halkyon-days/halkyon
Watch
1
0
Fork
You've already forked halkyon
 0
Code Issues Pull requests Projects Releases 37 Packages Wiki Activity Actions

feat(auth): change the password and the recovery phrase while signed in

Browse source 
ADR 0017, step 3. `password.beginChange` and `password.change` take the
old password's SRP proof and a TOTP or recovery code, and the same keys
wrapped under the new password; a session alone changes nothing, and an
account without a confirmed authenticator is told to set one up first.
`password.setRecoveryKeys` replaces the keys' wrapping under the
recovery phrase for a TOTP code, so a device holding the keys can make
a new phrase.

A change of password ends every other session of the account in every
service of the instance; resets of the password and of the account end
them all. The register ends its own and keeps a notice per member
(`sessions_ended_notice`, a migration that only creates it), told at
once and hourly until it confirms, as deletions are told: it names a
moment, so sessions made since stay, and the session that asked for a
change. A member answering one ends its sessions made before that
moment; a member signing someone in after a reset ends its own first
and makes the new session only once its clock is past the moment.

A reset not due says when it takes effect (`takesEffectAt` on
`PasswordRefusedException`), across members too.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-10-20 14:53:58 +02:00
commit d00da1f24a
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64
8 changed files with 43506 additions and 126 deletions
Download patch file Download diff file Expand all files Collapse all files

11
apps/learn/halkyon_learn_server/lib/src/auth/pruning_future_call.dart
View file

@ -50,10 +50,15 @@ class PruningFutureCall extends FutureCall {
);
}
/// Tells the instance's members again of the accounts gone that they
/// haven't confirmed yet (ADR 0016), and logs how many confirmed.
/// Tells the instance's members again of the accounts gone (ADR 0016) and
/// of the accounts whose sessions ended (ADR 0017: a password changed or
/// reset) that they haven't confirmed yet, and logs how many confirmed.
Future<void> tellMembersOfDeletions(Session session) async {
final confirmed = await deliverDeletionNotices(session);
session.log('Members confirmed $confirmed deleted accounts.');
final ended = await deliverSessionNotices(session);
session.log(
'Members confirmed $confirmed deleted accounts and $ended accounts '
'whose sessions ended.',
);
}
}

5
apps/learn/halkyon_learn_server/lib/src/generated/future_calls.dart
View file

@ -333,8 +333,9 @@ class PruningForgetSignUpAttemptsFutureCall extends _is.FutureCall
}
}
/// Tells the instance's members again of the accounts gone that they
/// haven't confirmed yet (ADR 0016), and logs how many confirmed.
/// Tells the instance's members again of the accounts gone (ADR 0016) and
/// of the accounts whose sessions ended (ADR 0017: a password changed or
/// reset) that they haven't confirmed yet, and logs how many confirmed.
class PruningTellMembersOfDeletionsFutureCall extends _is.FutureCall
implements _is.InvokableFutureCall {
@override

9698
apps/learn/halkyon_learn_server/migrations/20261020125117584-sessions-ended/definition.json Normal file
View file

File diff suppressed because it is too large Load diff

2312
apps/learn/halkyon_learn_server/migrations/20261020125117584-sessions-ended/definition.sql Normal file
View file

File diff suppressed because it is too large Load diff

4521
apps/learn/halkyon_learn_server/migrations/20261020125117584-sessions-ended/definition_project.json Normal file
View file

File diff suppressed because it is too large Load diff

100
apps/learn/halkyon_learn_server/migrations/20261020125117584-sessions-ended/migration.json Normal file
View file

