halkyon-days/halkyon
Watch
1
0
Fork
You've already forked halkyon
 0
Code Issues Pull requests Projects Releases 37 Packages Wiki Activity Actions

fix(app): every change of how an account is secured asks for the password

Browse source 
The app's side of the owner's proof (OwnerProof, the third reading): adding
an authenticator once one is confirmed, removing a confirmed one and new
recovery codes now ask for the current password beside the code, as
changing the password, a new phrase and deleting already did; one
challenge and one answer per sheet (OwnerAnswer). A wrong password or code
reads as the one refusal the instance gives.

Deleting chooses a code by mail from what the instance says
(secondFactorWorks), no longer from whether an authenticator was ever
confirmed: with the authenticators' reset taken effect but not carried
out, the app offered a code field the instance refused (the fourth
finding). Signed-in calls take no address any more, so a device that
doesn't know it changes the password as any other; deleting by mail asks
for the address only where the device doesn't know it, as the code goes
there (the fifth finding).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-10-21 10:42:55 +02:00
commit a0ae08f975
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64
4 changed files with 468 additions and 315 deletions
Download patch file Download diff file Expand all files Collapse all files

48
packages/halkyon_app/test/auth/widget/account_tiles_test.dart
View file

@ -1,3 +1,4 @@
import 'package:clock/clock.dart';
import 'package:flutter_test/flutter_test.dart';
import 'package:halkyon_app/halkyon_app.dart';
import 'package:halkyon_app/testing.dart';
@ -220,6 +221,53 @@ void main() {
);
});
testWidgets("deleting an account whose authenticators' reset took effect "
'asks for a code by mail, as the instance takes it, and for the '
"address where this device doesn't know it", (tester) async {
// The first person the fake password gateway makes.
const person = '00000000-0000-4000-8000-000000000001';
gateway = FakeAuthGateway(
status: const SignedIn(authUserId: person, isIdentified: true),
);
await start(tester);
// Its authenticator still confirmed, the reset taken effect but not
// carried out (the third reading's fourth finding).
dependencies.passwordGateway
.addAccount(
'anna@example.org',
password: 'correct horse',
crypto: dependencies.crypto,
)
.authenticatorReset = clock.now().subtract(
const Duration(hours: 1),
);
Finder field(String label) => find.widgetWithText(TextField, label);
await tester.tap(find.text('Delete account'));
await tester.pumpAndSettle();
await tester.tap(find.text('Delete account').last);
await tester.pumpAndSettle();
expect(find.textContaining('a code by mail confirms it'), findsOneWidget);
await tester.enterText(field('Current password'), 'correct horse');
await tester.enterText(field('Email address'), 'anna@example.org');
await tester.tap(find.text('Email me a code'));
await tester.pumpAndSettle();
expect(
dependencies.passwordGateway.mailed.single.purpose,
MailCodePurpose.deletion,
);
await tester.enterText(
field('Code from the email'),
dependencies.passwordGateway.codeFor('anna@example.org'),
);
await tester.tap(find.text('Delete account').last);
await tester.pumpAndSettle();
expect(gateway.accountDeletions, 1);
});
testWidgets('deleting an account with a password asks for it and a '
'code, which a wrong one fails, deleting nothing', (tester) async {
// The first person the fake password gateway makes.

42
packages/halkyon_app/test/password/bloc/account_security_cubit_test.dart
View file

@ -61,6 +61,7 @@ void main() {
await passwords.confirm(
added.id,
fakeTotpCode,
password: 'correct horse',
existingCode: fakeTotpCode,
);
await pumpEventQueue();
@ -132,8 +133,9 @@ void main() {
.having((state) => state.busy, 'busy', busy)
.having((state) => state.problem?.problem, 'problem', problem);
test('takes its code and one from an authenticator added before, '
'refusing a wrong one, nothing added meanwhile', () async {
test("takes its code and the owner's proof (the password and a code "
'from an authenticator added before), refusing a wrong one, nothing '
'added meanwhile', () async {
final cubit = AddAuthenticatorCubit(
passwords,
label: 'anna@example.org',
@ -151,17 +153,37 @@ void main() {
expect(
await statesOf(
cubit,
() => cubit.codeEntered(fakeTotpCode, existingCode: '000000'),
() => cubit.codeEntered(
fakeTotpCode,
password: 'correct horse',
existingCode: '000000',
),
),
[
at(AddAuthenticatorStep.code, busy: true),
at(
AddAuthenticatorStep.code,
problem: PasswordProblem.wrongExistingCode,
problem: PasswordProblem.wrongCredentials,
),
],
);
await cubit.codeEntered('000000', existingCode: fakeTotpCode);
await cubit.codeEntered(
fakeTotpCode,
password: 'wrong',
existingCode: fakeTotpCode,
);
expect(
cubit.state,
at(
AddAuthenticatorStep.code,
problem: PasswordProblem.wrongCredentials,
),
);
await cubit.codeEntered(
'000000',
password: 'correct horse',
existingCode: fakeTotpCode,
);
expect(
cubit.state,
at(AddAuthenticatorStep.code, problem: PasswordProblem.wrongCode),
@ -171,7 +193,11 @@ void main() {
expect(
await statesOf(
cubit,
() => cubit.codeEntered(fakeTotpCode, existingCode: fakeTotpCode),
() => cubit.codeEntered(
fakeTotpCode,
password: 'correct horse',
existingCode: fakeTotpCode,
),
),
[
at(AddAuthenticatorStep.code, busy: true),
@ -264,7 +290,6 @@ void main() {
['wrong', 'wrong', 'wrong'],
password: 'correct horse',
code: fakeTotpCode,
language: 'en',
);
expect(cubit.state, at(NewPhraseStep.check, phraseWrong: true));
// Nothing reached the instance before the words were right.
@ -277,7 +302,6 @@ void main() {
wordsAsked(cubit.state),
password: 'wrong',
code: fakeTotpCode,
language: 'en',
),
),
[
@ -289,7 +313,6 @@ void main() {
wordsAsked(cubit.state),
password: 'correct horse',
code: '000000',
language: 'en',
);
expect(
cubit.state,
@ -304,7 +327,6 @@ void main() {
wordsAsked(cubit.state),
password: 'correct horse',
code: fakeTotpCode,
language: 'en',
),
),
[

