halkyon-days/halkyon
Watch
1
0
Fork
You've already forked halkyon
 0
Code Issues Pull requests Projects Releases 37 Packages Wiki Activity Actions

fix(auth): a session's wrong codes end the session, not the account's codes

Browse source 
Wrong codes for removing an authenticator, new recovery codes or confirming
one counted toward the account's waits (the re-review's third finding): a
stolen session alone, without the password, could keep the owner's codes
waiting for up to a day at a time, renewed without end, holding them out
of signing in and of changing the password, the way to end that session,
and nobody was mailed. Those codes now count per session, where the session
is (the register's own, or a member's, which forwards the code): each try
counted before its code is checked (one statement, so tries sent at once
count each), a code accepted clearing the count, and the tenth wrong in a
row ending the session (sessionEnded; the device says it was signed out).
A try that checked no code (a refusal of something else) is taken back.
The account's waits now count only codes after a right password, and the
per-account ten tries an hour, which a session could fill as well, go.

Migration (module, Learn's and Todo's servers, Learn's device schema):
CREATE TABLE "session_code_failures" ("id" bigserial PRIMARY KEY,
"sessionId" uuid NOT NULL, "authUserId" uuid NOT NULL, "failures"
bigint NOT NULL, "updatedAt" timestamp NOT NULL) with a unique index on
"sessionId": a new table, nothing touched. Its rows go with a code
accepted, with the person, and hourly once their session is gone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-10-20 22:53:20 +02:00
commit e8c4a3d472
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64
45 changed files with 42634 additions and 88 deletions
Download patch file Download diff file Expand all files Collapse all files

7954
apps/learn/halkyon_learn_client/lib/migrations/20261020204619104-session-code-tries/definition.json Normal file
View file

File diff suppressed because it is too large Load diff

2625
apps/learn/halkyon_learn_client/lib/migrations/20261020204619104-session-code-tries/definition_project.json Normal file
View file

File diff suppressed because it is too large Load diff

1950
apps/learn/halkyon_learn_client/lib/migrations/20261020204619104-session-code-tries/migration.dart Normal file
View file

File diff suppressed because it is too large Load diff

79
apps/learn/halkyon_learn_client/lib/migrations/20261020204619104-session-code-tries/migration.json Normal file
View file

@ -0,0 +1,79 @@
{
"__className__": "serverpod.DatabaseMigration",
"actions": [
{
"__className__": "serverpod.DatabaseMigrationAction",
"type": "createTable",
"createTable": {
"__className__": "serverpod.TableDefinition",
"name": "session_code_failures",
"dartName": "SessionCodeFailures",
"module": "halkyon_base",
"schema": "public",
"columns": [
{
"__className__": "serverpod.ColumnDefinition",
"name": "id",
"fieldName": "id",
"columnType": 6,
"isNullable": false,
"columnDefault": "serial",
"dartType": "int?"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "sessionId",
"fieldName": "sessionId",
"columnType": 7,
"isNullable": false,
"dartType": "UuidValue"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "authUserId",
"fieldName": "authUserId",
"columnType": 7,
"isNullable": false,
"dartType": "UuidValue"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "failures",
"fieldName": "failures",
"columnType": 6,
"isNullable": false,
"dartType": "int"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "updatedAt",
"fieldName": "updatedAt",
"columnType": 4,
"isNullable": false,
"dartType": "DateTime"
}
],
"foreignKeys": [],
"indexes": [
{
"__className__": "serverpod.IndexDefinition",
"indexName": "session_code_failures_session_idx",
"elements": [
{
"__className__": "serverpod.IndexElementDefinition",
"type": 0,
"definition": "sessionId"
}
],
"type": "btree",
"isUnique": true,
"isPrimary": false
}
],
"managed": true
}
}
],
"warnings": [],
"migrationApiVersion": 1
}

2
apps/learn/halkyon_learn_client/lib/migrations/migration_registry.dart
View file

@ -22,6 +22,7 @@ part '20261020111943300-passwords/migration.dart';
part '20261020125117584-sessions-ended/migration.dart';
part '20261020185750538-recovery-proof-key/migration.dart';
part '20261020194228286-second-factor-waits/migration.dart';
part '20261020204619104-session-code-tries/migration.dart';
/// Migration registry for the client-side database.
class MigrationRegistry {
@ -46,6 +47,7 @@ class MigrationRegistry {
_Migration20261020125117584_sessions_ended(),
_Migration20261020185750538_recovery_proof_key(),
_Migration20261020194228286_second_factor_waits(),
_Migration20261020204619104_session_code_tries(),
];
/// List of all client-side database migration versions.

