halkyon-days/halkyon
Watch
1
0
Fork
You've already forked halkyon
 0
Code Issues Pull requests Projects Releases 37 Packages Wiki Activity Actions 1

fix(app): every change of how an account is secured asks for the password

Browse source 
The app's side of the owner's proof (OwnerProof, the third reading): adding
an authenticator once one is confirmed, removing a confirmed one and new
recovery codes now ask for the current password beside the code, as
changing the password, a new phrase and deleting already did; one
challenge and one answer per sheet (OwnerAnswer). A wrong password or code
reads as the one refusal the instance gives.

Deleting chooses a code by mail from what the instance says
(secondFactorWorks), no longer from whether an authenticator was ever
confirmed: with the authenticators' reset taken effect but not carried
out, the app offered a code field the instance refused (the fourth
finding). Signed-in calls take no address any more, so a device that
doesn't know it changes the password as any other; deleting by mail asks
for the address only where the device doesn't know it, as the code goes
there (the fifth finding).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-10-21 10:42:55 +02:00
commit a0ae08f975
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64
1 changed files with 468 additions and 315 deletions
Download patch file Download diff file Expand all files Collapse all files

42
packages/halkyon_app/test/password/bloc/account_security_cubit_test.dart
View file

@ -61,6 +61,7 @@ void main() {
await passwords.confirm(
added.id,
fakeTotpCode,
password: 'correct horse',
existingCode: fakeTotpCode,
);
await pumpEventQueue();
@ -132,8 +133,9 @@ void main() {
.having((state) => state.busy, 'busy', busy)
.having((state) => state.problem?.problem, 'problem', problem);
test('takes its code and one from an authenticator added before, '
'refusing a wrong one, nothing added meanwhile', () async {
test("takes its code and the owner's proof (the password and a code "
'from an authenticator added before), refusing a wrong one, nothing '
'added meanwhile', () async {
final cubit = AddAuthenticatorCubit(
passwords,
label: 'anna@example.org',
@ -151,17 +153,37 @@ void main() {
expect(
await statesOf(
cubit,
() => cubit.codeEntered(fakeTotpCode, existingCode: '000000'),
() => cubit.codeEntered(
fakeTotpCode,
password: 'correct horse',
existingCode: '000000',
),
),
[
at(AddAuthenticatorStep.code, busy: true),
at(
AddAuthenticatorStep.code,
problem: PasswordProblem.wrongExistingCode,
problem: PasswordProblem.wrongCredentials,
),
],
);
await cubit.codeEntered('000000', existingCode: fakeTotpCode);
await cubit.codeEntered(
fakeTotpCode,
password: 'wrong',
existingCode: fakeTotpCode,
);
expect(
cubit.state,
at(
AddAuthenticatorStep.code,
problem: PasswordProblem.wrongCredentials,
),
);
await cubit.codeEntered(
'000000',
password: 'correct horse',
existingCode: fakeTotpCode,
);
expect(
cubit.state,
at(AddAuthenticatorStep.code, problem: PasswordProblem.wrongCode),
@ -171,7 +193,11 @@ void main() {
expect(
await statesOf(
cubit,
() => cubit.codeEntered(fakeTotpCode, existingCode: fakeTotpCode),
() => cubit.codeEntered(
fakeTotpCode,
password: 'correct horse',
existingCode: fakeTotpCode,
),
),
[
at(AddAuthenticatorStep.code, busy: true),
@ -264,7 +290,6 @@ void main() {
['wrong', 'wrong', 'wrong'],
password: 'correct horse',
code: fakeTotpCode,
language: 'en',
);
expect(cubit.state, at(NewPhraseStep.check, phraseWrong: true));
// Nothing reached the instance before the words were right.
@ -277,7 +302,6 @@ void main() {
wordsAsked(cubit.state),
password: 'wrong',
code: fakeTotpCode,
language: 'en',
),
),
[
@ -289,7 +313,6 @@ void main() {
wordsAsked(cubit.state),
password: 'correct horse',
code: '000000',
language: 'en',
);
expect(
cubit.state,
@ -304,7 +327,6 @@ void main() {
wordsAsked(cubit.state),
password: 'correct horse',
code: fakeTotpCode,
language: 'en',
),
),
[