halkyon-days/halkyon
Watch
1
0
Fork
You've already forked halkyon
 0
Code Issues Pull requests Projects Releases 37 Packages Wiki Activity Actions

fix(app): every change of how an account is secured asks for the password

Browse source 
The app's side of the owner's proof (OwnerProof, the third reading): adding
an authenticator once one is confirmed, removing a confirmed one and new
recovery codes now ask for the current password beside the code, as
changing the password, a new phrase and deleting already did; one
challenge and one answer per sheet (OwnerAnswer). A wrong password or code
reads as the one refusal the instance gives.

Deleting chooses a code by mail from what the instance says
(secondFactorWorks), no longer from whether an authenticator was ever
confirmed: with the authenticators' reset taken effect but not carried
out, the app offered a code field the instance refused (the fourth
finding). Signed-in calls take no address any more, so a device that
doesn't know it changes the password as any other; deleting by mail asks
for the address only where the device doesn't know it, as the code goes
there (the fifth finding).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-10-21 10:42:55 +02:00
commit a0ae08f975
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64
1 changed files with 468 additions and 315 deletions
Download patch file Download diff file Expand all files Collapse all files

47
packages/halkyon_app/test/password/widget/password_sheets_test.dart
View file

@ -481,7 +481,7 @@ void main() {
});
testWidgets('once set up, changes the password and adds an authenticator '
'only with a code from one before', (tester) async {
'only with the password and a code from one before', (tester) async {
final anna = dependencies.passwordGateway.addAccount(
'anna@example.org',
password: 'correct horse',
@ -504,34 +504,43 @@ void main() {
field('Code from your authenticator app'),
fakeTotpCode,
);
await tester.enterText(field('Current password'), 'correct horse');
await tester.enterText(
field('Code from an authenticator you added before'),
'000000',
);
await tapButton(tester, 'Continue');
expect(
find.text("The code from your other authenticator isn't right."),
find.text("The address, the password or the code isn't right."),
findsOneWidget,
);
await tester.enterText(field('Current password'), 'wrong horse');
await tester.enterText(
field('Code from an authenticator you added before'),
fakeTotpCode,
);
await tapButton(tester, 'Continue');
expect(
find.text("The address, the password or the code isn't right."),
findsOneWidget,
);
expect(anna.authenticators.where((each) => each.confirmed), hasLength(1));
await tester.enterText(field('Current password'), 'correct horse');
await tapButton(tester, 'Continue');
expect(anna.authenticators.where((each) => each.confirmed), hasLength(2));
await tester.tap(find.text('Change password'));
await tester.pumpAndSettle();
await tester.enterText(field('Current password'), 'correct horse');
await tester.enterText(field('New password'), 'better horse');
await tester.enterText(field('New password again'), 'better horse');
await tester.enterText(field('New password'), 'better horses');
await tester.enterText(field('New password again'), 'better horses');
await tester.enterText(
field('Code from your authenticator app'),
fakeTotpCode,
);
await tapButton(tester, 'Change password');
expect(anna.password, 'better horse');
expect(anna.password, 'better horses');
expect(
find.text('Password changed. Your other devices are signed out.'),
findsOneWidget,
@ -605,14 +614,15 @@ void main() {
return anna;
}
testWidgets('removes an authenticator only with a code, and never the '
'last', (tester) async {
testWidgets('removes an authenticator only with the password and a code, '
'and never the last', (tester) async {
final anna = await annaSignedIn();
final passwords = dependencies.passwords;
final laptop = await passwords.enrol(name: 'Laptop', label: 'anna');
await passwords.confirm(
laptop.id,
fakeTotpCode,
password: 'correct horse',
existingCode: fakeTotpCode,
);
await show(tester);
@ -620,25 +630,31 @@ void main() {
await tester.tap(find.byTooltip('Remove').first);
await tester.pumpAndSettle();
expect(find.text('Remove Phone?'), findsOneWidget);
await tester.enterText(field('Current password'), 'correct horse');
await tester.enterText(
field('Code from your authenticator app'),
'000000',
);
await tapButton(tester, 'Remove');
expect(
find.text("This code isn't right. Enter the one your app shows now."),
find.text("The address, the password or the code isn't right."),
findsOneWidget,
);
expect(anna.authenticators, hasLength(2));
await tester.enterText(field('Current password'), 'wrong horse');
await tester.enterText(
field('Code from your authenticator app'),
fakeTotpCode,
);
await tapButton(tester, 'Remove');
expect(anna.authenticators, hasLength(2));
await tester.enterText(field('Current password'), 'correct horse');
await tapButton(tester, 'Remove');
expect(anna.authenticators.map((each) => each.name), ['Laptop']);
await tester.tap(find.byTooltip('Remove'));
await tester.pumpAndSettle();
await tester.enterText(field('Current password'), 'correct horse');
await tester.enterText(
field('Code from your authenticator app'),
fakeTotpCode,
@ -652,24 +668,33 @@ void main() {
expect(anna.authenticators, hasLength(1));
});
testWidgets('makes new recovery codes only with a code, the old ones '
'gone', (tester) async {
testWidgets('makes new recovery codes only with the password and a code, '
'the old ones gone', (tester) async {
final anna = await annaSignedIn();
await show(tester);
await tester.tap(find.text('New recovery codes'));
await tester.pumpAndSettle();
await tester.enterText(field('Current password'), 'correct horse');
await tester.enterText(
field('Code from your authenticator app'),
'000000',
);
await tapButton(tester, 'Continue');
expect(
find.text("This code isn't right. Enter the one your app shows now."),
find.text("The address, the password or the code isn't right."),
findsOneWidget,
);
expect(anna.recoveryCodes.first, 'AAAA-0001');
await tester.enterText(field('Current password'), 'wrong horse');
await tester.enterText(
field('Code from your authenticator app'),
fakeTotpCode,
);
await tapButton(tester, 'Continue');
expect(anna.recoveryCodes.first, 'AAAA-0001');
await tester.enterText(field('Current password'), 'correct horse');
await tester.enterText(
field('Code from your authenticator app'),
fakeTotpCode,