48
packages/halkyon_app/test/password/data/password_repository_test.dart
View file

@ -194,7 +194,7 @@ void main() {
await settle();
await expectLater(
passwords.deleteAccount(password: 'battery staple', language: 'en'),
passwords.deleteAccount(password: 'battery staple'),
failsWith(PasswordProblem.wrongCredentials),
);
final mailed = await passwords.mailDeletionCode(language: 'en');
@ -204,7 +204,6 @@ void main() {
password: 'battery staple',
request: mailed.request,
code: gateway.codeFor('carla@example.org'),
language: 'en',
);
expect(gateway.accounts, isNot(contains('carla@example.org')));
});
@ -317,7 +316,6 @@ void main() {
oldPassword: 'correct horse',
newPassword: 'better horse',
totpCode: fakeTotpCode,
language: 'en',
);
expect(anna.password, 'better horse');
@ -340,7 +338,6 @@ void main() {
oldPassword: 'wrong',
newPassword: 'better horse',
totpCode: fakeTotpCode,
language: 'en',
),
failsWith(PasswordProblem.wrongCredentials),
);
@ -350,44 +347,36 @@ void main() {
oldPassword: 'correct horse',
newPassword: 'better horse',
totpCode: fakeTotpCode,
language: 'en',
),
failsWith(PasswordProblem.keysMissing),
);
expect(anna.password, 'correct horse');
});
test('sends the address this device signed in with, and says when it '
"doesn't know it, sending nothing", () async {
test("takes no address while signed in: a device that doesn't know it "
'changes the password, and asks for one only to mail a code for '
'deleting', () async {
addresses.addresses.clear();
await passwords.changePassword(
oldPassword: 'correct horse',
newPassword: 'better horse',
newPassword: 'better horses',
totpCode: fakeTotpCode,
language: 'en',
);
expect(anna.password, 'better horse');
expect(anna.password, 'better horses');
addresses.addresses.clear();
final calls = gateway.calls.length;
await expectLater(
passwords.changePassword(
oldPassword: 'better horse',
newPassword: 'best horse',
totpCode: fakeTotpCode,
language: 'en',
),
failsWith(PasswordProblem.addressUnknown),
);
await expectLater(
passwords.deleteAccount(
password: 'better horse',
totpCode: fakeTotpCode,
language: 'en',
),
passwords.mailDeletionCode(language: 'en'),
failsWith(PasswordProblem.addressUnknown),
);
expect(gateway.calls, hasLength(calls));
expect(anna.password, 'better horse');
expect(
(await passwords.mailDeletionCode(
language: 'en',
address: ' anna@example.org ',
)).address,
'anna@example.org',
);
});
test('deletes the account with the password and a code alone, then '
@ -396,12 +385,11 @@ void main() {
passwords.deleteAccount(
password: 'wrong',
totpCode: fakeTotpCode,
language: 'en',
),
failsWith(PasswordProblem.wrongCredentials),
);
await expectLater(
passwords.deleteAccount(password: 'correct horse', language: 'en'),
passwords.deleteAccount(password: 'correct horse'),
failsWith(PasswordProblem.wrongCredentials),
);
expect(gateway.accounts, contains('anna@example.org'));
@ -410,7 +398,6 @@ void main() {
await passwords.deleteAccount(
password: 'correct horse',
totpCode: fakeTotpCode,
language: 'en',
);
expect(gateway.accounts, isNot(contains('anna@example.org')));
@ -426,7 +413,6 @@ void main() {
phrase,
password: 'correct horse',
code: '000000',
language: 'en',
),
failsWith(PasswordProblem.wrongCredentials),
);
@ -435,7 +421,6 @@ void main() {
phrase,
password: 'wrong',
code: fakeTotpCode,
language: 'en',
),
failsWith(PasswordProblem.wrongCredentials),
);
@ -445,7 +430,6 @@ void main() {
phrase,
password: 'correct horse',
code: fakeTotpCode,
language: 'en',
);
await auth.signOut();