9850
apps/learn/halkyon_learn_server/migrations/20261020204619104-session-code-tries/definition.json Normal file
View file

File diff suppressed because it is too large Load diff

2342
apps/learn/halkyon_learn_server/migrations/20261020204619104-session-code-tries/definition.sql Normal file
View file

File diff suppressed because it is too large Load diff

4521
apps/learn/halkyon_learn_server/migrations/20261020204619104-session-code-tries/definition_project.json Normal file
View file

File diff suppressed because it is too large Load diff

79
apps/learn/halkyon_learn_server/migrations/20261020204619104-session-code-tries/migration.json Normal file
View file

@ -0,0 +1,79 @@
{
"__className__": "serverpod.DatabaseMigration",
"actions": [
{
"__className__": "serverpod.DatabaseMigrationAction",
"type": "createTable",
"createTable": {
"__className__": "serverpod.TableDefinition",
"name": "session_code_failures",
"dartName": "SessionCodeFailures",
"module": "halkyon_base",
"schema": "public",
"columns": [
{
"__className__": "serverpod.ColumnDefinition",
"name": "id",
"fieldName": "id",
"columnType": 6,
"isNullable": false,
"columnDefault": "serial",
"dartType": "int?"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "sessionId",
"fieldName": "sessionId",
"columnType": 7,
"isNullable": false,
"dartType": "UuidValue"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "authUserId",
"fieldName": "authUserId",
"columnType": 7,
"isNullable": false,
"dartType": "UuidValue"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "failures",
"fieldName": "failures",
"columnType": 6,
"isNullable": false,
"dartType": "int"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "updatedAt",
"fieldName": "updatedAt",
"columnType": 4,
"isNullable": false,
"dartType": "DateTime"
}
],
"foreignKeys": [],
"indexes": [
{
"__className__": "serverpod.IndexDefinition",
"indexName": "session_code_failures_session_idx",
"elements": [
{
"__className__": "serverpod.IndexElementDefinition",
"type": 0,
"definition": "sessionId"
}
],
"type": "btree",
"isUnique": true,
"isPrimary": false
}
],
"managed": true
}
}
],
"warnings": [],
"migrationApiVersion": 1
}

67
apps/learn/halkyon_learn_server/migrations/20261020204619104-session-code-tries/migration.sql Normal file
View file

@ -0,0 +1,67 @@
BEGIN;
--
-- ACTION CREATE TABLE
--
CREATE TABLE "session_code_failures" (
"id" bigserial PRIMARY KEY,
"sessionId" uuid NOT NULL,
"authUserId" uuid NOT NULL,
"failures" bigint NOT NULL,
"updatedAt" timestamp without time zone NOT NULL
);
-- Indexes
CREATE UNIQUE INDEX "session_code_failures_session_idx" ON "session_code_failures" USING btree ("sessionId");
--
-- MIGRATION VERSION FOR halkyon_learn
--
INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
VALUES ('halkyon_learn', '20261020204619104-session-code-tries', now())
ON CONFLICT ("module")
DO UPDATE SET "version" = '20261020204619104-session-code-tries', "timestamp" = now();
--
-- MIGRATION VERSION FOR halkyon_base
--
INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
VALUES ('halkyon_base', '20261020204618337-session-code-tries', now())
ON CONFLICT ("module")
DO UPDATE SET "version" = '20261020204618337-session-code-tries', "timestamp" = now();
--
-- MIGRATION VERSION FOR serverpod
--
INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
VALUES ('serverpod', '20260824182259319', now())
ON CONFLICT ("module")
DO UPDATE SET "version" = '20260824182259319', "timestamp" = now();
--
-- MIGRATION VERSION FOR serverpod_auth_idp
--
INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
VALUES ('serverpod_auth_idp', '20260924105404509', now())
ON CONFLICT ("module")
DO UPDATE SET "version" = '20260924105404509', "timestamp" = now();
--
-- MIGRATION VERSION FOR serverpod_offline_sync
--
INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
VALUES ('serverpod_offline_sync', '20260914143806119', now())
ON CONFLICT ("module")
DO UPDATE SET "version" = '20260914143806119', "timestamp" = now();
--
-- MIGRATION VERSION FOR serverpod_auth_core
--
INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
VALUES ('serverpod_auth_core', '20260924105232991', now())
ON CONFLICT ("module")
DO UPDATE SET "version" = '20260924105232991', "timestamp" = now();
COMMIT;

