Tizian 「ティツィアーン」
a253700f8b
The register's tests make the device's side from made-up bytes, and the app's from fakes; nothing held what the device's real cryptography (libsodium, on isolates) makes to what the register takes. Now register_interop_test.dart does: a new account's setup passes isPasswordSetup, the device's SRP answer checks with the register's srpVerify and its M2 with the device, bound to the instance and the purpose (another instance's or a change's identity refused), the keys open as made, a new password passes isNewPassword, and the phrase's proof for it checks against the phrase's own key, never the account's, with the device's framing of the message the register's. halkyon_base_server exports the checks it uses; halkyon_app takes it as a dev dependency. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
93 lines
3.5 KiB
YAML
93 lines
3.5 KiB
YAML
name: halkyon_app
|
|
description: "What every Halkyon app is built around: the instances a device keeps accounts on, signing in through an instance's halkyon_base, each person's data opened and closed, and syncing it."
|
|
version: 0.1.0
|
|
publish_to: none
|
|
resolution: workspace
|
|
|
|
environment:
|
|
sdk: ^3.13.0
|
|
flutter: ^3.44.4
|
|
|
|
dependencies:
|
|
clock: ^1.1.3
|
|
equatable: ^3.0.0
|
|
# chmod(2) for files saved on the desktop: the own user's alone (FileSaver).
|
|
ffi: ^2.2.0
|
|
# Keeping a file the app made where the person chooses (FileSaver): the
|
|
# system's dialog on Android and iOS, file_selector's on the desktop.
|
|
file_picker: ^13.1.0
|
|
file_selector: ^1.1.0
|
|
# The flag of where an instance keeps people's data; it draws lipis'
|
|
# flag-icons, whose MIT notice this package registers (assets/flags/).
|
|
flag: ^7.1.0
|
|
flutter:
|
|
sdk: flutter
|
|
flutter_bloc: ^9.1.1
|
|
# gen-l10n's output imports it; apps take Material's texts from material_ui.
|
|
flutter_localizations:
|
|
sdk: flutter
|
|
# The account's private keys, once unlocked, in the system's keyring
|
|
# (ADR 0017), as Serverpod keeps sessions.
|
|
flutter_secure_storage: ^10.0.0
|
|
# LoopbackWebAuth takes the place of the package's own browser half on
|
|
# Linux and Windows.
|
|
flutter_web_auth_2_platform_interface: ^5.0.0
|
|
halkyon_base_client:
|
|
path: ../halkyon_base_client
|
|
halkyon_core:
|
|
path: ../halkyon_core
|
|
# The account's keys on the device (ADR 0017): libsodium, which its build
|
|
# hook compiles, so every build of an app needs a C compiler and make.
|
|
halkyon_keys:
|
|
path: ../halkyon_keys
|
|
halkyon_ui:
|
|
path: ../halkyon_ui
|
|
# A client of halkyon_base alone can be given a fake one in tests.
|
|
http: ^1.6.0
|
|
intl: ^0.20.3
|
|
lucide_icons_flutter: ^3.1.20
|
|
material_ui: ^1.5.0
|
|
path: ^1.9.1
|
|
# QR codes of an authenticator's otpauth:// URI, drawn by the app itself
|
|
# (BSD-3-Clause, pure Dart; pinned exactly, as what it encodes is a secret).
|
|
qr: 3.0.2
|
|
# Serverpod's packages move together, at one version (as the apps pin them).
|
|
serverpod_auth_core_client: 4.0.4
|
|
serverpod_auth_idp_client: 4.0.4
|
|
serverpod_auth_idp_flutter: 4.0.4
|
|
serverpod_client: 4.0.4
|
|
# Its sync refuses an app whose synced tables differ from the server's
|
|
# (OfflineSyncTablesHashMismatchException).
|
|
serverpod_offline_sync_client: 0.0.10
|
|
# libsodium's API, as halkyon_keys pins it (the same version, exactly):
|
|
# opening it on each isolate the account's keys are worked on.
|
|
sodium: 4.1.0+1
|
|
url_launcher: ^6.3.2
|
|
window_to_front: ^0.0.4
|
|
|
|
dev_dependencies:
|
|
fake_async: ^1.3.3
|
|
flutter_test:
|
|
sdk: flutter
|
|
# A test drives sign-in through its front, as Serverpod's GitHub sign-in does.
|
|
flutter_web_auth_2: ^5.1.0
|
|
# The register's own checks, which the device's real cryptography is held
|
|
# to (register_interop_test.dart).
|
|
halkyon_base_server:
|
|
path: ../halkyon_base_server
|
|
|
|
flutter:
|
|
# Generates HalkyonAppLocalizations from lib/l10n (see l10n.yaml).
|
|
generate: true
|
|
|
|
assets:
|
|
# flag-icons' MIT notice, for the licence list (registerFlagIconsLicense).
|
|
- assets/flags/LICENSE-flag-icons.txt
|
|
# Unicode CLDR's names of subdivisions (states, regions) in English and
|
|
# German (AssetSubdivisionNames; tool/subdivision_names.py writes them),
|
|
# and its licence's notice (registerCldrLicense).
|
|
- assets/subdivisions/subdivisions.json
|
|
- assets/subdivisions/LICENSE-CLDR.txt
|
|
# Unicode CLDR's names of countries in English and German, from the same
|
|
# release (AssetCountryNames; tool/country_names.py writes them).
|
|
- assets/countries/countries.json
|