t set up, so a code by mail confirms it: type your password, then the code we email to your address.'**
/// **'Your account goes with everything in it, in every service of this instance. None of its authenticators works now, so a code by mail confirms it: type your password, then the code we email to your address.'**
String get passwordDeleteIntroByMail;
/// No description provided for @passwordDeleteSendCode.