1
apps/learn/halkyon_learn_server/migrations/migration_registry.txt
View file

@ -39,3 +39,4 @@
20261020125117584-sessions-ended
20261020185750538-recovery-proof-key
20261020194228286-second-factor-waits
20261020204619104-session-code-tries

4301
apps/todo/halkyon_todo_server/migrations/20261020204619863-session-code-tries/definition.json Normal file
View file

File diff suppressed because it is too large Load diff

1016
apps/todo/halkyon_todo_server/migrations/20261020204619863-session-code-tries/definition.sql Normal file
View file

File diff suppressed because it is too large Load diff

29
apps/todo/halkyon_todo_server/migrations/20261020204619863-session-code-tries/definition_project.json Normal file
View file

@ -0,0 +1,29 @@
{
"__className__": "serverpod.DatabaseDefinition",
"schemaVersion": 2,
"moduleName": "halkyon_todo",
"tables": [],
"installedModules": [
{
"__className__": "serverpod.DatabaseMigrationVersion",
"module": "halkyon_base",
"version": "20261020204618337-session-code-tries"
},
{
"__className__": "serverpod.DatabaseMigrationVersion",
"module": "serverpod",
"version": "20260824182259319"
},
{
"__className__": "serverpod.DatabaseMigrationVersion",
"module": "serverpod_auth_idp",
"version": "20260924105404509"
},
{
"__className__": "serverpod.DatabaseMigrationVersion",
"module": "serverpod_auth_core",
"version": "20260924105232991"
}
],
"migrationApiVersion": 1
}

79
apps/todo/halkyon_todo_server/migrations/20261020204619863-session-code-tries/migration.json Normal file
View file

@ -0,0 +1,79 @@
{
"__className__": "serverpod.DatabaseMigration",
"actions": [
{
"__className__": "serverpod.DatabaseMigrationAction",
"type": "createTable",
"createTable": {
"__className__": "serverpod.TableDefinition",
"name": "session_code_failures",
"dartName": "SessionCodeFailures",
"module": "halkyon_base",
"schema": "public",
"columns": [
{
"__className__": "serverpod.ColumnDefinition",
"name": "id",
"fieldName": "id",
"columnType": 6,
"isNullable": false,
"columnDefault": "serial",
"dartType": "int?"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "sessionId",
"fieldName": "sessionId",
"columnType": 7,
"isNullable": false,
"dartType": "UuidValue"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "authUserId",
"fieldName": "authUserId",
"columnType": 7,
"isNullable": false,
"dartType": "UuidValue"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "failures",
"fieldName": "failures",
"columnType": 6,
"isNullable": false,
"dartType": "int"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "updatedAt",
"fieldName": "updatedAt",
"columnType": 4,
"isNullable": false,
"dartType": "DateTime"
}
],
"foreignKeys": [],
"indexes": [
{
"__className__": "serverpod.IndexDefinition",
"indexName": "session_code_failures_session_idx",
"elements": [
{
"__className__": "serverpod.IndexElementDefinition",
"type": 0,
"definition": "sessionId"
}
],
"type": "btree",
"isUnique": true,
"isPrimary": false
}
],
"managed": true
}
}
],
"warnings": [],
"migrationApiVersion": 1
}

59
apps/todo/halkyon_todo_server/migrations/20261020204619863-session-code-tries/migration.sql Normal file
View file

