feat(auth): a password with TOTP on the register, and resets

The register's side of signing in with an address, a password that never
leaves the device (SRP-6a) and a code from an authenticator (ADR 0017),
with members forwarding every step through AccountRegister:

- password.set: salt, Argon2id's costs, SRP's verifier, the public keys
  and the private keys wrapped twice, all made on the device; with the
  address a mailed code proves, an anonymous person becomes identified
  under their ID. It signs in once an authenticator is confirmed.
- passwordSignIn.begin and complete: SRP's two steps with a TOTP or
  recovery code. An address nobody has is answered from a decoy key as
  an account would be; every wrong credential is refused alike.
- authenticator: secrets sealed under totpKey (XChaCha20-Poly1305, bound
  to their row), each code accepted once, ten recovery codes with the
  first, the last one kept.
- accountRecovery: a lost authenticator reset 72 hours after the
  password and a mailed code or the recovery phrase ask, a lost password
  set anew with the phrase's signature, or the account reset with new
  keys 72 hours after a mailed code asks; a mail at each start, a
  sign-in calling it off.
- An account with a password no longer signs in by a mailed code or
  GitHub; no new GitHub account is linked where passwords are offered,
  and from GITHUB_SIGN_IN_ENDS GitHub signs nobody in and its IDs go.

Five tables, added by the module's migration; deletePerson deletes
their rows.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_base_server/lib/src/register/instance_api.dart

@@ -221,6 +221,124 @@ Future<Map<String, Object?>?> _answer(
       return {
         'known': [for (final person in known) person.uuid],
       };
+    case RegisterOperation.passwordSignInOffered:
+      return {'offered': await register.passwordSignInOffered(session)};
+    case RegisterOperation.setPassword:
+      await register.setPassword(
+        session,
+        person: arguments.id('person'),
+        setup: arguments.model('setup', PasswordSetup.fromJson),
+        request: arguments.optionalId('request'),
+        code: arguments.optionalString('code'),
+      );
+      return const {};
+    case RegisterOperation.beginPasswordSignIn:
+      final challenge = await register.beginPasswordSignIn(
+        session,
+        address: arguments.string('address'),
+        network: arguments.string('network'),
+      );
+      return {'challenge': challenge.toJson()};
+    case RegisterOperation.completePasswordSignIn:
+      final proof = await register.completePasswordSignIn(
+        session,
+        challenge: arguments.id('challenge'),
+        clientValue: arguments.bytes('clientValue'),
+        clientProof: arguments.bytes('clientProof'),
+        totpCode: arguments.optionalString('totpCode'),
+        recoveryCode: arguments.optionalString('recoveryCode'),
+      );
+      return {'proof': proof.toJson()};
+    case RegisterOperation.enrolAuthenticator:
+      final enrolment = await register.enrolAuthenticator(
+        session,
+        person: arguments.id('person'),
+        name: arguments.string('name'),
+        label: arguments.string('label'),
+      );
+      return {'enrolment': enrolment.toJson()};
+    case RegisterOperation.confirmAuthenticator:
+      final codes = await register.confirmAuthenticator(
+        session,
+        person: arguments.id('person'),
+        authenticator: arguments.id('authenticator'),
+        code: arguments.string('code'),
+      );
+      return {'recoveryCodes': codes};
+    case RegisterOperation.authenticatorsOf:
+      final authenticators = await register.authenticatorsOf(
+        session,
+        arguments.id('person'),
+      );
+      return {
+        'authenticators': [
+          for (final authenticator in authenticators) authenticator.toJson(),
+        ],
+      };
+    case RegisterOperation.removeAuthenticator:
+      await register.removeAuthenticator(
+        session,
+        person: arguments.id('person'),
+        authenticator: arguments.id('authenticator'),
+        code: arguments.optionalString('code'),
+      );
+      return const {};
+    case RegisterOperation.newRecoveryCodes:
+      final codes = await register.newRecoveryCodes(
+        session,
+        person: arguments.id('person'),
+        code: arguments.string('code'),
+      );
+      return {'recoveryCodes': codes};
+    case RegisterOperation.resetAuthenticator:
+      final pending = await register.resetAuthenticator(
+        session,
+        challenge: arguments.id('challenge'),
+        clientValue: arguments.bytes('clientValue'),
+        clientProof: arguments.bytes('clientProof'),
+        address: arguments.string('address'),
+        language: arguments.string('language'),
+        request: arguments.optionalId('request'),
+        code: arguments.optionalString('code'),
+        keyChallenge: arguments.optionalId('keyChallenge'),
+        signature: arguments.optionalBytes('signature'),
+      );
+      return {'pending': pending.toJson()};
+    case RegisterOperation.beginKeyProof:
+      final challenge = await register.beginKeyProof(
+        session,
+        address: arguments.string('address'),
+        network: arguments.string('network'),
+      );
+      return {'challenge': challenge.toJson()};
+    case RegisterOperation.resetPasswordWithPhrase:
+      final account = await register.resetPasswordWithPhrase(
+        session,
+        challenge: arguments.id('challenge'),
+        signature: arguments.bytes('signature'),
+        password: arguments.model('password', NewPassword.fromJson),
+        totpCode: arguments.optionalString('totpCode'),
+        recoveryCode: arguments.optionalString('recoveryCode'),
+      );
+      return {'account': account.uuid};
+    case RegisterOperation.startAccountReset:
+      final pending = await register.startAccountReset(
+        session,
+        address: arguments.string('address'),
+        language: arguments.string('language'),
+        request: arguments.id('request'),
+        code: arguments.string('code'),
+      );
+      return {'pending': pending.toJson()};
+    case RegisterOperation.completeAccountReset:
+      final account = await register.completeAccountReset(
+        session,
+        address: arguments.string('address'),
+        request: arguments.id('request'),
+        code: arguments.string('code'),
+        setup: arguments.model('setup', PasswordSetup.fromJson),
+      );
+      return {'account': account.uuid};
   }
   return null;
 }
@@ -276,8 +394,44 @@ extension type const _Arguments(Map<String, Object?> _map) {
     _ => throw FormatException('$name is no list of strings'),
   };
 
+  String? optionalString(String name) => switch (_map[name]) {
+    null => null,
+    final String value => value,
+    _ => throw FormatException('$name is no string'),
+  };
+
   UuidValue id(String name) => UuidValue.withValidation(string(name));
 
+  UuidValue? optionalId(String name) => switch (optionalString(name)) {
+    final value? => UuidValue.withValidation(value),
+    null => null,
+  };
+
+  ByteData bytes(String name) => ByteData.sublistView(
+    base64Decode(string(name)),
+  );
+
+  ByteData? optionalBytes(String name) =>
+      optionalString(name) == null ? null : bytes(name);
+
+  /// The model [read] makes of the object [name]; a [FormatException] for
+  /// what isn't one.
+  T model<T>(String name, T Function(Map<String, dynamic> json) read) {
+    final json = _map[name];
+    if (json is! Map<String, Object?>) {
+      throw FormatException('$name is no object');
+    }
+    try {
+      return read(json);
+    } on FormatException {
+      rethrow;
+    } on Object catch (error) {
+      // A field missing or of another type throws a TypeError: the request
+      // is unreadable all the same.
+      throw FormatException('$name: ${error.runtimeType}');
+    }
+  }
+
   Set<UuidValue> ids(String name) => {
     for (final value in strings(name)) UuidValue.withValidation(value),
   };