halkyon/packages/halkyon_app/test/auth/bloc/session_bloc_test.dart
Tizian 「ティツィアーン」 ae57cbe864
feat(auth)!: codes by mail no longer sign in
ADR 0017, step 3 (D4: nobody signs in with email codes yet, so the
password replaces them outright). `emailCode.verifyCode`,
`emailSignIn.signIn` and the switch token go, with the register's
`verifySignInCode` and `completeEmailSwitch` and their operations
between services. `emailCode.sendCode` stays, now without a session
(signing up and getting back in have none), as what proves an address
for a password's setup, a sign-up, a setup never finished and the
resets; `accountRecovery.sendCode`, which did that for the resets,
goes. The `switchChallengeId` column stays: Serverpod's challenges
still link a completion token, and older servers read it during a
deploy.

The apps: halkyon_app's email sign-in (its bloc, sheet, gateway calls
and the start screen's Continue with email) goes; Learn's profile and
Todo's account sheet show `AccountSecuritySection` (a password set up
by someone anonymous or signing in with GitHub, whose end it names;
the authenticators; changing the password; new recovery codes and
phrase), which reads anew after every change the repository makes.

BREAKING CHANGE: Learn's `minimumAppBuild` is 22: builds up to 21 sign
in with the endpoints that went. Todo was never released and stays at
build 1.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
2026-10-23 14:12:41 +02:00

187 lines
5.8 KiB
Dart

import 'package:flutter_test/flutter_test.dart';
import 'package:halkyon_app/halkyon_app.dart';
import 'package:halkyon_app/testing.dart';
void main() {
late FakeAuthGateway gateway;
late MemorySignedOutMark mark;
late SessionBloc bloc;
SessionStateActive anonymous(int number) => SessionStateActive(
SignedIn(authUserId: 'anonymous-$number', isIdentified: false),
);
void start({AuthStatus status = const SignedOut(), bool signedOut = false}) {
gateway = FakeAuthGateway(status: status);
mark = MemorySignedOutMark(signedOut);
bloc = SessionBloc(AuthRepository(gateway, MemorySignInAddresses()), mark);
}
tearDown(() => bloc.close());
test('signs in anonymously at a first start, nobody having signed out '
'here', () async {
start();
bloc.add(const SessionEventStarted());
await expectLater(
bloc.stream,
emitsInOrder([const SessionStateLoading(), anonymous(1)]),
);
expect(gateway.signIns, 1);
});
test('keeps a stored session instead of creating a second account', () async {
const stored = SignedIn(authUserId: 'stored', isIdentified: false);
start(status: stored);
bloc.add(const SessionEventStarted());
await expectLater(bloc.stream, emits(const SessionStateActive(stored)));
expect(gateway.signIns, 0);
});
test('reports a failed sign-in and signs in when asked again', () async {
start();
gateway.signInError = Exception('No connection');
bloc.add(const SessionEventStarted());
await expectLater(
bloc.stream,
emitsInOrder([const SessionStateLoading(), const SessionStateFailed()]),
);
gateway.signInError = null;
bloc.add(const SessionEventSignInRequested());
await expectLater(
bloc.stream,
emitsInOrder([const SessionStateLoading(), anonymous(2)]),
);
});
test('after signing out, asks how to start, making no account; the next '
'start of the app asks again', () async {
const stored = SignedIn(authUserId: 'stored', isIdentified: false);
start(status: stored);
bloc.add(const SessionEventStarted());
await expectLater(bloc.stream, emits(const SessionStateActive(stored)));
bloc.add(const SessionEventSignOutRequested());
await expectLater(
bloc.stream,
emitsInOrder([
const SessionStateLoading(),
const SessionStateSignedOut(),
]),
);
// Signing out of an anonymous account deletes it.
expect(gateway.accountDeletions, 1);
expect(gateway.signIns, 0);
expect(mark.signedOut, isTrue);
await bloc.close();
bloc = SessionBloc(AuthRepository(gateway, MemorySignInAddresses()), mark)
..add(const SessionEventStarted());
await expectLater(bloc.stream, emits(const SessionStateSignedOut()));
expect(gateway.signIns, 0);
});
test('starting without an account from there signs in anonymously, and '
'the device is no longer signed out', () async {
start(signedOut: true);
bloc.add(const SessionEventStarted());
await expectLater(bloc.stream, emits(const SessionStateSignedOut()));
bloc.add(const SessionEventStartedAnonymously());
await expectLater(
bloc.stream,
emitsInOrder([const SessionStateLoading(), anonymous(1)]),
);
expect(mark.signedOut, isFalse);
});
test('signing in with GitHub from there switches to its person; '
'cancelled, it asks again', () async {
start(signedOut: true);
bloc.add(const SessionEventStarted());
await expectLater(bloc.stream, emits(const SessionStateSignedOut()));
bloc.add(const SessionEventGitHubRequested());
await expectLater(
bloc.stream,
emitsThrough(
const SessionStateActive(
SignedIn(authUserId: 'github-person', isIdentified: true),
),
),
);
expect(gateway.signIns, 0);
expect(mark.signedOut, isFalse);
});
test('a GitHub account nobody here signs in with yet is said so; any '
'other refusal fails, and nothing is made either way', () async {
start(signedOut: true);
bloc.add(const SessionEventStarted());
await expectLater(bloc.stream, emits(const SessionStateSignedOut()));
gateway.gitHubError = const GitHubSignInFailed(
GitHubSignInProblem.unknownAccount,
);
bloc.add(const SessionEventGitHubRequested());
await expectLater(
bloc.stream,
emitsInOrder([
const SessionStateSignedOut(busy: true),
const SessionStateSignedOut(problem: SignedOutProblem.noGitHubAccount),
]),
);
gateway.gitHubError = const GitHubSignInFailed(GitHubSignInProblem.refused);
bloc.add(const SessionEventGitHubRequested());
await expectLater(
bloc.stream,
emitsInOrder([
const SessionStateSignedOut(busy: true),
const SessionStateSignedOut(problem: SignedOutProblem.failed),
]),
);
expect(gateway.signIns, 0);
expect(gateway.gitHubSwitches, 0);
});
test('a session the server ended asks how to start too', () async {
const stored = SignedIn(authUserId: 'github-1', isIdentified: true);
start(status: stored);
bloc.add(const SessionEventStarted());
await expectLater(bloc.stream, emits(const SessionStateActive(stored)));
gateway.revokeSession();
await expectLater(bloc.stream, emits(const SessionStateSignedOut()));
expect(gateway.signIns, 0);
});
test('deleting the account asks how to start', () async {
const stored = SignedIn(authUserId: 'github-1', isIdentified: true);
start(status: stored);
bloc.add(const SessionEventStarted());
await expectLater(bloc.stream, emits(const SessionStateActive(stored)));
bloc.add(const SessionEventDeleteRequested());
await expectLater(
bloc.stream,
emitsInOrder([
const SessionStateLoading(),
const SessionStateSignedOut(),
]),
);
expect(gateway.accountDeletions, 1);
expect(gateway.signIns, 0);
});
}