halkyon-days/halkyon
Watch
1
0
Fork
You've already forked halkyon
 0
Code Issues Pull requests Projects Releases 37 Packages Wiki Activity Actions

feat(auth)!: codes by mail no longer sign in

Browse source 
ADR 0017, step 3 (D4: nobody signs in with email codes yet, so the
password replaces them outright). `emailCode.verifyCode`,
`emailSignIn.signIn` and the switch token go, with the register's
`verifySignInCode` and `completeEmailSwitch` and their operations
between services. `emailCode.sendCode` stays, now without a session
(signing up and getting back in have none), as what proves an address
for a password's setup, a sign-up, a setup never finished and the
resets; `accountRecovery.sendCode`, which did that for the resets,
goes. The `switchChallengeId` column stays: Serverpod's challenges
still link a completion token, and older servers read it during a
deploy.

The apps: halkyon_app's email sign-in (its bloc, sheet, gateway calls
and the start screen's Continue with email) goes; Learn's profile and
Todo's account sheet show `AccountSecuritySection` (a password set up
by someone anonymous or signing in with GitHub, whose end it names;
the authenticators; changing the password; new recovery codes and
phrase), which reads anew after every change the repository makes.

BREAKING CHANGE: Learn's `minimumAppBuild` is 22: builds up to 21 sign
in with the endpoints that went. Todo was never released and stays at
build 1.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-10-20 19:31:49 +02:00
commit ae57cbe864
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64
1 changed files with 429 additions and 3835 deletions
Download patch file Download diff file Expand all files Collapse all files

126
packages/halkyon_base_server/test/integration/register/member_test.dart
View file

@ -25,7 +25,6 @@ final class _Register implements AccountRegister {
final gitHub = <String, UuidValue>{};
final profiles = <UuidValue, Profile>{};
final codes = <UuidValue, ({String address, String code})>{};
final switches = <String, UuidValue>{};
/// The calls asked, by name, in their order.
final asked = <String>[];
@ -163,40 +162,6 @@ final class _Register implements AccountRegister {
return request;
});
@override
Future<EmailCodeAccepted> verifySignInCode(
Session session, {
required UuidValue person,
required UuidValue request,
required String code,
}) => _answer('verifySignInCode', () {
final sent = codes[request];
if (sent == null || sent.code != code) {
throw EmailSignInRefusedException(reason: EmailSignInRefusal.wrongCode);
}
final owner = addresses[sent.address];
if (owner != null && owner != person) {
final token = 'switch to ${owner.uuid}';
switches[token] = owner;
return EmailCodeAccepted(switchToken: token);
}
add(person, address: sent.address);
return EmailCodeAccepted();
});
@override
Future<UuidValue> completeEmailSwitch(
Session session, {
required String switchToken,
}) => _answer(
'completeEmailSwitch',
() =>
switches.remove(switchToken) ??
(throw EmailSignInRefusedException(
reason: EmailSignInRefusal.codeExpired,
)),
);
@override
Future<void> linkGitHub(
Session session, {
@ -574,97 +539,6 @@ void main() {
);
});
test('an address nobody has makes the person here identified, under '
'the same ID, the register making them its account', () async {
final request = await endpoints.emailCode.sendCode(
asAnna(),
address: 'anna@example.org',
language: 'de',
);
final accepted = await endpoints.emailCode.verifyCode(
asAnna(),
request: request,
code: 'K7QX-M2PD',
);
expect(accepted.switchToken, isNull);
expect(register.accounts, contains(anna));
expect(await scopesOf(anna), contains(identified.name));
expect(
(await ServerSideSession.db.findById(
session,
annasPhone,
))!.scopeNames,
contains(identified.name),
);
expect(
await AnonymousAccount.db.count(
session,
where: (t) => t.authUserId.equals(anna),
),
0,
);
});
test('a wrong code changes nothing here', () async {
final request = await endpoints.emailCode.sendCode(
asAnna(),
address: 'anna@example.org',
language: 'de',
);
await expectLater(
endpoints.emailCode.verifyCode(
asAnna(),
request: request,
code: 'AAAA-AAAA',
),
throwsA(isA<EmailSignInRefusedException>()),
);
expect(await scopesOf(anna), isNot(contains(identified.name)));
});
test("another account's address gives a switch, which signs in as "
'that account here, made a person here under its ID the first '
'time', () async {
final carla = const Uuid().v7obj();
register.add(carla, address: 'carla@example.org');
final request = await endpoints.emailCode.sendCode(
asAnna(),
address: 'carla@example.org',
language: 'en',
);
final accepted = await endpoints.emailCode.verifyCode(
asAnna(),
request: request,
code: 'K7QX-M2PD',
);
expect(accepted.switchToken, isNotNull);
expect(await scopesOf(anna), isNot(contains(identified.name)));
expect(await AuthUser.db.findById(session, carla), isNull);
final signedIn = await endpoints.emailSignIn.signIn(
notSignedIn(),
switchToken: accepted.switchToken!,
);
expect(signedIn.authUserId, carla);
expect(await scopesOf(carla), {identified.name});
final sessions = await ServerSideSession.db.find(
session,
where: (t) => t.authUserId.equals(carla),
);
expect(sessions.single.scopeNames, {identified.name});
await expectLater(
endpoints.emailSignIn.signIn(
notSignedIn(),
switchToken: accepted.switchToken!,
),
throwsA(isA<EmailSignInRefusedException>()),
);
});
test('an account signing in again is the same person here', () async {
await issueSession(session, ben, method: 'test');
await issueSession(session, ben, method: 'test');