feat(auth)!: codes by mail no longer sign in

ADR 0017, step 3 (D4: nobody signs in with email codes yet, so the
password replaces them outright). `emailCode.verifyCode`,
`emailSignIn.signIn` and the switch token go, with the register's
`verifySignInCode` and `completeEmailSwitch` and their operations
between services. `emailCode.sendCode` stays, now without a session
(signing up and getting back in have none), as what proves an address
for a password's setup, a sign-up, a setup never finished and the
resets; `accountRecovery.sendCode`, which did that for the resets,
goes. The `switchChallengeId` column stays: Serverpod's challenges
still link a completion token, and older servers read it during a
deploy.

The apps: halkyon_app's email sign-in (its bloc, sheet, gateway calls
and the start screen's Continue with email) goes; Learn's profile and
Todo's account sheet show `AccountSecuritySection` (a password set up
by someone anonymous or signing in with GitHub, whose end it names;
the authenticators; changing the password; new recovery codes and
phrase), which reads anew after every change the repository makes.

BREAKING CHANGE: Learn's `minimumAppBuild` is 22: builds up to 21 sign
in with the endpoints that went. Todo was never released and stays at
build 1.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-10-20 19:31:49 +02:00
commit ae57cbe864
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64

View file

@ -4,8 +4,8 @@ import 'package:halkyon_app/halkyon_app.dart';
import 'package:halkyon_app/testing.dart';
import 'package:material_ui/material_ui.dart';
/// A signed-in person's app as a test makes one: whose it is, whether
/// they asked to continue with email, and a way to sign out.
/// A signed-in person's app as a test makes one: whose it is, and a way to
/// sign out.
class const _PersonApp(final SignedIn person) extends StatelessWidget {
@override
Widget build(BuildContext context) => MaterialApp(
@ -16,10 +16,6 @@ class const _PersonApp(final SignedIn person) extends StatelessWidget {
builder: (context) => Column(
children: [
Text('App of ${person.authUserId}'),
if (context.watch<SessionBloc>().state case SessionStateActive(
signsInWithEmail: true,
))
const Text('Asks for the address'),
TextButton(
onPressed: () => context.read<SessionBloc>().add(
const SessionEventSignOutRequested(),
@ -86,7 +82,7 @@ void main() {
expect(find.text('Signed out'), findsOneWidget);
expect(find.text('Start on test.example.org:'), findsOneWidget);
expect(find.text('Sign in with GitHub'), findsOneWidget);
expect(find.text('Continue with email'), findsOneWidget);
expect(find.text('Create an account'), findsOneWidget);
expect(
find.text('Use another instance'),
findsNothing,
@ -127,27 +123,14 @@ void main() {
expect(gateway.signIns, 0);
});
testWidgets('from there, an email address starts without an account and '
'asks for the address in the app', (tester) async {
await dependencies.signedOut.write(signedOut: true);
await start(tester);
await tester.tap(find.text('Continue with email'));
await tester.pumpAndSettle();
expect(find.text('App of anonymous-1'), findsOneWidget);
expect(find.text('Asks for the address'), findsOneWidget);
});
testWidgets('offers only the ways the instance has', (tester) async {
gateway
..offersGitHub = false
..offersEmail = false;
gateway.offersGitHub = false;
dependencies.passwordGateway.offered = false;
await dependencies.signedOut.write(signedOut: true);
await start(tester);
expect(find.text('Sign in with GitHub'), findsNothing);
expect(find.text('Continue with email'), findsNothing);
expect(find.text('Create an account'), findsNothing);
expect(find.text('Start without an account'), findsOneWidget);
});