feat!: drop the backend-side elevation windows; password and passkey sessions share capabilities, passkeys guard what nodes verify; the trust page lists added and removed passkeys [CI]

backend/tests/MoShiro.Backend.Tests/PasskeyTests.cs

@@ -112,7 +112,7 @@ public sealed class PasskeyTests
 
     private string _user = "";
 
-    /// <summary>每个测试用自己新建的用户：管理员已经有 fixture 的 passkey，再加就要提权，而这里测的是第一个 passkey 的流程。</summary>
+    /// <summary>每个测试用自己新建的用户：管理员已经有 fixture 的 passkey，而这里测的是第一个 passkey 的流程。</summary>
     private async Task<HttpClient> FreshSessionAsync()
     {
         _user = _backend.UniqueName("pk");
@@ -121,16 +121,6 @@ public sealed class PasskeyTests
         return await PasswordSessionAsync(_user, "correct horse battery");
     }
 
-    /// <summary>用已有的 passkey 触碰一次，开凭证窗口（删除 passkey 需要）。</summary>
-    private static async Task ElevateAsync(HttpClient session, SoftwarePasskey passkey)
-    {
-        using HttpResponseMessage options = await session.PostAsync("/api/admin/auth/elevation/options", BackendFixture.Json(new JsonObject { ["class"] = "credential" }));
-        JsonObject assertion = passkey.Assert((await JsonOf(options))["challenge"]!.GetValue<string>());
-        assertion["class"] = "credential";
-        using HttpResponseMessage elevated = await session.PostAsync("/api/admin/auth/elevation", BackendFixture.Json(assertion));
-        Assert.Equal(HttpStatusCode.OK, elevated.StatusCode);
-    }
-
     private static async Task<JsonNode> JsonOf(HttpResponseMessage response) => JsonNode.Parse(await response.Content.ReadAsStringAsync())!;
 
     private async Task<string> RegistrationChallengeAsync(HttpClient session)
@@ -251,12 +241,8 @@ public sealed class PasskeyTests
         // 正常注册，同一把凭证不能注册两次，也不能用登录用的挑战注册
         string challenge = await RegistrationChallengeAsync(session);
         Assert.Equal(HttpStatusCode.Created, await TryAsync(passkey.Register("ok", challenge)));
-        // 已经有 passkey 了，再注册要先触碰一次（凭证窗口，用一次就没有）
-        await ElevateAsync(session, passkey);
         Assert.Equal(HttpStatusCode.BadRequest, await TryAsync(passkey.Register("again", challenge))); // 挑战只能用一次
-        await ElevateAsync(session, passkey);
         Assert.Equal(HttpStatusCode.Conflict, await TryAsync(passkey.Register("again", await RegistrationChallengeAsync(session))));
-        await ElevateAsync(session, passkey);
         Assert.Equal(HttpStatusCode.BadRequest, await TryAsync(new SoftwarePasskey(RpId, Origin).Register("x", await LoginChallengeAsync())));
     }
 
@@ -270,11 +256,9 @@ public sealed class PasskeyTests
         using HttpResponseMessage created = await _backend.Admin.PostAsync("/api/admin/users", BackendFixture.Json(new JsonObject { ["username"] = other, ["password"] = "correct horse battery" }));
         Assert.Equal(HttpStatusCode.Created, created.StatusCode);
         using HttpClient intruder = await PasswordSessionAsync(other, "correct horse battery");
-        Assert.Equal(HttpStatusCode.Forbidden, (await intruder.DeleteAsync("/api/admin/auth/passkeys/" + passkey.Id)).StatusCode); // 没有窗口，连试都不行
+        Assert.Equal(HttpStatusCode.NotFound, (await intruder.DeleteAsync("/api/admin/auth/passkeys/" + passkey.Id)).StatusCode); // 别人的 passkey：看不见，也删不了
         Assert.DoesNotContain((await JsonOf(await intruder.GetAsync("/api/admin/auth/passkeys")))["items"]!.AsArray(), p => p!["id"]!.GetValue<string>() == passkey.Id);
 
-        Assert.Equal(HttpStatusCode.Forbidden, (await admin.DeleteAsync("/api/admin/auth/passkeys/" + passkey.Id)).StatusCode); // 删除要先触碰
-        await ElevateAsync(admin, passkey);
         Assert.Equal(HttpStatusCode.NoContent, (await admin.DeleteAsync("/api/admin/auth/passkeys/" + passkey.Id)).StatusCode);
         Assert.Equal(HttpStatusCode.Unauthorized, await LoginStatusAsync(passkey.Assert(await LoginChallengeAsync())));
     }