@ -0,0 +1,100 @@
{
"__className__": "serverpod.DatabaseMigration",
"actions": [
{
"__className__": "serverpod.DatabaseMigrationAction",
"type": "createTable",
"createTable": {
"__className__": "serverpod.TableDefinition",
"name": "sessions_ended_notice",
"dartName": "SessionsEndedNotice",
"module": "halkyon_base",
"schema": "public",
"columns": [
{
"__className__": "serverpod.ColumnDefinition",
"name": "id",
"fieldName": "id",
"columnType": 6,
"isNullable": false,
"columnDefault": "serial",
"dartType": "int?"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "account",
"fieldName": "account",
"columnType": 7,
"isNullable": false,
"dartType": "UuidValue"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "member",
"fieldName": "member",
"columnType": 0,
"isNullable": false,
"dartType": "String"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "endedBefore",
"fieldName": "endedBefore",
"columnType": 4,
"isNullable": false,
"dartType": "DateTime"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "keepSession",
"fieldName": "keepSession",
"columnType": 7,
"isNullable": true,
"dartType": "UuidValue?"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "attempts",
"fieldName": "attempts",
"columnType": 6,
"isNullable": false,
"dartType": "int"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "lastAttemptAt",
"fieldName": "lastAttemptAt",
"columnType": 4,
"isNullable": true,
"dartType": "DateTime?"
}
],
"foreignKeys": [],
"indexes": [
{
"__className__": "serverpod.IndexDefinition",
"indexName": "sessions_ended_notice_idx",
"elements": [
{
"__className__": "serverpod.IndexElementDefinition",
"type": 0,
"definition": "account"
},
{
"__className__": "serverpod.IndexElementDefinition",
"type": 0,
"definition": "member"
}
],
"type": "btree",
"isUnique": true,
"isPrimary": false
}
],
"managed": true
}
}
],
"warnings": [],
"migrationApiVersion": 1
}

69
apps/learn/halkyon_learn_server/migrations/20261020125117584-sessions-ended/migration.sql Normal file
View file

@ -0,0 +1,69 @@
BEGIN;
--
-- ACTION CREATE TABLE
--
CREATE TABLE "sessions_ended_notice" (
"id" bigserial PRIMARY KEY,
"account" uuid NOT NULL,
"member" text NOT NULL,
"endedBefore" timestamp without time zone NOT NULL,
"keepSession" uuid,
"attempts" bigint NOT NULL,
"lastAttemptAt" timestamp without time zone
);
-- Indexes
CREATE UNIQUE INDEX "sessions_ended_notice_idx" ON "sessions_ended_notice" USING btree ("account", "member");
--
-- MIGRATION VERSION FOR halkyon_learn
--
INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
VALUES ('halkyon_learn', '20261020125117584-sessions-ended', now())
ON CONFLICT ("module")
DO UPDATE SET "version" = '20261020125117584-sessions-ended', "timestamp" = now();
--
-- MIGRATION VERSION FOR halkyon_base
--
INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
VALUES ('halkyon_base', '20261020124836165-sessions-ended', now())
ON CONFLICT ("module")
DO UPDATE SET "version" = '20261020124836165-sessions-ended', "timestamp" = now();
--
-- MIGRATION VERSION FOR serverpod
--
INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
VALUES ('serverpod', '20260824182259319', now())
ON CONFLICT ("module")
DO UPDATE SET "version" = '20260824182259319', "timestamp" = now();
--
-- MIGRATION VERSION FOR serverpod_auth_idp
--
INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
VALUES ('serverpod_auth_idp', '20260924105404509', now())
ON CONFLICT ("module")
DO UPDATE SET "version" = '20260924105404509', "timestamp" = now();
--
-- MIGRATION VERSION FOR serverpod_offline_sync
--
INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
VALUES ('serverpod_offline_sync', '20260914143806119', now())
ON CONFLICT ("module")
DO UPDATE SET "version" = '20260914143806119', "timestamp" = now();
--
-- MIGRATION VERSION FOR serverpod_auth_core
--
INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
VALUES ('serverpod_auth_core', '20260924105232991', now())
ON CONFLICT ("module")
DO UPDATE SET "version" = '20260924105232991', "timestamp" = now();
COMMIT;

1
apps/learn/halkyon_learn_server/migrations/migration_registry.txt
View file

@ -36,3 +36,4 @@
20261019201023295-profiles-in-halkyon-base
20261019204112282-deletion-notices
20261020111943300-passwords
20261020125117584-sessions-ended