halkyon-days/halkyon
Watch
1
0
Fork
You've already forked halkyon
 0
Code Issues Pull requests Projects Releases 37 Packages Wiki Activity Actions

feat(auth): Learn's and Todo's servers take password sign-in

Browse source 
Their migrations add halkyon_base's five tables for passwords,
authenticators, recovery codes, resets and sign-ins begun (nothing
else), and their pruning forgets sign-ins never finished and
authenticators never confirmed, hourly, and every GitHub ID once
GitHub sign-in has ended, daily.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-10-20 13:32:21 +02:00
commit aedd03661a
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64
8 changed files with 35545 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

26
apps/learn/halkyon_learn_server/lib/src/auth/pruning_future_call.dart
View file

@ -11,13 +11,15 @@ import 'package:serverpod/serverpod.dart';
/// All but the last are halkyon_base's (ADR 0014, ADR 0016), and people go
/// through its `deletePerson`, so Learn's own data of theirs goes too.
class PruningFutureCall extends FutureCall {
/// Prunes one batch and logs how many people went.
/// Prunes one batch and logs how many people went; once GitHub sign-in
/// has ended (`GITHUB_SIGN_IN_ENDS`), forgets every GitHub ID too.
Future<void> pruneAnonymousPeople(Session session) async {
final pruned = await pruneAbandonedAnonymousPeople(
session,
now: clock.now(),
final now = clock.now();
final pruned = await pruneAbandonedAnonymousPeople(session, now: now);
final gitHub = await forgetGitHubAccounts(session, now: now);
session.log(
'Pruned $pruned abandoned anonymous people and $gitHub GitHub IDs.',
);
session.log('Pruned $pruned abandoned anonymous people.');
}
/// Forgets the assistant connector's codes and tokens past their time, and
@ -31,13 +33,21 @@ class PruningFutureCall extends FutureCall {
}
/// Forgets the sign-up attempts the rate limit is done with, with their IP
/// addresses, and the email sign-in codes past their time, and logs how
/// many.
/// addresses, the email sign-in codes past their time, and the password
/// sign-ins never finished and authenticators never confirmed (ADR 0017),
/// and logs how many.
Future<void> forgetSignUpAttempts(Session session) async {
final now = clock.now();
final forgotten = await forgetOldSignUpAttempts(session, now: now);
final codes = await forgetExpiredEmailCodes(session, now: now);
session.log('Forgot $forgotten sign-up attempts and $codes email codes.');
final unfinished = await forgetUnconfirmedAuthenticators(
session,
now: now,
);
session.log(
'Forgot $forgotten sign-up attempts, $codes email codes and '
'$unfinished unfinished sign-ins and authenticators.',
);
}
/// Tells the instance's members again of the accounts gone that they

8
apps/learn/halkyon_learn_server/lib/src/generated/future_calls.dart
View file

@ -292,7 +292,8 @@ class FilePruningPruneFilesFutureCall extends _is.FutureCall
}
}
/// Prunes one batch and logs how many people went.
/// Prunes one batch and logs how many people went; once GitHub sign-in
/// has ended (`GITHUB_SIGN_IN_ENDS`), forgets every GitHub ID too.
class PruningPruneAnonymousPeopleFutureCall extends _is.FutureCall
implements _is.InvokableFutureCall {
@override
@ -318,8 +319,9 @@ class PruningForgetConnectorSecretsFutureCall extends _is.FutureCall
}
/// Forgets the sign-up attempts the rate limit is done with, with their IP
/// addresses, and the email sign-in codes past their time, and logs how
/// many.
/// addresses, the email sign-in codes past their time, and the password
/// sign-ins never finished and authenticators never confirmed (ADR 0017),
/// and logs how many.
class PruningForgetSignUpAttemptsFutureCall extends _is.FutureCall
implements _is.InvokableFutureCall {
@override

9609
apps/learn/halkyon_learn_server/migrations/20261020111943300-passwords/definition.json Normal file
View file

File diff suppressed because it is too large Load diff

2296
apps/learn/halkyon_learn_server/migrations/20261020111943300-passwords/definition.sql Normal file
View file

File diff suppressed because it is too large Load diff

4521
apps/learn/halkyon_learn_server/migrations/20261020111943300-passwords/definition_project.json Normal file
View file

File diff suppressed because it is too large Load diff

468
apps/learn/halkyon_learn_server/migrations/20261020111943300-passwords/migration.json Normal file
View file

