halkyon-days/halkyon
Watch
1
0
Fork
You've already forked halkyon
 0
Code Issues Pull requests Projects Releases 37 Packages Wiki Activity Actions

feat(auth)!: codes by mail no longer sign in

Browse source 
ADR 0017, step 3 (D4: nobody signs in with email codes yet, so the
password replaces them outright). `emailCode.verifyCode`,
`emailSignIn.signIn` and the switch token go, with the register's
`verifySignInCode` and `completeEmailSwitch` and their operations
between services. `emailCode.sendCode` stays, now without a session
(signing up and getting back in have none), as what proves an address
for a password's setup, a sign-up, a setup never finished and the
resets; `accountRecovery.sendCode`, which did that for the resets,
goes. The `switchChallengeId` column stays: Serverpod's challenges
still link a completion token, and older servers read it during a
deploy.

The apps: halkyon_app's email sign-in (its bloc, sheet, gateway calls
and the start screen's Continue with email) goes; Learn's profile and
Todo's account sheet show `AccountSecuritySection` (a password set up
by someone anonymous or signing in with GitHub, whose end it names;
the authenticators; changing the password; new recovery codes and
phrase), which reads anew after every change the repository makes.

BREAKING CHANGE: Learn's `minimumAppBuild` is 22: builds up to 21 sign
in with the endpoints that went. Todo was never released and stays at
build 1.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-10-20 19:31:49 +02:00
commit ae57cbe864
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64
2 changed files with 429 additions and 3835 deletions
Download patch file Download diff file Expand all files Collapse all files

204
packages/halkyon_app/test/auth/widget/email_sign_in_sheet_test.dart
View file

@ -1,204 +0,0 @@
import 'package:flutter_test/flutter_test.dart';
import 'package:halkyon_app/halkyon_app.dart';
import 'package:halkyon_app/testing.dart';
import 'package:halkyon_ui/halkyon_ui.dart';
import 'package:material_ui/material_ui.dart';
void main() {
late FakeAuthGateway gateway;
late TestAppDependencies dependencies;
/// Whether this device holds content a switch would leave behind.
late bool holdsContent;
/// What the sheet returned once it closed.
late List<String?> returned;
setUp(() {
gateway = FakeAuthGateway(
status: const SignedIn(authUserId: 'anonymous-1', isIdentified: false),
);
dependencies = TestAppDependencies(gateway: gateway);
holdsContent = false;
returned = [];
});
/// Opens the sheet, in [locale].
Future<void> open(
WidgetTester tester, {
Locale locale = const Locale('en'),
}) async {
tester.view.physicalSize = const Size(412, 900);
tester.view.devicePixelRatio = 1;
addTearDown(tester.view.reset);
await tester.pumpWidget(
testApp(
Scaffold(
body: Builder(
builder: (context) => TextButton(
onPressed: () async => returned.add(
await showEmailSignInSheet(
context,
deviceHoldsContent: () async => holdsContent,
),
),
child: const Text('Open'),
),
),
),
dependencies: dependencies,
locale: locale,
),
);
await tester.tap(find.text('Open'));
await tester.pumpAndSettle();
}
/// The sheet's text field.
final inSheet = find.descendant(
of: find.byType(SheetScaffold),
matching: find.byType(TextField),
);
/// Types [address] and sends a code to it, then types [code]. A switch to
/// another person shows a spinner until their app replaces the whole
/// subtree, which a test never settles: [switches] pumps frames instead.
Future<void> signInWith(
WidgetTester tester,
String address, {
String code = 'CODE-1',
bool switches = false,
}) async {
await tester.enterText(inSheet, address);
await tester.tap(find.widgetWithText(FilledButton, 'Send code'));
await tester.pumpAndSettle();
expect(
find.text("We mailed a code to $address. It's valid for 15 minutes."),
findsOneWidget,
);
await tester.enterText(inSheet, code);
await tester.tap(find.widgetWithText(FilledButton, 'Continue'));
if (switches) {
await tester.pump();
await tester.pump();
} else {
await tester.pumpAndSettle();
}
}
testWidgets('an anonymous person continues with email: the address, then '
'the code mailed to it, after which the address is theirs', (
tester,
) async {
await open(tester);
expect(
find.textContaining('keeps only a fingerprint of your address'),
findsOneWidget,
);
await signInWith(tester, 'anna@example.org');
expect(returned, ['anna@example.org']);
expect(gateway.mailed.single.language, 'en');
expect(
gateway.status,
const SignedIn(authUserId: 'anonymous-1', isIdentified: true),
);
expect(dependencies.addresses.addresses, {
'anonymous-1': 'anna@example.org',
});
});
testWidgets('the mail is worded in German for someone who reads the app in '
'German', (tester) async {
await open(tester, locale: const Locale('de'));
await tester.enterText(inSheet, 'anna@example.org');
await tester.tap(find.widgetWithText(FilledButton, 'Code senden'));
await tester.pumpAndSettle();
expect(gateway.mailed.single.language, 'de');
});
testWidgets('a wrong code says so, and a new one can be asked for', (
tester,
) async {
await open(tester);
await signInWith(tester, 'anna@example.org', code: 'CODE-9');
expect(find.text("That code isn't right."), findsOneWidget);
await tester.tap(find.text('Send a new code'));
await tester.pumpAndSettle();
expect(find.text('A new code is on its way.'), findsOneWidget);
expect(gateway.mailed, hasLength(2));
});
testWidgets("another person's address switches at once where the device "
'holds nothing', (tester) async {
gateway.addressOwners['ben@example.org'] = 'ben';
await open(tester);
await signInWith(tester, 'ben@example.org', switches: true);
expect(gateway.emailSwitches, 1);
expect(
gateway.status,
const SignedIn(authUserId: 'ben', isIdentified: true),
);
});
testWidgets("another person's address asks first where the device holds "
"content, in the app's own words: staying changes nothing, switching "
'switches', (tester) async {
gateway.addressOwners['ben@example.org'] = 'ben';
holdsContent = true;
await open(tester);
await signInWith(tester, 'ben@example.org');
expect(
find.text('Switch to the account of ben@example.org?'),
findsOneWidget,
);
expect(
find.text(
"The notes on this device can't be combined with it yet: if you "
'switch, they are deleted.',
),
findsOneWidget,
);
await tester.tap(find.text('Stay anonymous'));
await tester.pumpAndSettle();
expect(gateway.emailSwitches, 0);
await signInWith(tester, 'ben@example.org', code: 'CODE-2');
await tester.tap(find.text('Switch'));
await tester.pump();
await tester.pump();
expect(gateway.emailSwitches, 1);
});
testWidgets("someone identified whose address is another account's is "
'told so, and stays who they are', (tester) async {
gateway = FakeAuthGateway(
status: const SignedIn(authUserId: 'github-person', isIdentified: true),
)..addressOwners['ben@example.org'] = 'ben';
dependencies = TestAppDependencies(gateway: gateway);
await open(tester);
await signInWith(tester, 'ben@example.org');
expect(
find.text(
'ben@example.org already signs in to another account. To switch to '
'it, sign out first.',
),
findsOneWidget,
);
expect(gateway.emailSwitches, 0);
expect(
gateway.status,
const SignedIn(authUserId: 'github-person', isIdentified: true),
);
});
}

