feat!: drop the backend-side elevation windows; password and passkey sessions share capabilities, passkeys guard what nodes verify; the trust page lists added and removed passkeys [CI]

backend/src/MoShiro.Backend.Api/Contracts/AdminDtos.cs

@@ -10,16 +10,10 @@ public sealed record LoginRequest(string Username, string Password, bool? Return
 public sealed record PasskeyCreationOptionsDto(string Challenge, string RpId, string RpName, string UserId, string UserName, IReadOnlyList<string> ExcludeCredentials, int TimeoutMs);
 
 /// <summary>浏览器 <c>navigator.credentials.get</c> 要的参数（可发现凭证：不需要先输用户名）。</summary>
-/// <param name="AllowCredentials">只有提权的挑战会带：这个用户自己的 passkey 的凭证 id。</param>
+/// <param name="AllowCredentials">列出时限定可选的 passkey（凭证 id）；登录的挑战不带。</param>
 public sealed record PasskeyRequestOptionsDto(string Challenge, string RpId, int TimeoutMs, IReadOnlyList<string>? AllowCredentials = null);
 
 /// <param name="Class"><c>enroll</c>（加节点）、<c>revoke</c>（吊销和删除）、<c>credential</c>（改凭证，用一次就没有）。</param>
-public sealed record ElevationRequest(string Class);
-
-public sealed record ElevationAssertionRequest(string Class, string CredentialId, string AuthenticatorData, string ClientDataJson, string Signature);
-
-public sealed record ElevationDto(string Class, DateTimeOffset ExpiresAt);
-
 public sealed record RegisterPasskeyRequest(string Name, string CredentialId, string AttestationObject, string ClientDataJson, IReadOnlyList<string>? Transports);
 
 public sealed record PasskeyLoginRequest(string CredentialId, string AuthenticatorData, string ClientDataJson, string Signature, bool? ReturnSession);
@@ -28,7 +22,7 @@ public sealed record PasskeyDto(string Id, string Name, DateTimeOffset CreatedAt
 
 public sealed record LoginResponse(string UserId, string Username, string CsrfToken, DateTimeOffset ExpiresAt, string? SessionToken);
 
-/// <param name="AuthMethod">会话是怎么登录的：<c>password</c>（没有任何能力，只能注册 passkey）或 <c>passkey</c>；API 令牌为空。</param>
+/// <param name="AuthMethod">会话是怎么登录的：<c>password</c> 或 <c>passkey</c>（能力相同，信任类操作都要提权窗口）；API 令牌为空。</param>
 public sealed record MeDto(string Kind, IReadOnlyList<string> Capabilities, string? UserId, string? Username, string? CsrfToken, string? AuthMethod = null);
 
 public sealed record LocalLimitsDto(double MaxTotalMbps, long MaxTotalPps, IReadOnlyList<string> AllowedTargetCidrs, int MaxConcurrentTests);
@@ -83,7 +77,13 @@ public sealed record CreateJoinTokenRequest(string? Note, IReadOnlyList<string>?
 /// <summary>令牌明文只在创建的响应里出现一次。</summary>
 public sealed record InstallCommandsDto(string Linux, string Macos, string Windows);
 
-public sealed record TrustProposalDto(string Statement, int Version, string Challenge);
+/// <summary>下一版里新增的 passkey。</summary>
+public sealed record ProposedCredentialDto(string Id, string Name, DateTimeOffset CreatedAt);
+
+/// <param name="Added">相对当前生效的集合新增的 passkey；签名之前必须看一眼是不是自己加的。</param>
+/// <param name="Removed">相对当前生效的集合移除的 passkey 凭证 id。</param>
+/// <param name="ServerKeyChanged">服务器密钥有变化（换了新的）。</param>
+public sealed record TrustProposalDto(string Statement, int Version, string Challenge, IReadOnlyList<ProposedCredentialDto> Added, IReadOnlyList<string> Removed, bool ServerKeyChanged);
 
 /// <param name="Genesis">创世版本的指纹：安装命令里固定到节点上的就是它。还没建立信任根时为空。</param>
 /// <param name="InSync">当前生效的集合和已注册的 passkey、域名一致；不一致（比如新加了 passkey）就要签一个新版本。</param>