Tizian 「ティツィアーン」
8d6785f5c6
SimpleLogin takes only https redirect addresses, each registered exactly, so the instance's SimpleLogin app registers one page on the register's web server, /simplelogin-callback, which sends the browser on to the app that began the sign-in: a 303 to the desktop's loopback (127.0.0.1, a port per app) or the phone's scheme, chosen by the marker the state begins with (`<app>-<platform>.<rest>`, the rest 1 to 512 characters of base64url), from a fixed table, so it sends nobody anywhere else. It forwards the code or SimpleLogin's error (`deny`) with the state and nothing else, refuses anything malformed, repeated or not a GET with a page that repeats nothing it was given, and keeps and logs nothing (no-store, no referrer). It is built ahead of the sign-in itself so development can sign in through learn.halkyon.eu's page, which the development app registers too. Android's assetlinks.json for Halkyon Learn signed with the release key is answered by the Caddyfile on learn.halkyon.eu alone: the one domain the project's builds name, and the server knows no app's key. A root test holds its fingerprint to tool/release/android-certificate.sha256. The app's intent filter comes with the sign-in; iOS's association waits for an Apple team ID. The profile page's language choice and look move to common/web_page.dart, shared by both pages. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
34 lines
1.3 KiB
Dart
34 lines
1.3 KiB
Dart
import 'dart:convert';
|
|
import 'dart:io';
|
|
|
|
import 'package:test/test.dart';
|
|
|
|
/// The certificate's SHA-256 as `tool/release/android-certificate.sha256`
|
|
/// pins it, the release tool's way: the first line that isn't a comment.
|
|
String _pinned() =>
|
|
File('tool/release/android-certificate.sha256')
|
|
.readAsLinesSync()
|
|
.map((line) => line.trim())
|
|
.firstWhere((line) => line.isNotEmpty && !line.startsWith('#'));
|
|
|
|
void main() {
|
|
test("learn.halkyon.eu's assetlinks.json names Halkyon Learn signed with "
|
|
'the key releases are signed with, and nothing else (ADR 0020, D9)', () {
|
|
final caddyfile = File('deploy/Caddyfile').readAsStringSync();
|
|
final body = RegExp(r'handle @assetlinks \{[^}]*respond `([^`]*)` 200')
|
|
.firstMatch(caddyfile)?[1];
|
|
expect(body, isNotNull, reason: 'the Caddyfile answers assetlinks.json');
|
|
expect(jsonDecode(body!), [
|
|
{
|
|
'relation': ['delegate_permission/common.handle_all_urls'],
|
|
'target': {
|
|
'namespace': 'android_app',
|
|
'package_name': 'app.halkyon.learn',
|
|
'sha256_cert_fingerprints': [_pinned()],
|
|
},
|
|
},
|
|
]);
|
|
// Colon-separated upper-case hex, as Android's verifier compares it.
|
|
expect(_pinned(), matches(RegExp(r'^([0-9A-F]{2}:){31}[0-9A-F]{2}$')));
|
|
});
|
|
}
|