@ -0,0 +1,59 @@
BEGIN;
--
-- ACTION CREATE TABLE
--
CREATE TABLE "session_code_failures" (
"id" bigserial PRIMARY KEY,
"sessionId" uuid NOT NULL,
"authUserId" uuid NOT NULL,
"failures" bigint NOT NULL,
"updatedAt" timestamp without time zone NOT NULL
);
-- Indexes
CREATE UNIQUE INDEX "session_code_failures_session_idx" ON "session_code_failures" USING btree ("sessionId");
--
-- MIGRATION VERSION FOR halkyon_todo
--
INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
VALUES ('halkyon_todo', '20261020204619863-session-code-tries', now())
ON CONFLICT ("module")
DO UPDATE SET "version" = '20261020204619863-session-code-tries', "timestamp" = now();
--
-- MIGRATION VERSION FOR halkyon_base
--
INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
VALUES ('halkyon_base', '20261020204618337-session-code-tries', now())
ON CONFLICT ("module")
DO UPDATE SET "version" = '20261020204618337-session-code-tries', "timestamp" = now();
--
-- MIGRATION VERSION FOR serverpod
--
INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
VALUES ('serverpod', '20260824182259319', now())
ON CONFLICT ("module")
DO UPDATE SET "version" = '20260824182259319', "timestamp" = now();
--
-- MIGRATION VERSION FOR serverpod_auth_idp
--
INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
VALUES ('serverpod_auth_idp', '20260924105404509', now())
ON CONFLICT ("module")
DO UPDATE SET "version" = '20260924105404509', "timestamp" = now();
--
-- MIGRATION VERSION FOR serverpod_auth_core
--
INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
VALUES ('serverpod_auth_core', '20260924105232991', now())
ON CONFLICT ("module")
DO UPDATE SET "version" = '20260924105232991', "timestamp" = now();
COMMIT;

1
apps/todo/halkyon_todo_server/migrations/migration_registry.txt
View file

@ -11,3 +11,4 @@
20261020125124942-sessions-ended
20261020185752014-recovery-proof-key
20261020194229631-second-factor-waits
20261020204619863-session-code-tries

3
packages/halkyon_app/lib/l10n/halkyon_app_de.arb
View file

@ -210,5 +210,6 @@
"passwordMinLength": "Mindestens {count} Zeichen",
"passwordTooShort": "Ein neues Passwort braucht mindestens {count} Zeichen: Sollte die Datenbank der Instanz je nach außen gelangen, wird ein kurzes zuerst erraten.",
"passwordCodesWait": "Zu viele falsche Codes hintereinander: Bis {date} wird kein Code angenommen. Waren es nicht deine, kennt jemand dein Passwort: Ändere es dann.",
"passwordDeleteIntro": "Dein Konto wird mit allem darin gelöscht, in jedem Dienst dieser Instanz. Gib zur Bestätigung dein Passwort und einen Code deiner Authenticator-App ein."
"passwordDeleteIntro": "Dein Konto wird mit allem darin gelöscht, in jedem Dienst dieser Instanz. Gib zur Bestätigung dein Passwort und einen Code deiner Authenticator-App ein.",
"passwordSessionEnded": "Zu viele falsche Codes hintereinander von diesem Gerät: Es wurde abgemeldet. Melde dich wieder mit deinem Passwort und einem Code an."
}

3
packages/halkyon_app/lib/l10n/halkyon_app_en.arb
View file

@ -457,5 +457,6 @@
}
}
},
"passwordDeleteIntro": "Your account goes with everything in it, in every service of this instance. To confirm, type your password and a code from your authenticator app."
"passwordDeleteIntro": "Your account goes with everything in it, in every service of this instance. To confirm, type your password and a code from your authenticator app.",
"passwordSessionEnded": "Too many wrong codes in a row from this device: it was signed out. Sign in again with your password and a code."
}

6
packages/halkyon_app/lib/l10n/halkyon_app_localizations.dart
View file

@ -1368,6 +1368,12 @@ abstract class HalkyonAppLocalizations {
/// In en, this message translates to:
/// **'Your account goes with everything in it, in every service of this instance. To confirm, type your password and a code from your authenticator app.'**
String get passwordDeleteIntro;
/// No description provided for @passwordSessionEnded.
///
/// In en, this message translates to:
/// **'Too many wrong codes in a row from this device: it was signed out. Sign in again with your password and a code.'**
String get passwordSessionEnded;
}
class _HalkyonAppLocalizationsDelegate

Some files were not shown because too many files have changed in this diff Show more