halkyon-days/halkyon
Watch
1
0
Fork
You've already forked halkyon
 0
Code Issues Pull requests Projects Releases 40 Packages Wiki Activity Actions 1

fix(auth)!: a first password takes a fresh proof of the account's way in

Browse source 
The fourth reading's first finding: password.set took a session alone,
so whoever took one made a GitHub-only account, or an address account
without a password, theirs for good (their address or password, their
authenticator; GitHub then refused the owner).

- An account with an address proves it anew: a code mailed to that
  address for this (EmailCodePurpose.firstPassword, its own mail), never
  the session alone, a code asked for anything else, or another address.
- An account that signs in with GitHub alone does it within 10 minutes of
  a GitHub sign-in (the session's method and creation time, where the
  session lives; members tell the register), refused signInAgain before
  any code is used; the address it adds is proved as before.
- Anonymous people still become identified with a code to the address
  they add.

The app mails the code to the person's own address (asking for it where
the device doesn't know it), offers a password right after a GitHub
sign-in (D2's "at their next sign-in") before the person's app, and asks
for a GitHub sign-in anew when the instance refuses an older one, keeping
the code typed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-10-21 11:31:22 +02:00
commit f0413531ff
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64
1 changed files with 762 additions and 66 deletions
Download patch file Download diff file Expand all files Collapse all files

30
packages/halkyon_app/lib/l10n/halkyon_app_localizations.dart
View file

@ -1398,6 +1398,36 @@ abstract class HalkyonAppLocalizations {
/// In en, this message translates to:
/// **'Your password was changed, but this service couldn\'t sign you in just yet. Sign in again with the new password.'**
String get passwordChangedSignInAgain;
/// No description provided for @passwordSignInAgain.
///
/// In en, this message translates to:
/// **'To give an account that signs in with GitHub its password, sign in with GitHub again first: it has been more than a few minutes.'**
String get passwordSignInAgain;
/// No description provided for @passwordSignInWithGitHubAgain.
///
/// In en, this message translates to:
/// **'Sign in with GitHub again'**
String get passwordSignInWithGitHubAgain;
/// No description provided for @passwordOfferTitle.
///
/// In en, this message translates to:
/// **'Set up a password'**
String get passwordOfferTitle;
/// No description provided for @passwordOfferBody.
///
/// In en, this message translates to:
/// **'Sign-in with GitHub is ending. Set up a password and an authenticator app to keep your account.'**
String get passwordOfferBody;
/// No description provided for @passwordOfferLater.
///
/// In en, this message translates to:
/// **'Later'**
String get passwordOfferLater;
}
class _HalkyonAppLocalizationsDelegate