halkyon-days/halkyon
Watch
1
0
Fork
You've already forked halkyon
 0
Code Issues Pull requests Projects Releases 37 Packages Wiki Activity Actions

fix(auth): an account with a password deletes itself only with it and a code

Browse source 
A session alone deleted any account, with everything encrypted under its
keys (the second reading's lows; decided by the developer: the password
and a code, as a change of password takes). account.delete now takes a
DeletionProof (the password's SRP proof for a beginChange challenge, a
TOTP or recovery code, the host the device addressed); the register
checks it (requireOwnerToDelete), a member passing it on bound to its own
host. Accounts without a password, anonymous ones among them, delete with
their session as before. In the app, deleting an account with a password
asks for it and a code in a sheet of its own; a wrong one deletes
nothing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-10-20 21:59:42 +02:00
commit d53844bc93
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64
1 changed files with 873 additions and 32 deletions
Download patch file Download diff file Expand all files Collapse all files

9
packages/halkyon_base_server/test/integration/test_tools/serverpod_test_tools.dart
View file

@ -22,6 +22,8 @@ import 'package:halkyon_base_server/src/generated/password/authenticator.dart'
as _ip34xal6;
import 'package:halkyon_base_server/src/generated/password/authenticator_enrolment.dart'
as _id229ey1;
import 'package:halkyon_base_server/src/generated/password/deletion_proof.dart'
as _i619l6vv;
import 'package:halkyon_base_server/src/generated/password/key_proof_challenge.dart'
as _iaysae70;
import 'package:halkyon_base_server/src/generated/password/new_password.dart'
@ -270,7 +272,10 @@ class _AccountEndpoint {
final _is.SerializationManager _serializationManager;
_ida.Future<void> delete(_ist.TestSessionBuilder sessionBuilder) async {
_ida.Future<void> delete(
_ist.TestSessionBuilder sessionBuilder, {
_i619l6vv.DeletionProof? proof,
}) async {
return _ist.callAwaitableFunctionAndHandleExceptions(() async {
var _localUniqueSession =
(sessionBuilder as _ist.InternalTestSessionBuilder).internalBuild(
@ -282,7 +287,7 @@ class _AccountEndpoint {
createSessionCallback: (_) => _localUniqueSession,
endpointPath: 'account',
methodName: 'delete',
parameters: _ist.testObjectToJson({}),
parameters: _ist.testObjectToJson({'proof': proof}),
serializationManager: _serializationManager,
);
var _localReturnValue =