justme/MoShiro
1
1 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 5 Wiki Activity

feat!: drop the backend-side elevation windows; password and passkey sessions share capabilities, passkeys guard what nodes verify; the trust page lists added and removed passkeys [CI]

Browse Source
This commit is contained in:
justme committed 2026-10-08 04:57:28 +08:00
1 parent f704c66dd9
commit 4106f831dc
34 files changed
+191 -1364
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

backend/openapi/v1.json
+39 -278
View File
@@ -1625,208 +1625,6 @@
"x-moshiro-capability": "authenticated"
}
},
"/api/admin/auth/elevation": {
"get": {
"tags": [
"admin-auth"
],
"summary": "The elevation windows this session has open (sensitive actions need one)",
"operationId": "auth_elevation_list",
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/PageDtoOfElevationDto"
}
}
}
},
"401": {
"description": "Unauthorized",
"content": {
"application/problem+json": {
"schema": {
"$ref": "#/components/schemas/ProblemDto"
}
}
}
}
},
"x-moshiro-capability": "authenticated"
},
"post": {
"tags": [
"admin-auth"
],
"summary": "Open an elevation window from a passkey assertion (enroll 15 min, revoke 5 min, credential one use within 60 s)",
"operationId": "auth_elevate",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ElevationAssertionRequest"
}
}
},
"required": true
},
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ElevationDto"
}
}
}
},
"400": {
"description": "Bad Request",
"content": {
"application/problem+json": {
"schema": {
"$ref": "#/components/schemas/ProblemDto"
}
}
}
},
"401": {
"description": "Unauthorized",
"content": {
"application/problem+json": {
"schema": {
"$ref": "#/components/schemas/ProblemDto"
}
}
}
},
"403": {
"description": "Forbidden",
"content": {
"application/problem+json": {
"schema": {
"$ref": "#/components/schemas/ProblemDto"
}
}
}
},
"429": {
"description": "Too Many Requests",
"content": {
"application/problem+json": {
"schema": {
"$ref": "#/components/schemas/ProblemDto"
}
}
}
}
},
"x-moshiro-capability": "authenticated"
},
"delete": {
"tags": [
"admin-auth"
],
"summary": "Close all elevation windows of this session",
"operationId": "auth_elevation_end",
"responses": {
"204": {
"description": "No Content",
"content": {
"application/json": {
"schema": { }
}
}
},
"401": {
"description": "Unauthorized",
"content": {
"application/problem+json": {
"schema": {
"$ref": "#/components/schemas/ProblemDto"
}
}
}
}
},
"x-moshiro-capability": "authenticated"
}
},
"/api/admin/auth/elevation/options": {
"post": {
"tags": [
"admin-auth"
],
"summary": "A challenge for opening an elevation window with a passkey touch",
"operationId": "auth_elevation_options",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ElevationRequest"
}
}
},
"required": true
},
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/PasskeyRequestOptionsDto"
}
}
}
},
"400": {
"description": "Bad Request",
"content": {
"application/problem+json": {
"schema": {
"$ref": "#/components/schemas/ProblemDto"
}
}
}
},
"401": {
"description": "Unauthorized",
"content": {
"application/problem+json": {
"schema": {
"$ref": "#/components/schemas/ProblemDto"
}
}
}
},
"403": {
"description": "Forbidden",
"content": {
"application/problem+json": {
"schema": {
"$ref": "#/components/schemas/ProblemDto"
}
}
}
},
"429": {
"description": "Too Many Requests",
"content": {
"application/problem+json": {
"schema": {
"$ref": "#/components/schemas/ProblemDto"
}
}
}
}
},
"x-moshiro-capability": "authenticated"
}
},
"/api/admin/auth/me": {
"get": {
"tags": [
@@ -3932,7 +3730,7 @@
"tags": [
"admin-trust"
],
"summary": "Store the next operator set, signed with a passkey (the first one sets the genesis and needs a credential window)",
"summary": "Store the next operator set, signed with a passkey (the first one sets the genesis)",
"operationId": "trust_commit",
"requestBody": {
"content": {
@@ -6229,59 +6027,6 @@
}
}
},
"ElevationAssertionRequest": {
"required": [
"class",
"credential_id",
"authenticator_data",
"client_data_json",
"signature"
],
"type": "object",
"properties": {
"class": {
"type": "string"
},
"credential_id": {
"type": "string"
},
"authenticator_data": {
"type": "string"
},
"client_data_json": {
"type": "string"
},
"signature": {
"type": "string"
}
}
},
"ElevationDto": {
"required": [
"class",
"expires_at"
],
"type": "object",
"properties": {
"class": {
"type": "string"
},
"expires_at": {
"format": "date-time"
}
}
},
"ElevationRequest": {
"required": [
"class"
],
"type": "object",
"properties": {
"class": {
"type": "string"
}
}
},
"EventDto": {
"required": [
"id",
@@ -7632,27 +7377,6 @@
}
}
},
"PageDtoOfElevationDto": {
"required": [
"items",
"next_cursor"
],
"type": "object",
"properties": {
"items": {
"type": "array",
"items": {
"$ref": "#/components/schemas/ElevationDto"
}
},
"next_cursor": {
"type": [
"null",
"string"
]
}
}
},
"PageDtoOfEventDto": {
"required": [
"items",
@@ -8477,6 +8201,25 @@
}
}
},
"ProposedCredentialDto": {
"required": [
"id",
"name",
"created_at"
],
"type": "object",
"properties": {
"id": {
"type": "string"
},
"name": {
"type": "string"
},
"created_at": {
"format": "date-time"
}
}
},
"PublishReleaseRequest": {
"required": [
"manifest",
@@ -9272,7 +9015,10 @@
"required": [
"statement",
"version",
"challenge"
"challenge",
"added",
"removed",
"server_key_changed"
],
"type": "object",
"properties": {
@@ -9289,6 +9035,21 @@
},
"challenge": {
"type": "string"
},
"added": {
"type": "array",
"items": {
"$ref": "#/components/schemas/ProposedCredentialDto"
}
},
"removed": {
"type": "array",
"items": {
"type": "string"
}
},
"server_key_changed": {
"type": "boolean"
}
}
},