@ -0,0 +1,468 @@
{
"__className__": "serverpod.DatabaseMigration",
"actions": [
{
"__className__": "serverpod.DatabaseMigrationAction",
"type": "createTable",
"createTable": {
"__className__": "serverpod.TableDefinition",
"name": "account_password",
"dartName": "AccountPassword",
"module": "halkyon_base",
"schema": "public",
"columns": [
{
"__className__": "serverpod.ColumnDefinition",
"name": "id",
"fieldName": "id",
"columnType": 6,
"isNullable": false,
"columnDefault": "serial",
"dartType": "int?"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "authUserId",
"fieldName": "authUserId",
"columnType": 7,
"isNullable": false,
"dartType": "UuidValue"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "salt",
"fieldName": "salt",
"columnType": 5,
"isNullable": false,
"dartType": "dart:typed_data:ByteData"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "kdfAlgorithm",
"fieldName": "kdfAlgorithm",
"columnType": 0,
"isNullable": false,
"dartType": "String"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "kdfOpsLimit",
"fieldName": "kdfOpsLimit",
"columnType": 6,
"isNullable": false,
"dartType": "int"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "kdfMemLimit",
"fieldName": "kdfMemLimit",
"columnType": 6,
"isNullable": false,
"dartType": "int"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "verifier",
"fieldName": "verifier",
"columnType": 5,
"isNullable": false,
"dartType": "dart:typed_data:ByteData"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "encryptionPublicKey",
"fieldName": "encryptionPublicKey",
"columnType": 5,
"isNullable": false,
"dartType": "dart:typed_data:ByteData"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "signingPublicKey",
"fieldName": "signingPublicKey",
"columnType": 5,
"isNullable": false,
"dartType": "dart:typed_data:ByteData"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "passwordKeysNonce",
"fieldName": "passwordKeysNonce",
"columnType": 5,
"isNullable": false,
"dartType": "dart:typed_data:ByteData"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "passwordKeysCipherText",
"fieldName": "passwordKeysCipherText",
"columnType": 5,
"isNullable": false,
"dartType": "dart:typed_data:ByteData"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "recoveryKeysNonce",
"fieldName": "recoveryKeysNonce",
"columnType": 5,
"isNullable": false,
"dartType": "dart:typed_data:ByteData"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "recoveryKeysCipherText",
"fieldName": "recoveryKeysCipherText",
"columnType": 5,
"isNullable": false,
"dartType": "dart:typed_data:ByteData"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "createdAt",
"fieldName": "createdAt",
"columnType": 4,
"isNullable": false,
"dartType": "DateTime"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "updatedAt",
"fieldName": "updatedAt",
"columnType": 4,
"isNullable": false,
"dartType": "DateTime"
}
],
"foreignKeys": [],
"indexes": [
{
"__className__": "serverpod.IndexDefinition",
"indexName": "account_password_person_idx",
"elements": [
{
"__className__": "serverpod.IndexElementDefinition",
"type": 0,
"definition": "authUserId"
}
],
"type": "btree",
"isUnique": true,
"isPrimary": false
}
],
"managed": true
}
},
{
"__className__": "serverpod.DatabaseMigrationAction",
"type": "createTable",
"createTable": {
"__className__": "serverpod.TableDefinition",
"name": "account_reset",
"dartName": "AccountReset",
"module": "halkyon_base",
"schema": "public",
"columns": [
{
"__className__": "serverpod.ColumnDefinition",
"name": "id",
"fieldName": "id",
"columnType": 6,
"isNullable": false,
"columnDefault": "serial",
"dartType": "int?"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "authUserId",
"fieldName": "authUserId",
"columnType": 7,
"isNullable": false,
"dartType": "UuidValue"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "kind",
"fieldName": "kind",
"columnType": 0,
"isNullable": false,
"dartType": "protocol:AccountResetKind"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "takesEffectAt",
"fieldName": "takesEffectAt",
"columnType": 4,
"isNullable": false,
"dartType": "DateTime"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "createdAt",
"fieldName": "createdAt",
"columnType": 4,
"isNullable": false,
"dartType": "DateTime"
}
],
"foreignKeys": [],
"indexes": [
{
"__className__": "serverpod.IndexDefinition",
"indexName": "account_reset_person_kind_idx",
"elements": [
{
"__className__": "serverpod.IndexElementDefinition",
"type": 0,
"definition": "authUserId"
},
{
"__className__": "serverpod.IndexElementDefinition",
"type": 0,
