fix(auth): an account with a password deletes itself only with it and a code

A session alone deleted any account, with everything encrypted under its
keys (the second reading's lows; decided by the developer: the password
and a code, as a change of password takes). account.delete now takes a
DeletionProof (the password's SRP proof for a beginChange challenge, a
TOTP or recovery code, the host the device addressed); the register
checks it (requireOwnerToDelete), a member passing it on bound to its own
host. Accounts without a password, anonymous ones among them, delete with
their session as before. In the app, deleting an account with a password
asks for it and a code in a sheet of its own; a wrong one deletes
nothing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_base_server/test/integration/password/password_change_test.dart

@@ -504,6 +504,97 @@ void main() {
         });
       });
 
+      group('deleting the account', () {
+        /// Deletes Anna's account from her phone, with the password's proof
+        /// (hers by default, by [privateValue] otherwise, none [withoutProof])
+        /// and [totpCode] (her authenticator's now by default), bound to
+        /// [host].
+        Future<void> delete({
+          BigInt? privateValue,
+          String? totpCode,
+          bool withoutCode = false,
+          bool withoutProof = false,
+          String host = testHost,
+        }) => atNow(() async {
+          if (withoutProof) {
+            return await endpoints.account.delete(onPhone());
+          }
+          final challenge = await endpoints.password.beginChange(onPhone());
+          final answer = device.answer(
+            challenge,
+            privateValue: privateValue,
+            host: host,
+          );
+          await endpoints.account.delete(
+            onPhone(),
+            proof: DeletionProof(
+              challenge: challenge.challenge,
+              clientValue: answer.clientValue,
+              clientProof: answer.clientProof,
+              totpCode: withoutCode
+                  ? null
+                  : totpCode ?? codeOf(enrolment, at: now),
+              host: testHost,
+            ),
+          );
+        });
+
+        test(
+          'takes the password and a code, as a change does: a session '
+          "alone, or with a phone's authenticator, deletes nothing",
+          () async {
+            await expectLater(
+              delete(withoutProof: true),
+              refused(PasswordRefusal.wrongCredentials),
+            );
+            await expectLater(
+              delete(withoutCode: true),
+              refused(PasswordRefusal.wrongCredentials),
+            );
+            await expectLater(
+              delete(privateValue: BigInt.from(4242)),
+              refused(PasswordRefusal.wrongCredentials),
+            );
+            await expectLater(
+              delete(totpCode: '000000'),
+              refused(PasswordRefusal.wrongCredentials),
+            );
+            await expectLater(
+              delete(host: 'learn.evil.example'),
+              refused(PasswordRefusal.wrongCredentials),
+            );
+            expect(await AuthUser.db.findById(session, anna), isNotNull);
+            expect(await AccountPassword.db.count(session), 1);
+
+            nextStep();
+            await delete();
+
+            expect(await AuthUser.db.findById(session, anna), isNull);
+            expect(await AccountPassword.db.count(session), 0);
+          },
+        );
+
+        test(
+          'of an anonymous person takes its session alone, as before',
+          () async {
+            final ben = await newAnonymousPerson(session);
+            final bensLaptop = await signInNewDevice(session, ben);
+
+            await endpoints.account.delete(
+              sessionBuilder.copyWith(
+                authentication: AuthenticationOverride.authenticationInfo(
+                  ben.uuid,
+                  {},
+                  authId: bensLaptop.uuid,
+                ),
+              ),
+            );
+
+            expect(await AuthUser.db.findById(session, ben), isNull);
+          },
+        );
+      });
+
       group('a reset', () {
         test('of the password with the phrase ends the sessions at the '
             'members too, the new session made after', () async {

packages/halkyon_base_server/test/integration/register/member_test.dart

@@ -433,11 +433,18 @@ final class _Register implements AccountRegister {
   }) => _answer('setRecoveryKeys', () {});
 
   @override
-  Future<void> deleteAccount(Session session, UuidValue person) =>
-      _answer('deleteAccount', () {
-        deleted.add(person);
-        accounts.remove(person);
-      });
+  Future<void> deleteAccount(
+    Session session,
+    UuidValue person, {
+    DeletionProof? proof,
+  }) => _answer('deleteAccount', () {
+    deleted.add(person);
+    deletedWith.add(proof);
+    accounts.remove(person);
+  });
+
+  /// The proofs deletions came with, as the member bound them.
+  final deletedWith = <DeletionProof?>[];
 
   @override
   Future<Set<UuidValue>> knownAccounts(
@@ -831,6 +838,24 @@ void main() {
           expect(await AuthUser.db.findById(session, anna), isNotNull);
         });
 
+        test("passes the password's proof on to the register, bound to "
+            'the host the device addressed here', () async {
+          await endpoints.account.delete(
+            asBen(),
+            proof: DeletionProof(
+              challenge: const Uuid().v7obj(),
+              clientValue: ByteData(384),
+              clientProof: ByteData(32),
+              totpCode: '123456',
+              host: 'LOCALHOST',
+            ),
+          );
+
+          expect(register.deleted, [ben]);
+          expect(register.deletedWith.single?.host, testHost);
+          expect(register.deletedWith.single?.totpCode, '123456');
+        });
+
         test('of an anonymous person deletes it here alone', () async {
           await endpoints.account.delete(asAnna());
 

packages/halkyon_base_server/test/integration/test_tools/serverpod_test_tools.dart

@@ -22,6 +22,8 @@ import 'package:halkyon_base_server/src/generated/password/authenticator.dart'
     as _ip34xal6;
 import 'package:halkyon_base_server/src/generated/password/authenticator_enrolment.dart'
     as _id229ey1;
+import 'package:halkyon_base_server/src/generated/password/deletion_proof.dart'
+    as _i619l6vv;
 import 'package:halkyon_base_server/src/generated/password/key_proof_challenge.dart'
     as _iaysae70;
 import 'package:halkyon_base_server/src/generated/password/new_password.dart'
@@ -270,7 +272,10 @@ class _AccountEndpoint {
 
   final _is.SerializationManager _serializationManager;
 
-  _ida.Future<void> delete(_ist.TestSessionBuilder sessionBuilder) async {
+  _ida.Future<void> delete(
+    _ist.TestSessionBuilder sessionBuilder, {
+    _i619l6vv.DeletionProof? proof,
+  }) async {
     return _ist.callAwaitableFunctionAndHandleExceptions(() async {
       var _localUniqueSession =
           (sessionBuilder as _ist.InternalTestSessionBuilder).internalBuild(
@@ -282,7 +287,7 @@ class _AccountEndpoint {
           createSessionCallback: (_) => _localUniqueSession,
           endpointPath: 'account',
           methodName: 'delete',
-          parameters: _ist.testObjectToJson({}),
+          parameters: _ist.testObjectToJson({'proof': proof}),
           serializationManager: _serializationManager,
         );
         var _localReturnValue =