feat!: capabilities replace API token scopes; every admin endpoint declares one, with a picker UI [CI]

backend/src/MoShiro.Backend.Storage.Sqlite/Schema.cs

@@ -5,7 +5,7 @@ namespace MoShiro.Backend.Storage.Sqlite;
 /// <summary>表结构。版本记录在 <c>PRAGMA user_version</c>；以后的迁移是按版本号追加的内置 SQL。</summary>
 internal static class Schema
 {
-    public const int CurrentVersion = 10;
+    public const int CurrentVersion = 11;
 
     public static void Migrate(SqliteConnection connection)
     {
@@ -140,6 +140,27 @@ internal static class Schema
             connection.Exec("PRAGMA user_version = 10");
             transaction.Commit();
         }
+
+        if (version < 11)
+        {
+            // 权限从三个作用域改成细粒度的能力。破坏性变更，不做兼容：旧的 API 令牌全部作废，需要重新创建
+            using SqliteTransaction transaction = connection.BeginTransaction();
+            connection.Exec("DROP TABLE api_tokens");
+            connection.Exec("""
+                CREATE TABLE api_tokens (
+                  id TEXT PRIMARY KEY,
+                  name TEXT NOT NULL,
+                  capabilities TEXT NOT NULL,
+                  token_sha256 BLOB NOT NULL UNIQUE,
+                  created_at INTEGER NOT NULL,
+                  last_used_at INTEGER,
+                  expires_at INTEGER,
+                  revoked_at INTEGER
+                )
+                """);
+            connection.Exec("PRAGMA user_version = 11");
+            transaction.Commit();
+        }
     }
 
     /// <summary>