Tizian 「ティツィアーン」
1d4320370b
Codes by mail were tied to nothing but their address (the re-review's
seventh finding): a hostile instance could answer that a setup never
finished, have the person type a code into it, relay it to start the real
instance's account reset, and 72 hours later relay a second to finish it
with its own password and keys; the mail said "to sign in" whatever the
code was for. A code is now asked for a purpose (signUp, finishSetup,
authenticatorReset, accountReset, deletion), only that purpose takes it (any
other is refused as no longer valid, leaving the code as it was), and its
mail says what it would do ("to reset your account on learn.halkyon.eu: a
new password and new keys, and what was encrypted with the old ones is
lost") and to type it only in the app on that instance, nowhere else. The
app asks for each code with the purpose of its step.
Migration (module, Learn's and Todo's servers, Learn's device schema):
ALTER TABLE "email_code_request" ADD COLUMN "purpose" text; nullable,
so the requests of the last 15 minutes before it stay, taken by nothing
and forgotten within the hour.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
101 lines
4.9 KiB
Dart
101 lines
4.9 KiB
Dart
/// What every Halkyon app is built around, on an instance's halkyon_base:
|
|
///
|
|
/// - **Instances**: the ones a device keeps an account on, one in use at a
|
|
/// time (`InstanceChoice`), chosen at first start (`FirstStartScreen`) or
|
|
/// added later (`showAccountSwitcher`), each checked before the app moves
|
|
/// there (`InstanceChecker`) and saying where it keeps people's data.
|
|
/// - **Gates**: `InstanceGate` opens the app's dependencies on the instance
|
|
/// in use (`AppDependencies`, `AppScope`); `SessionGate` keeps a person
|
|
/// signed in and asks how to start once signed out (`StartScreen`);
|
|
/// `PersonScope` opens each person's own dependencies.
|
|
/// - **The account and About**: `AccountTiles` for an app's settings,
|
|
/// `showAppAbout` with the source of what the instance runs, and
|
|
/// `resolveAppLocale`, the language every Halkyon app picks.
|
|
/// - **Signing in**: anonymously, with GitHub (`AuthRepository` on
|
|
/// `ServerpodAuthGateway`), and with a password and TOTP (ADR 0017:
|
|
/// `PasswordRepository`, its sheets and `AccountSecuritySection`), the
|
|
/// account's keys on the device.
|
|
/// - **Sync**: `SyncService` on triggers, the changes still waiting, and
|
|
/// where it stands (`SyncStatusBloc`, `SyncStatusCard`, `AppMismatchBanner`,
|
|
/// `SyncTroubleBadge`).
|
|
///
|
|
/// An app gives its name, look and own words as an `AppFrame`, and installs
|
|
/// `HalkyonAppLocalizations.delegate` beside its own.
|
|
library;
|
|
|
|
export 'l10n/halkyon_app_localizations.dart';
|
|
export 'src/app/about.dart';
|
|
export 'src/app/app_frame.dart' show AppFrame, AppFrameScope, LookSettings;
|
|
export 'src/app/app_locale.dart';
|
|
export 'src/app/app_scope.dart';
|
|
export 'src/app/instance_gate.dart';
|
|
export 'src/app/person_scope.dart';
|
|
export 'src/auth/bloc/github_sign_in_bloc.dart';
|
|
export 'src/auth/bloc/session_bloc.dart';
|
|
export 'src/auth/bloc/sign_in_ways_cubit.dart';
|
|
export 'src/auth/data/auth_gateway.dart';
|
|
export 'src/auth/data/auth_repository.dart';
|
|
export 'src/auth/data/loopback_web_auth.dart';
|
|
export 'src/auth/data/serverpod_auth_gateway.dart';
|
|
export 'src/auth/data/sign_in_addresses.dart';
|
|
export 'src/auth/data/signed_out_mark.dart';
|
|
export 'src/auth/model/auth_status.dart';
|
|
export 'src/auth/model/github_link_outcome.dart';
|
|
export 'src/auth/model/github_sign_in.dart';
|
|
export 'src/auth/model/session_grant.dart';
|
|
export 'src/auth/model/sign_in_ways.dart';
|
|
export 'src/auth/widget/account_tiles.dart';
|
|
export 'src/auth/widget/session_gate.dart';
|
|
export 'src/auth/widget/start_screen.dart';
|
|
export 'src/base/base_client.dart';
|
|
export 'src/files/file_saver.dart';
|
|
export 'src/instance/cldr_license.dart';
|
|
export 'src/instance/country_names.dart';
|
|
export 'src/instance/european_union.dart';
|
|
export 'src/instance/flag_icons_license.dart';
|
|
export 'src/instance/instance.dart';
|
|
export 'src/instance/instance_checker.dart';
|
|
export 'src/instance/instance_choice.dart';
|
|
export 'src/instance/instance_locations.dart';
|
|
export 'src/instance/instance_scope.dart';
|
|
export 'src/instance/instance_storage.dart';
|
|
export 'src/instance/instance_store.dart';
|
|
export 'src/instance/subdivision_names.dart';
|
|
export 'src/instance/widget/account_switcher_sheet.dart';
|
|
export 'src/instance/widget/first_start_screen.dart';
|
|
export 'src/instance/widget/instance_location.dart';
|
|
export 'src/instance/widget/instance_location_words.dart';
|
|
export 'src/instance/widget/instance_step.dart';
|
|
export 'src/instance/widget/instance_tile.dart';
|
|
export 'src/password/bloc/account_recovery_cubit.dart';
|
|
export 'src/password/bloc/account_security_cubit.dart';
|
|
export 'src/password/bloc/account_setup_cubit.dart';
|
|
export 'src/password/bloc/password_sign_in_cubit.dart';
|
|
export 'src/password/data/account_crypto.dart';
|
|
export 'src/password/data/account_key_store.dart';
|
|
export 'src/password/data/password_gateway.dart';
|
|
export 'src/password/data/password_repository.dart';
|
|
export 'src/password/data/serverpod_password_gateway.dart';
|
|
export 'src/password/data/sodium_account_crypto.dart';
|
|
export 'src/password/model/account_authenticator.dart';
|
|
export 'src/password/model/account_security.dart';
|
|
export 'src/password/model/mail_code_purpose.dart';
|
|
export 'src/password/model/password_failed.dart';
|
|
export 'src/password/model/phrase_check.dart';
|
|
export 'src/password/model/unlocked_account_keys.dart';
|
|
export 'src/password/widget/account_recovery_sheet.dart';
|
|
export 'src/password/widget/account_security_section.dart';
|
|
export 'src/password/widget/account_setup_sheet.dart';
|
|
export 'src/password/widget/password_sign_in_sheet.dart';
|
|
export 'src/password/widget/password_texts.dart';
|
|
export 'src/password/widget/password_widgets.dart';
|
|
export 'src/person/person_folders.dart';
|
|
export 'src/sync/app_compatibility.dart';
|
|
export 'src/sync/bloc/sync_status_bloc.dart';
|
|
export 'src/sync/pending_changes_store.dart';
|
|
export 'src/sync/sync_service.dart';
|
|
export 'src/sync/sync_status.dart';
|
|
export 'src/sync/widget/app_mismatch_banner.dart';
|
|
export 'src/sync/widget/sync_and_wait.dart';
|
|
export 'src/sync/widget/sync_status_card.dart';
|
|
export 'src/sync/widget/sync_trouble_badge.dart';
|