29
packages/halkyon_app/test/auth/widget/session_gate_test.dart
View file

@ -4,8 +4,8 @@ import 'package:halkyon_app/halkyon_app.dart';
import 'package:halkyon_app/testing.dart';
import 'package:material_ui/material_ui.dart';
/// A signed-in person's app as a test makes one: whose it is, whether
/// they asked to continue with email, and a way to sign out.
/// A signed-in person's app as a test makes one: whose it is, and a way to
/// sign out.
class const _PersonApp(final SignedIn person) extends StatelessWidget {
@override
Widget build(BuildContext context) => MaterialApp(
@ -16,10 +16,6 @@ class const _PersonApp(final SignedIn person) extends StatelessWidget {
builder: (context) => Column(
children: [
Text('App of ${person.authUserId}'),
if (context.watch<SessionBloc>().state case SessionStateActive(
signsInWithEmail: true,
))
const Text('Asks for the address'),
TextButton(
onPressed: () => context.read<SessionBloc>().add(
const SessionEventSignOutRequested(),
@ -86,7 +82,7 @@ void main() {
expect(find.text('Signed out'), findsOneWidget);
expect(find.text('Start on test.example.org:'), findsOneWidget);
expect(find.text('Sign in with GitHub'), findsOneWidget);
expect(find.text('Continue with email'), findsOneWidget);
expect(find.text('Create an account'), findsOneWidget);
expect(
find.text('Use another instance'),
findsNothing,
@ -127,27 +123,14 @@ void main() {
expect(gateway.signIns, 0);
});
testWidgets('from there, an email address starts without an account and '
'asks for the address in the app', (tester) async {
await dependencies.signedOut.write(signedOut: true);
await start(tester);
await tester.tap(find.text('Continue with email'));
await tester.pumpAndSettle();
expect(find.text('App of anonymous-1'), findsOneWidget);
expect(find.text('Asks for the address'), findsOneWidget);
});
testWidgets('offers only the ways the instance has', (tester) async {
gateway
..offersGitHub = false
..offersEmail = false;
gateway.offersGitHub = false;
dependencies.passwordGateway.offered = false;
await dependencies.signedOut.write(signedOut: true);
await start(tester);
expect(find.text('Sign in with GitHub'), findsNothing);
expect(find.text('Continue with email'), findsNothing);
expect(find.text('Create an account'), findsNothing);
expect(find.text('Start without an account'), findsOneWidget);
});