"definition": "kind"
}
],
"type": "btree",
"isUnique": true,
"isPrimary": false
}
],
"managed": true
}
},
{
"__className__": "serverpod.DatabaseMigrationAction",
"type": "createTable",
"createTable": {
"__className__": "serverpod.TableDefinition",
"name": "recovery_code",
"dartName": "RecoveryCode",
"module": "halkyon_base",
"schema": "public",
"columns": [
{
"__className__": "serverpod.ColumnDefinition",
"name": "id",
"fieldName": "id",
"columnType": 6,
"isNullable": false,
"columnDefault": "serial",
"dartType": "int?"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "authUserId",
"fieldName": "authUserId",
"columnType": 7,
"isNullable": false,
"dartType": "UuidValue"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "hash",
"fieldName": "hash",
"columnType": 0,
"isNullable": false,
"dartType": "String"
}
],
"foreignKeys": [],
"indexes": [
{
"__className__": "serverpod.IndexDefinition",
"indexName": "recovery_code_person_idx",
"elements": [
{
"__className__": "serverpod.IndexElementDefinition",
"type": 0,
"definition": "authUserId"
}
],
"type": "btree",
"isUnique": false,
"isPrimary": false
}
],
"managed": true
}
},
{
"__className__": "serverpod.DatabaseMigrationAction",
"type": "createTable",
"createTable": {
"__className__": "serverpod.TableDefinition",
"name": "sign_in_challenge",
"dartName": "SignInChallenge",
"module": "halkyon_base",
"schema": "public",
"columns": [
{
"__className__": "serverpod.ColumnDefinition",
"name": "id",
"fieldName": "id",
"columnType": 7,
"isNullable": false,
"columnDefault": "random_v7",
"dartType": "UuidValue?"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "authUserId",
"fieldName": "authUserId",
"columnType": 7,
"isNullable": true,
"dartType": "UuidValue?"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "purpose",
"fieldName": "purpose",
"columnType": 0,
"isNullable": false,
"dartType": "protocol:SignInChallengePurpose"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "addressHash",
"fieldName": "addressHash",
"columnType": 0,
"isNullable": false,
"dartType": "String"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "secret",
"fieldName": "secret",
"columnType": 0,
"isNullable": false,
"dartType": "String"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "serverValue",
"fieldName": "serverValue",
"columnType": 0,
"isNullable": true,
"dartType": "String?"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "createdAt",
"fieldName": "createdAt",
"columnType": 4,
"isNullable": false,
"dartType": "DateTime"
}
],
"foreignKeys": [],
"indexes": [
{
"__className__": "serverpod.IndexDefinition",
"indexName": "sign_in_challenge_created_idx",
"elements": [
{
"__className__": "serverpod.IndexElementDefinition",
"type": 0,
"definition": "createdAt"
}
],
"type": "btree",
"isUnique": false,
"isPrimary": false
}
],
"managed": true
}
},
{
"__className__": "serverpod.DatabaseMigrationAction",
"type": "createTable",
"createTable": {
"__className__": "serverpod.TableDefinition",
"name": "totp_authenticator",
"dartName": "TotpAuthenticator",
"module": "halkyon_base",
"schema": "public",
"columns": [
{
"__className__": "serverpod.ColumnDefinition",
"name": "id",
"fieldName": "id",
"columnType": 7,
"isNullable": false,
"columnDefault": "random_v7",
"dartType": "UuidValue?"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "authUserId",
"fieldName": "authUserId",
"columnType": 7,
"isNullable": false,
"dartType": "UuidValue"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "name",
"fieldName": "name",
"columnType": 0,
"isNullable": false,
"dartType": "String"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "secret",
"fieldName": "secret",
"columnType": 5,
"isNullable": false,
"dartType": "dart:typed_data:ByteData"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "confirmedAt",
"fieldName": "confirmedAt",
"columnType": 4,
"isNullable": true,
"dartType": "DateTime?"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "lastStep",
"fieldName": "lastStep",
"columnType": 6,
"isNullable": true,
"dartType": "int?"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "createdAt",
"fieldName": "createdAt",
"columnType": 4,
"isNullable": false,
"dartType": "DateTime"
}
],
"foreignKeys": [],
"indexes": [
{
"__className__": "serverpod.IndexDefinition",
"indexName": "totp_authenticator_person_idx",
"elements": [
{
"__className__": "serverpod.IndexElementDefinition",
"type": 0,
"definition": "authUserId"
}
],
"type": "btree",
"isUnique": false,
"isPrimary": false
}
],
"managed": true
}
}
],
"warnings": [],
"migrationApiVersion": 1
}