47
packages/halkyon_app/test/password/widget/password_sheets_test.dart
View file

@ -481,7 +481,7 @@ void main() {
});
testWidgets('once set up, changes the password and adds an authenticator '
'only with a code from one before', (tester) async {
'only with the password and a code from one before', (tester) async {
final anna = dependencies.passwordGateway.addAccount(
'anna@example.org',
password: 'correct horse',
@ -504,34 +504,43 @@ void main() {
field('Code from your authenticator app'),
fakeTotpCode,
);
await tester.enterText(field('Current password'), 'correct horse');
await tester.enterText(
field('Code from an authenticator you added before'),
'000000',
);
await tapButton(tester, 'Continue');
expect(
find.text("The code from your other authenticator isn't right."),
find.text("The address, the password or the code isn't right."),
findsOneWidget,
);
await tester.enterText(field('Current password'), 'wrong horse');
await tester.enterText(
field('Code from an authenticator you added before'),
fakeTotpCode,
);
await tapButton(tester, 'Continue');
expect(
find.text("The address, the password or the code isn't right."),
findsOneWidget,
);
expect(anna.authenticators.where((each) => each.confirmed), hasLength(1));
await tester.enterText(field('Current password'), 'correct horse');
await tapButton(tester, 'Continue');
expect(anna.authenticators.where((each) => each.confirmed), hasLength(2));
await tester.tap(find.text('Change password'));
await tester.pumpAndSettle();
await tester.enterText(field('Current password'), 'correct horse');
await tester.enterText(field('New password'), 'better horse');
await tester.enterText(field('New password again'), 'better horse');
await tester.enterText(field('New password'), 'better horses');
await tester.enterText(field('New password again'), 'better horses');
await tester.enterText(
field('Code from your authenticator app'),
fakeTotpCode,
);
await tapButton(tester, 'Change password');
expect(anna.password, 'better horse');
expect(anna.password, 'better horses');
expect(
find.text('Password changed. Your other devices are signed out.'),
findsOneWidget,
@ -605,14 +614,15 @@ void main() {
return anna;
}
testWidgets('removes an authenticator only with a code, and never the '
'last', (tester) async {
testWidgets('removes an authenticator only with the password and a code, '
'and never the last', (tester) async {
final anna = await annaSignedIn();
final passwords = dependencies.passwords;
final laptop = await passwords.enrol(name: 'Laptop', label: 'anna');
await passwords.confirm(
laptop.id,
fakeTotpCode,
password: 'correct horse',
existingCode: fakeTotpCode,
);
await show(tester);
@ -620,25 +630,31 @@ void main() {
await tester.tap(find.byTooltip('Remove').first);
await tester.pumpAndSettle();
expect(find.text('Remove Phone?'), findsOneWidget);
await tester.enterText(field('Current password'), 'correct horse');
await tester.enterText(
field('Code from your authenticator app'),
'000000',
);
await tapButton(tester, 'Remove');
expect(
find.text("This code isn't right. Enter the one your app shows now."),
find.text("The address, the password or the code isn't right."),
findsOneWidget,
);
expect(anna.authenticators, hasLength(2));
await tester.enterText(field('Current password'), 'wrong horse');
await tester.enterText(
field('Code from your authenticator app'),
fakeTotpCode,
);
await tapButton(tester, 'Remove');
expect(anna.authenticators, hasLength(2));
await tester.enterText(field('Current password'), 'correct horse');
await tapButton(tester, 'Remove');
expect(anna.authenticators.map((each) => each.name), ['Laptop']);
await tester.tap(find.byTooltip('Remove'));
await tester.pumpAndSettle();
await tester.enterText(field('Current password'), 'correct horse');
await tester.enterText(
field('Code from your authenticator app'),
fakeTotpCode,
@ -652,24 +668,33 @@ void main() {
expect(anna.authenticators, hasLength(1));
});
testWidgets('makes new recovery codes only with a code, the old ones '
'gone', (tester) async {
testWidgets('makes new recovery codes only with the password and a code, '
'the old ones gone', (tester) async {
final anna = await annaSignedIn();
await show(tester);
await tester.tap(find.text('New recovery codes'));
await tester.pumpAndSettle();
await tester.enterText(field('Current password'), 'correct horse');
await tester.enterText(
field('Code from your authenticator app'),
'000000',
);
await tapButton(tester, 'Continue');
expect(
find.text("This code isn't right. Enter the one your app shows now."),
find.text("The address, the password or the code isn't right."),
findsOneWidget,
);
expect(anna.recoveryCodes.first, 'AAAA-0001');
await tester.enterText(field('Current password'), 'wrong horse');
await tester.enterText(
field('Code from your authenticator app'),
fakeTotpCode,
);
await tapButton(tester, 'Continue');
expect(anna.recoveryCodes.first, 'AAAA-0001');
await tester.enterText(field('Current password'), 'correct horse');
await tester.enterText(
field('Code from your authenticator app'),
fakeTotpCode,