halkyon-days/halkyon
Watch
1
0
Fork
You've already forked halkyon
 0
Code Issues Pull requests Projects Releases 37 Packages Wiki Activity Actions 1

feat(auth)!: codes by mail no longer sign in

Browse source 
ADR 0017, step 3 (D4: nobody signs in with email codes yet, so the
password replaces them outright). `emailCode.verifyCode`,
`emailSignIn.signIn` and the switch token go, with the register's
`verifySignInCode` and `completeEmailSwitch` and their operations
between services. `emailCode.sendCode` stays, now without a session
(signing up and getting back in have none), as what proves an address
for a password's setup, a sign-up, a setup never finished and the
resets; `accountRecovery.sendCode`, which did that for the resets,
goes. The `switchChallengeId` column stays: Serverpod's challenges
still link a completion token, and older servers read it during a
deploy.

The apps: halkyon_app's email sign-in (its bloc, sheet, gateway calls
and the start screen's Continue with email) goes; Learn's profile and
Todo's account sheet show `AccountSecuritySection` (a password set up
by someone anonymous or signing in with GitHub, whose end it names;
the authenticators; changing the password; new recovery codes and
phrase), which reads anew after every change the repository makes.

BREAKING CHANGE: Learn's `minimumAppBuild` is 22: builds up to 21 sign
in with the endpoints that went. Todo was never released and stays at
build 1.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-10-20 19:31:49 +02:00
commit ae57cbe864
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64
1 changed files with 429 additions and 3835 deletions
Download patch file Download diff file Expand all files Collapse all files

67
packages/halkyon_base_server/test/integration/register/register_test.dart
View file

@ -354,78 +354,45 @@ void main() {
expect(mailbox.sent, hasLength(11));
});
test("makes a member's anonymous person an account under the same "
'ID, identified, with the address', () async {
test("a code proves the address for a member's password, and a "
'wrong one refuses it, keeping nothing', () async {
usePasswordKeys(pod, testPasswordKeys);
addTearDown(() => usePasswordKeys(pod, null));
final device = await PasswordDevice.make();
final annaOnTodo = const Uuid().v7obj();
final request = await remote.sendSignInCode(
session,
address: 'Anna@example.org',
language: 'de',
network: '203.0.113.7',
);
final accepted = await remote.verifySignInCode(
session,
person: annaOnTodo,
request: request,
code: mailbox.codeFor('anna@example.org'),
);
expect(accepted.switchToken, isNull);
final account = await AuthUser.db.findById(session, annaOnTodo);
expect(account!.scopeNames, contains(identified.name));
expect(
(await remote.signInWaysOf(session, annaOnTodo)).toJson(),
SignInWays(gitHub: false, email: true).toJson(),
);
expect(await remote.knownAccounts(session, {annaOnTodo, ben}), {
annaOnTodo,
ben,
});
});
test('switches to the account that has the address, once, and '
'refuses a wrong code', () async {
final annaOnTodo = const Uuid().v7obj();
final request = await remote.sendSignInCode(
session,
address: 'ben@example.org',
language: 'en',
network: '203.0.113.7',
);
await expectLater(
remote.verifySignInCode(
remote.setPassword(
session,
person: annaOnTodo,
setup: device.setup(),
request: request,
code: 'AAAA-AAAA',
),
refused(EmailSignInRefusal.wrongCode),
);
final accepted = await remote.verifySignInCode(
expect(await AuthUser.db.findById(session, annaOnTodo), isNull);
await remote.setPassword(
session,
person: annaOnTodo,
setup: device.setup(),
request: request,
code: mailbox.codeFor('ben@example.org'),
code: mailbox.codeFor('anna@example.org'),
);
expect(accepted.switchToken, isNotNull);
expect(await AuthUser.db.findById(session, annaOnTodo), isNull);
expect(
await remote.completeEmailSwitch(
session,
switchToken: accepted.switchToken!,
),
(await AuthUser.db.findById(session, annaOnTodo))!.scopeNames,
contains(identified.name),
);
expect(await remote.knownAccounts(session, {annaOnTodo, ben}), {
annaOnTodo,
ben,
);
await expectLater(
remote.completeEmailSwitch(
session,
switchToken: accepted.switchToken!,
),
refused(EmailSignInRefusal.codeExpired),
);
});
});
});