164
apps/learn/halkyon_learn_server/migrations/20261020111943300-passwords/migration.sql Normal file
View file

@ -0,0 +1,164 @@
BEGIN;
--
-- Function: gen_random_uuid_v7()
-- Source: https://gist.github.com/kjmph/5bd772b2c2df145aa645b837da7eca74
-- License: MIT (copyright notice included on the generator source code).
--
create or replace function gen_random_uuid_v7()
returns uuid
as $$
begin
-- use random v4 uuid as starting point (which has the same variant we need)
-- then overlay timestamp
-- then set version 7 by flipping the 2 and 1 bit in the version 4 string
return encode(
set_bit(
set_bit(
overlay(uuid_send(gen_random_uuid())
placing substring(int8send(floor(extract(epoch from clock_timestamp()) * 1000)::bigint) from 3)
from 1 for 6
),
52, 1
),
53, 1
),
'hex')::uuid;
end
$$
language plpgsql
volatile;
--
-- ACTION CREATE TABLE
--
CREATE TABLE "account_password" (
"id" bigserial PRIMARY KEY,
"authUserId" uuid NOT NULL,
"salt" bytea NOT NULL,
"kdfAlgorithm" text NOT NULL,
"kdfOpsLimit" bigint NOT NULL,
"kdfMemLimit" bigint NOT NULL,
"verifier" bytea NOT NULL,
"encryptionPublicKey" bytea NOT NULL,
"signingPublicKey" bytea NOT NULL,
"passwordKeysNonce" bytea NOT NULL,
"passwordKeysCipherText" bytea NOT NULL,
"recoveryKeysNonce" bytea NOT NULL,
"recoveryKeysCipherText" bytea NOT NULL,
"createdAt" timestamp without time zone NOT NULL,
"updatedAt" timestamp without time zone NOT NULL
);
-- Indexes
CREATE UNIQUE INDEX "account_password_person_idx" ON "account_password" USING btree ("authUserId");
--
-- ACTION CREATE TABLE
--
CREATE TABLE "account_reset" (
"id" bigserial PRIMARY KEY,
"authUserId" uuid NOT NULL,
"kind" text NOT NULL,
"takesEffectAt" timestamp without time zone NOT NULL,
"createdAt" timestamp without time zone NOT NULL
);
-- Indexes
CREATE UNIQUE INDEX "account_reset_person_kind_idx" ON "account_reset" USING btree ("authUserId", "kind");
--
-- ACTION CREATE TABLE
--
CREATE TABLE "recovery_code" (
"id" bigserial PRIMARY KEY,
"authUserId" uuid NOT NULL,
"hash" text NOT NULL
);
-- Indexes
CREATE INDEX "recovery_code_person_idx" ON "recovery_code" USING btree ("authUserId");
--
-- ACTION CREATE TABLE
--
CREATE TABLE "sign_in_challenge" (
"id" uuid PRIMARY KEY DEFAULT gen_random_uuid_v7(),
"authUserId" uuid,
"purpose" text NOT NULL,
"addressHash" text NOT NULL,
"secret" text NOT NULL,
"serverValue" text,
"createdAt" timestamp without time zone NOT NULL
);
-- Indexes
CREATE INDEX "sign_in_challenge_created_idx" ON "sign_in_challenge" USING btree ("createdAt");
--
-- ACTION CREATE TABLE
--
CREATE TABLE "totp_authenticator" (
"id" uuid PRIMARY KEY DEFAULT gen_random_uuid_v7(),
"authUserId" uuid NOT NULL,
"name" text NOT NULL,
"secret" bytea NOT NULL,
"confirmedAt" timestamp without time zone,
"lastStep" bigint,
"createdAt" timestamp without time zone NOT NULL
);
-- Indexes
CREATE INDEX "totp_authenticator_person_idx" ON "totp_authenticator" USING btree ("authUserId");
--
-- MIGRATION VERSION FOR halkyon_learn
--
INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
VALUES ('halkyon_learn', '20261020111943300-passwords', now())
ON CONFLICT ("module")
DO UPDATE SET "version" = '20261020111943300-passwords', "timestamp" = now();
--
-- MIGRATION VERSION FOR halkyon_base
--
INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
VALUES ('halkyon_base', '20261020111123780-passwords', now())
ON CONFLICT ("module")
DO UPDATE SET "version" = '20261020111123780-passwords', "timestamp" = now();
--
-- MIGRATION VERSION FOR serverpod
--
INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
VALUES ('serverpod', '20260824182259319', now())
ON CONFLICT ("module")
DO UPDATE SET "version" = '20260824182259319', "timestamp" = now();
--
-- MIGRATION VERSION FOR serverpod_auth_idp
--
INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
VALUES ('serverpod_auth_idp', '20260924105404509', now())
ON CONFLICT ("module")
DO UPDATE SET "version" = '20260924105404509', "timestamp" = now();
--
-- MIGRATION VERSION FOR serverpod_offline_sync
--
INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
VALUES ('serverpod_offline_sync', '20260914143806119', now())
ON CONFLICT ("module")
DO UPDATE SET "version" = '20260914143806119', "timestamp" = now();
--
-- MIGRATION VERSION FOR serverpod_auth_core
--
INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
VALUES ('serverpod_auth_core', '20260924105232991', now())
ON CONFLICT ("module")
DO UPDATE SET "version" = '20260924105232991', "timestamp" = now();
COMMIT;

1
apps/learn/halkyon_learn_server/migrations/migration_registry.txt
View file

@ -35,3 +35,4 @@
20261019121406578-halkyon-base
20261019201023295-profiles-in-halkyon-base
20261019204112282-deletion-notices
20261020111943300-passwords