halkyon-days/halkyon
Watch
1
0
Fork
You've already forked halkyon
 0
Code Issues Pull requests Projects Releases 37 Packages Wiki Activity Actions

feat(auth)!: codes by mail no longer sign in

Browse source 
ADR 0017, step 3 (D4: nobody signs in with email codes yet, so the
password replaces them outright). `emailCode.verifyCode`,
`emailSignIn.signIn` and the switch token go, with the register's
`verifySignInCode` and `completeEmailSwitch` and their operations
between services. `emailCode.sendCode` stays, now without a session
(signing up and getting back in have none), as what proves an address
for a password's setup, a sign-up, a setup never finished and the
resets; `accountRecovery.sendCode`, which did that for the resets,
goes. The `switchChallengeId` column stays: Serverpod's challenges
still link a completion token, and older servers read it during a
deploy.

The apps: halkyon_app's email sign-in (its bloc, sheet, gateway calls
and the start screen's Continue with email) goes; Learn's profile and
Todo's account sheet show `AccountSecuritySection` (a password set up
by someone anonymous or signing in with GitHub, whose end it names;
the authenticators; changing the password; new recovery codes and
phrase), which reads anew after every change the repository makes.

BREAKING CHANGE: Learn's `minimumAppBuild` is 22: builds up to 21 sign
in with the endpoints that went. Todo was never released and stays at
build 1.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-10-20 19:31:49 +02:00
commit ae57cbe864
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64
2 changed files with 429 additions and 3835 deletions
Download patch file Download diff file Expand all files Collapse all files

82
packages/halkyon_app/test/auth/data/auth_repository_test.dart
View file

@ -68,86 +68,4 @@ void main() {
expect(gateway.accountDeletions, 1);
expect(gateway.status, const SignedOut());
});
group('signing in with an email address', () {
late FakeAuthGateway gateway;
late MemorySignInAddresses addresses;
late AuthRepository auth;
setUp(() {
gateway = FakeAuthGateway(
status: const SignedIn(authUserId: 'anonymous-1', isIdentified: false),
);
addresses = MemorySignInAddresses();
auth = AuthRepository(gateway, addresses);
});
test("a code for a new address makes it the person's, and this device "
'remembers it for them, to show', () async {
final request = await auth.sendEmailCode(
'anna@example.org',
language: 'en',
);
final outcome = await auth.verifyEmailCode(
request,
'CODE-1',
address: 'anna@example.org',
);
expect(outcome, const EmailLinked());
expect(auth.isIdentified, isTrue);
expect(await auth.emailAddress(), 'anna@example.org');
});
test("a code for another person's address changes nothing here; "
'switching remembers the address for the person switched to, not '
'the one left', () async {
gateway.addressOwners['ben@example.org'] = 'ben';
final request = await auth.sendEmailCode(
'ben@example.org',
language: 'en',
);
final outcome = await auth.verifyEmailCode(
request,
'CODE-1',
address: 'ben@example.org',
);
expect(outcome, isA<EmailTakenByAnotherPerson>());
expect(auth.isIdentified, isFalse);
expect(addresses.addresses, isEmpty);
await auth.switchToEmail(
(outcome as EmailTakenByAnotherPerson).switchToken,
address: 'ben@example.org',
);
expect(
gateway.status,
const SignedIn(authUserId: 'ben', isIdentified: true),
);
expect(addresses.addresses, {'ben': 'ben@example.org'});
expect(await auth.emailAddress(), 'ben@example.org');
});
test('a wrong code remembers nothing', () async {
final request = await auth.sendEmailCode(
'anna@example.org',
language: 'en',
);
await expectLater(
auth.verifyEmailCode(request, 'CODE-9', address: 'anna@example.org'),
throwsA(
isA<EmailSignInFailed>().having(
(failure) => failure.problem,
'problem',
EmailSignInProblem.wrongCode,
),
),
);
expect(addresses.addresses, isEmpty);
});
});
}

87
packages/halkyon_app/test/auth/data/serverpod_auth_gateway_test.dart
View file

