halkyon-days/halkyon
Watch
1
0
Fork
You've already forked halkyon
 0
Code Issues Pull requests Projects Releases 37 Packages Wiki Activity Actions

fix(auth): a proof the register couldn't answer counts; the sign-up mail says it gives a password

Browse source 
Two of the fourth reading's lows:

- A signed-in proof whose call to the register failed
  (RegisterUnavailableException, a member's call timing out after the
  register checked it) stays counted against the session, rather than
  taken back: a guess never goes uncounted.
- A sign-up code also gives an existing account with that address its
  first password, which its mail now says in the subject too ("create an
  account or give it a password").

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-10-21 11:46:01 +02:00
commit f154b7ea7c
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64
2 changed files with 50 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

27
packages/halkyon_base_server/test/integration/register/member_test.dart
View file

@ -727,6 +727,33 @@ void main() {
expect(left.single.createdAt.isBefore(endedBefore), isFalse);
});
test("count a proof whose answer the register couldn't give, as it "
'may have checked it (the fourth reading)', () async {
register.failing = RegisterUnavailableException('test');
await expectLater(
endpoints.authenticator.newRecoveryCodes(
asAnna(),
proof: OwnerProof(
challenge: const Uuid().v7obj(),
clientValue: ByteData(384),
clientProof: ByteData(32),
host: testHost,
totpCode: '123456',
),
),
throwsA(isA<RegisterUnavailableException>()),
);
expect(
(await SessionCodeFailures.db.findFirstRow(
session,
where: (t) => t.sessionId.equals(annasPhone),
))?.failures,
1,
);
});
test('sign up at the register, the new account signed in here, '
'identified', () async {
final device = await PasswordDevice.make();

21
packages/halkyon_base_server/test/unit/code_mail_test.dart
View file

@ -100,7 +100,8 @@ void main() {
expect(
mail.subject,
'K7QX-M2PD: your Halkyon Learn code to create an account',
'K7QX-M2PD: your Halkyon Learn code to create an account or give it '
'a password',
);
expect(mail.body, startsWith('K7QX-M2PD\n\n'));
expect(mail.body, contains('create your account on learn.halkyon.eu'));
@ -173,7 +174,8 @@ void main() {
).subject;
const english = {
EmailCodePurpose.signUp:
'K7QX-M2PD: your Halkyon Learn code to create an account',
'K7QX-M2PD: your Halkyon Learn code to create an account or give '
'it a password',
EmailCodePurpose.finishSetup:
'K7QX-M2PD: your Halkyon Learn code to finish setting up your '
'account',
@ -190,7 +192,8 @@ void main() {
};
const german = {
EmailCodePurpose.signUp:
'K7QX-M2PD: dein Halkyon-Learn-Code, um ein Konto anzulegen',
'K7QX-M2PD: dein Halkyon-Learn-Code, um ein Konto anzulegen oder '
'ihm ein Passwort zu geben',
EmailCodePurpose.finishSetup:
'K7QX-M2PD: dein Halkyon-Learn-Code, um dein Konto fertig '
'einzurichten',
@ -248,11 +251,13 @@ void main() {
expect(
mailIn('de').subject,
'K7QX-M2PD: dein Halkyon-Learn-Code, um ein Konto anzulegen',
'K7QX-M2PD: dein Halkyon-Learn-Code, um ein Konto anzulegen oder ihm '
'ein Passwort zu geben',
);
expect(
mailIn('fr').subject,
'K7QX-M2PD: your Halkyon Learn code to create an account',
'K7QX-M2PD: your Halkyon Learn code to create an account or give '
'it a password',
);
});
@ -267,12 +272,14 @@ void main() {
expect(
mailIn('en').subject,
'K7QX-M2PD: your Halkyon Todo code to create an account',
'K7QX-M2PD: your Halkyon Todo code to create an account or give it a '
'password',
);
expect(mailIn('en').body, contains('Type this code in Halkyon Todo'));
expect(
mailIn('de').subject,
'K7QX-M2PD: dein Halkyon-Todo-Code, um ein Konto anzulegen',
'K7QX-M2PD: dein Halkyon-Todo-Code, um ein Konto anzulegen oder '
'ihm ein Passwort zu geben',
);
expect(mailIn('de').body, contains('Gib diesen Code in Halkyon Todo'));
});