feat!: capabilities replace API token scopes; every admin endpoint declares one, with a picker UI [CI]

backend/src/MoShiro.Backend.Storage.Sqlite/Schema.cs

@@ -5,7 +5,7 @@ namespace MoShiro.Backend.Storage.Sqlite;
 /// <summary>表结构。版本记录在 <c>PRAGMA user_version</c>；以后的迁移是按版本号追加的内置 SQL。</summary>
 internal static class Schema
 {
-    public const int CurrentVersion = 10;
+    public const int CurrentVersion = 11;
 
     public static void Migrate(SqliteConnection connection)
     {
@@ -140,6 +140,27 @@ internal static class Schema
             connection.Exec("PRAGMA user_version = 10");
             transaction.Commit();
         }
+
+        if (version < 11)
+        {
+            // 权限从三个作用域改成细粒度的能力。破坏性变更，不做兼容：旧的 API 令牌全部作废，需要重新创建
+            using SqliteTransaction transaction = connection.BeginTransaction();
+            connection.Exec("DROP TABLE api_tokens");
+            connection.Exec("""
+                CREATE TABLE api_tokens (
+                  id TEXT PRIMARY KEY,
+                  name TEXT NOT NULL,
+                  capabilities TEXT NOT NULL,
+                  token_sha256 BLOB NOT NULL UNIQUE,
+                  created_at INTEGER NOT NULL,
+                  last_used_at INTEGER,
+                  expires_at INTEGER,
+                  revoked_at INTEGER
+                )
+                """);
+            connection.Exec("PRAGMA user_version = 11");
+            transaction.Commit();
+        }
     }
 
     /// <summary>

backend/src/MoShiro.Backend.Storage.Sqlite/SqliteAuthStore.cs

@@ -6,7 +6,7 @@ namespace MoShiro.Backend.Storage.Sqlite;
 public sealed class SqliteAuthStore : IAuthStore
 {
     private const string UserColumns = "id, username, password_hash, password_salt, iterations, created_at";
-    private const string TokenColumns = "id, name, scope, token_sha256, created_at, last_used_at, revoked_at";
+    private const string TokenColumns = "id, name, capabilities, token_sha256, created_at, last_used_at, expires_at, revoked_at";
 
     private readonly SqliteDatabase _db;
 
@@ -64,8 +64,8 @@ public sealed class SqliteAuthStore : IAuthStore
     public ValueTask CreateApiTokenAsync(ApiTokenRecord token, CancellationToken ct) =>
         _db.ExecuteAsync(
             c => c.Exec(
-                "INSERT INTO api_tokens (id, name, scope, token_sha256, created_at) VALUES (@id, @n, @s, @h, @at)",
-                ("@id", token.Id), ("@n", token.Name), ("@s", token.Scope), ("@h", token.TokenSha256), ("@at", token.CreatedAtMs)),
+                "INSERT INTO api_tokens (id, name, capabilities, token_sha256, created_at, expires_at) VALUES (@id, @n, @caps, @h, @at, @exp)",
+                ("@id", token.Id), ("@n", token.Name), ("@caps", StorageJson.ToJson(token.Capabilities)), ("@h", token.TokenSha256), ("@at", token.CreatedAtMs), ("@exp", token.ExpiresAtMs)),
             ct);
 
     public ValueTask<ApiTokenRecord?> FindApiTokenAsync(byte[] tokenSha256, CancellationToken ct) =>
@@ -82,5 +82,5 @@ public sealed class SqliteAuthStore : IAuthStore
 
     private static UserRecord ReadUser(SqliteDataReader r) => new(r.GetString(0), r.GetString(1), r.Bytes(2), r.Bytes(3), r.GetInt32(4), r.GetInt64(5));
 
-    private static ApiTokenRecord ReadToken(SqliteDataReader r) => new(r.GetString(0), r.GetString(1), r.GetString(2), r.Bytes(3), r.GetInt64(4), r.NullableLong(5), r.NullableLong(6));
+    private static ApiTokenRecord ReadToken(SqliteDataReader r) => new(r.GetString(0), r.GetString(1), StorageJson.Strings(r.GetString(2)), r.Bytes(3), r.GetInt64(4), r.NullableLong(5), r.NullableLong(6), r.NullableLong(7));
 }