@ -1,4 +1,5 @@
import 'dart:convert';
import 'dart:typed_data';
import 'package:flutter_test/flutter_test.dart';
import 'package:halkyon_app/halkyon_app.dart';
@ -19,8 +20,8 @@ final class _MemoryStorage() implements ClientAuthSuccessStorage {
}
/// An instance's halkyon_base as the network shows it: anonymous sign-ins
/// get `anonymous-token`, its basics offer GitHub and email, and an address
/// belongs to Ben, whom a switch signs in as with `ben-token`.
/// get `anonymous-token`, its basics offer GitHub and passwords, and a
/// sign-up makes Ben, signed in with `ben-token`.
final class _Instance() {
static final anonymous = UuidValue.withValidation(
'0191f0c4-1111-7000-8000-000000000001',
@ -32,9 +33,6 @@ final class _Instance() {
/// Each call, by its endpoint and method, with the session it carried.
final calls = <({String call, String? session})>[];
/// What mailing a code is refused for, while set.
EmailSignInRefusal? sendRefused;
http.Client client() => MockClient((request) async {
final call = request.url.path.substring(1);
calls.add((call: call, session: request.headers['authorization']));
@ -56,24 +54,7 @@ final class _Instance() {
),
200,
),
'halkyon_base.emailCode/sendCode' => switch (sendRefused) {
final reason? => http.Response(
sent({
'className': 'halkyon_base.EmailSignInRefusedException',
'data': EmailSignInRefusedException(reason: reason).toJson(),
}),
400,
),
null => http.Response(
sent('0191f0c4-3333-7000-8000-000000000003'),
200,
),
},
'halkyon_base.emailCode/verifyCode' => http.Response(
sent(EmailCodeAccepted(switchToken: 'switch-to-ben').toJson()),
200,
),
'halkyon_base.emailSignIn/signIn' => http.Response(
'halkyon_base.passwordSignIn/signUp' => http.Response(
sent(_session(ben, 'ben-token', identified: true)),
200,
),
@ -137,47 +118,51 @@ void main() {
test('tells what the instance offers from its basics', () async {
expect(await gateway.gitHubClientId(), 'github-client');
expect(await gateway.offersEmailSignIn(), isTrue);
});
test("the instance's refusals to mail a code arrive in the package's own "
'words', () async {
test('a session granted elsewhere (a sign-up with a password, without '
"this device's session) takes its place, deleting the anonymous "
'account left behind as itself', () async {
await gateway.signInAnonymously();
instance.sendRefused = EmailSignInRefusal.tooManyCodes;
final passwords = ServerpodPasswordGateway(
app,
base: app.modules,
httpClient: instance.client,
);
await expectLater(
gateway.sendEmailCode('ben@example.org', language: 'en'),
throwsA(
isA<EmailSignInFailed>().having(
(failure) => failure.problem,
'problem',
EmailSignInProblem.tooManyCodes,
final grant = await passwords.signUp(
PasswordSetup(
salt: ByteData(16),
costs: PasswordCosts(
algorithm: 'argon2id13',
opsLimit: 3,
memLimit: 64 * 1024 * 1024,
),
verifier: ByteData(384),
encryptionPublicKey: ByteData(32),
signingPublicKey: ByteData(32),
passwordKeys: WrappedKeys(
nonce: ByteData(24),
cipherText: ByteData(112),
),
recoveryKeys: WrappedKeys(
nonce: ByteData(24),
cipherText: ByteData(112),
),
),
request: '0191f0c4-3333-7000-8000-000000000003',
code: 'K7QXM2PD',
);
});
test("switching to an address's person signs in without this device's "
'session, then deletes the anonymous account left behind as '
'itself', () async {
await gateway.signInAnonymously();
final request = await gateway.sendEmailCode(
'ben@example.org',
language: 'en',
);
final outcome = await gateway.verifyEmailCode(request, 'K7QXM2PD');
expect(outcome, const EmailTakenByAnotherPerson('switch-to-ben'));
expect(await gateway.switchToEmail('switch-to-ben'), '${_Instance.ben}');
await gateway.useSession(grant);
expect(
gateway.status,
SignedIn(authUserId: '${_Instance.ben}', isIdentified: true),
);
final signIn = instance.calls.singleWhere(
(call) => call.call == 'halkyon_base.emailSignIn/signIn',
final signUp = instance.calls.singleWhere(
(call) => call.call == 'halkyon_base.passwordSignIn/signUp',
);
expect(signIn.session, isNull, reason: 'no session goes with it');
expect(signUp.session, isNull, reason: 'no session goes with it');
final deletion = instance.calls.singleWhere(
(call) => call.call == 'halkyon_base.account/delete',
);