halkyon-days/halkyon
Watch
1
0
Fork
You've already forked halkyon
 0
Code Issues Pull requests Projects Releases 40 Packages Wiki Activity Actions

fix(app): every change of how an account is secured asks for the password

Browse source 
The app's side of the owner's proof (OwnerProof, the third reading): adding
an authenticator once one is confirmed, removing a confirmed one and new
recovery codes now ask for the current password beside the code, as
changing the password, a new phrase and deleting already did; one
challenge and one answer per sheet (OwnerAnswer). A wrong password or code
reads as the one refusal the instance gives.

Deleting chooses a code by mail from what the instance says
(secondFactorWorks), no longer from whether an authenticator was ever
confirmed: with the authenticators' reset taken effect but not carried
out, the app offered a code field the instance refused (the fourth
finding). Signed-in calls take no address any more, so a device that
doesn't know it changes the password as any other; deleting by mail asks
for the address only where the device doesn't know it, as the code goes
there (the fifth finding).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-10-21 10:42:55 +02:00
commit a0ae08f975
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64
1 changed files with 468 additions and 315 deletions
Download patch file Download diff file Expand all files Collapse all files

16
packages/halkyon_app/lib/l10n/halkyon_app_localizations_en.dart
View file

@ -428,6 +428,10 @@ class HalkyonAppLocalizationsEn extends HalkyonAppLocalizations {
@override
String get passwordAuthenticatorCodeIntro => 'Then enter the code it shows.';
@override
String get passwordAuthenticatorOwnerIntro =>
'To add it, confirm it is you: your password and a code from an authenticator you added before.';
@override
String get passwordExistingCode =>
'Code from an authenticator you added before';
@ -592,7 +596,7 @@ class HalkyonAppLocalizationsEn extends HalkyonAppLocalizations {
@override
String get passwordSectionRemoveIntro =>
'Enter a code from one of your authenticators to confirm.';
'Enter your password and a code from one of your authenticators to confirm.';
@override
String get passwordSectionRemoveAction => 'Remove';
@ -628,7 +632,7 @@ class HalkyonAppLocalizationsEn extends HalkyonAppLocalizations {
@override
String get passwordNewCodesIntro =>
'Enter a code from your authenticator app. Your old recovery codes stop working.';
'Enter your password and a code from your authenticator app. Your old recovery codes stop working.';
@override
String get passwordNewPhraseIntro =>
@ -678,10 +682,6 @@ class HalkyonAppLocalizationsEn extends HalkyonAppLocalizations {
String get passwordWrongCode =>
'This code isn\'t right. Enter the one your app shows now.';
@override
String get passwordWrongExistingCode =>
'The code from your other authenticator isn\'t right.';
@override
String get passwordLastAuthenticator =>
'Your last authenticator can\'t go: every sign-in needs one.';
@ -782,11 +782,11 @@ class HalkyonAppLocalizationsEn extends HalkyonAppLocalizations {
@override
String get passwordAddressUnknown =>
'This device doesn\'t know your account\'s address, which this takes. Sign out, then sign in again with your address and password.';
'Enter your account\'s email address: the code goes there.';
@override
String get passwordDeleteIntroByMail =>
'Your account goes with everything in it, in every service of this instance. Its authenticator isn\'t set up, so a code by mail confirms it: type your password, then the code we email to your address.';
'Your account goes with everything in it, in every service of this instance. None of its authenticators works now, so a code by mail confirms it: type your password, then the code we email to your address.';
@override
String get passwordDeleteSendCode => 'Email me a code';