feat!: sensitive actions need a fresh passkey touch (elevation windows), plus login page hint cleanup [CI]

backend/src/MoShiro.Backend.Api/Common/Guards.cs

@@ -89,10 +89,21 @@ public static class CapabilityGuard
             }
         }
 
+        // 信任类的操作（加节点、吊销、改凭证）：登录用户还要有这一种的提权窗口；API key 自己带着能力，不经过这里
+        if (requirement.Capability is { } trusted && Elevation.For(trusted) is { } elevation && ElevationGate.Require(http, elevation, consume: true) is { } needed)
+        {
+            return needed;
+        }
+
         if (principal.Kind != PrincipalKind.Anonymous && !HttpMethods.IsGet(http.Request.Method) && !HttpMethods.IsHead(http.Request.Method) && !HttpMethods.IsOptions(http.Request.Method))
         {
             // 写操作都记审计：响应发完之后才知道结果，所以放在 OnCompleted 里
             string action = http.GetEndpoint()?.Metadata.GetMetadata<IEndpointNameMetadata>()?.EndpointName ?? http.Request.Path.Value ?? "";
+            if (action.EndsWith("_options", StringComparison.Ordinal))
+            {
+                return await next(context); // 取挑战不是操作
+            }
+
             string? target = http.Request.RouteValues.Count == 0 ? null : string.Join(' ', http.Request.RouteValues.Where(v => v.Value is not null).Select(v => v.Key + "=" + v.Value));
             http.Response.OnCompleted(() =>
             {
@@ -106,6 +117,24 @@ public static class CapabilityGuard
     }
 }
 
+/// <summary>提权检查：登录用户（含用 return_session 拿到的 Bearer 会话）要有对应种类的有效窗口，API key 不需要。</summary>
+public static class ElevationGate
+{
+    /// <summary>没问题返回 null；否则 403 <c>elevation_required</c>，detail 是缺的窗口种类，前端据此触碰 passkey 后重试。</summary>
+    public static IResult? Require(HttpContext http, ElevationClass elevation, bool consume)
+    {
+        Principal principal = http.GetPrincipal();
+        if (principal.UserId is null)
+        {
+            return null;
+        }
+
+        return principal.SessionId is { } session && http.RequestServices.GetRequiredService<ElevationService>().Check(session, elevation, consume)
+            ? null
+            : Problems.Create(http, MoShiroErrors.ElevationRequired, Elevation.IdOf(elevation));
+    }
+}
+
 /// <summary>展示层守卫：站点公开时匿名可读；私有时需要登录或只读令牌。</summary>
 public static class PublicGuard
 {