halkyon/packages/halkyon_app/test/auth/bloc/session_bloc_test.dart
Tizian 「ティツィアーン」 f0413531ff
fix(auth)!: a first password takes a fresh proof of the account's way in
The fourth reading's first finding: password.set took a session alone,
so whoever took one made a GitHub-only account, or an address account
without a password, theirs for good (their address or password, their
authenticator; GitHub then refused the owner).

- An account with an address proves it anew: a code mailed to that
  address for this (EmailCodePurpose.firstPassword, its own mail), never
  the session alone, a code asked for anything else, or another address.
- An account that signs in with GitHub alone does it within 10 minutes of
  a GitHub sign-in (the session's method and creation time, where the
  session lives; members tell the register), refused signInAgain before
  any code is used; the address it adds is proved as before.
- Anonymous people still become identified with a code to the address
  they add.

The app mails the code to the person's own address (asking for it where
the device doesn't know it), offers a password right after a GitHub
sign-in (D2's "at their next sign-in") before the person's app, and asks
for a GitHub sign-in anew when the instance refuses an older one, keeping
the code typed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
2026-10-23 14:12:50 +02:00

187 lines
6 KiB
Dart

import 'package:flutter_test/flutter_test.dart';
import 'package:halkyon_app/halkyon_app.dart';
import 'package:halkyon_app/testing.dart';
void main() {
late FakeAuthGateway gateway;
late MemorySignedOutMark mark;
late SessionBloc bloc;
SessionStateActive anonymous(int number) => SessionStateActive(
SignedIn(authUserId: 'anonymous-$number', isIdentified: false),
);
void start({AuthStatus status = const SignedOut(), bool signedOut = false}) {
gateway = FakeAuthGateway(status: status);
mark = MemorySignedOutMark(signedOut);
bloc = SessionBloc(AuthRepository(gateway, MemorySignInAddresses()), mark);
}
tearDown(() => bloc.close());
test('signs in anonymously at a first start, nobody having signed out '
'here', () async {
start();
bloc.add(const SessionEventStarted());
await expectLater(
bloc.stream,
emitsInOrder([const SessionStateLoading(), anonymous(1)]),
);
expect(gateway.signIns, 1);
});
test('keeps a stored session instead of creating a second account', () async {
const stored = SignedIn(authUserId: 'stored', isIdentified: false);
start(status: stored);
bloc.add(const SessionEventStarted());
await expectLater(bloc.stream, emits(const SessionStateActive(stored)));
expect(gateway.signIns, 0);
});
test('reports a failed sign-in and signs in when asked again', () async {
start();
gateway.signInError = Exception('No connection');
bloc.add(const SessionEventStarted());
await expectLater(
bloc.stream,
emitsInOrder([const SessionStateLoading(), const SessionStateFailed()]),
);
gateway.signInError = null;
bloc.add(const SessionEventSignInRequested());
await expectLater(
bloc.stream,
emitsInOrder([const SessionStateLoading(), anonymous(2)]),
);
});
test('after signing out, asks how to start, making no account; the next '
'start of the app asks again', () async {
const stored = SignedIn(authUserId: 'stored', isIdentified: false);
start(status: stored);
bloc.add(const SessionEventStarted());
await expectLater(bloc.stream, emits(const SessionStateActive(stored)));
bloc.add(const SessionEventSignOutRequested());
await expectLater(
bloc.stream,
emitsInOrder([
const SessionStateLoading(),
const SessionStateSignedOut(),
]),
);
// Signing out of an anonymous account deletes it.
expect(gateway.accountDeletions, 1);
expect(gateway.signIns, 0);
expect(mark.signedOut, isTrue);
await bloc.close();
bloc = SessionBloc(AuthRepository(gateway, MemorySignInAddresses()), mark)
..add(const SessionEventStarted());
await expectLater(bloc.stream, emits(const SessionStateSignedOut()));
expect(gateway.signIns, 0);
});
test('starting without an account from there signs in anonymously, and '
'the device is no longer signed out', () async {
start(signedOut: true);
bloc.add(const SessionEventStarted());
await expectLater(bloc.stream, emits(const SessionStateSignedOut()));
bloc.add(const SessionEventStartedAnonymously());
await expectLater(
bloc.stream,
emitsInOrder([const SessionStateLoading(), anonymous(1)]),
);
expect(mark.signedOut, isFalse);
});
test('signing in with GitHub from there switches to its person; '
'cancelled, it asks again', () async {
start(signedOut: true);
bloc.add(const SessionEventStarted());
await expectLater(bloc.stream, emits(const SessionStateSignedOut()));
bloc.add(const SessionEventGitHubRequested());
// A password is offered first (ADR 0017, D2), then the person's app.
const person = SignedIn(authUserId: 'github-person', isIdentified: true);
await expectLater(
bloc.stream,
emitsThrough(const SessionStateGitHubSignedIn(person)),
);
bloc.add(const SessionEventPasswordOfferDone());
await expectLater(bloc.stream, emits(const SessionStateActive(person)));
expect(gateway.signIns, 0);
expect(mark.signedOut, isFalse);
});
test('a GitHub account nobody here signs in with yet is said so; any '
'other refusal fails, and nothing is made either way', () async {
start(signedOut: true);
bloc.add(const SessionEventStarted());
await expectLater(bloc.stream, emits(const SessionStateSignedOut()));
gateway.gitHubError = const GitHubSignInFailed(
GitHubSignInProblem.unknownAccount,
);
bloc.add(const SessionEventGitHubRequested());
await expectLater(
bloc.stream,
emitsInOrder([
const SessionStateSignedOut(busy: true),
const SessionStateSignedOut(problem: SignedOutProblem.noGitHubAccount),
]),
);
gateway.gitHubError = const GitHubSignInFailed(GitHubSignInProblem.refused);
bloc.add(const SessionEventGitHubRequested());
await expectLater(
bloc.stream,
emitsInOrder([
const SessionStateSignedOut(busy: true),
const SessionStateSignedOut(problem: SignedOutProblem.failed),
]),
);
expect(gateway.signIns, 0);
expect(gateway.gitHubSwitches, 0);
});
test('a session the server ended asks how to start too', () async {
const stored = SignedIn(authUserId: 'github-1', isIdentified: true);
start(status: stored);
bloc.add(const SessionEventStarted());
await expectLater(bloc.stream, emits(const SessionStateActive(stored)));
gateway.revokeSession();
await expectLater(bloc.stream, emits(const SessionStateSignedOut()));
expect(gateway.signIns, 0);
});
test('deleting the account asks how to start', () async {
const stored = SignedIn(authUserId: 'github-1', isIdentified: true);
start(status: stored);
bloc.add(const SessionEventStarted());
await expectLater(bloc.stream, emits(const SessionStateActive(stored)));
bloc.add(const SessionEventDeleteRequested());
await expectLater(
bloc.stream,
emitsInOrder([
const SessionStateLoading(),
const SessionStateSignedOut(),
]),
);
expect(gateway.accountDeletions, 1);
expect(gateway.signIns, 0);
});
}