justme/MoShiro
1
1 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 5 Wiki Activity

feat!: sensitive actions need a fresh passkey touch (elevation windows), plus login page hint cleanup [CI]

Browse Source
This commit is contained in:
justme committed 2026-10-07 22:29:24 +08:00
1 parent 1379b8c7cb
commit ff45ad086e
27 files changed
+1305 -58
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

web/shared/api/schema.ts
+234
View File
@@ -448,6 +448,42 @@ export interface paths {
patch?: never;
trace?: never;
};
"/api/admin/auth/elevation": {
parameters: {
query?: never;
header?: never;
path?: never;
cookie?: never;
};
/** The elevation windows this session has open (sensitive actions need one) */
get: operations["auth_elevation_list"];
put?: never;
/** Open an elevation window from a passkey assertion (enroll 15 min, revoke 5 min, credential one use within 60 s) */
post: operations["auth_elevate"];
/** Close all elevation windows of this session */
delete: operations["auth_elevation_end"];
options?: never;
head?: never;
patch?: never;
trace?: never;
};
"/api/admin/auth/elevation/options": {
parameters: {
query?: never;
header?: never;
path?: never;
cookie?: never;
};
get?: never;
put?: never;
/** A challenge for opening an elevation window with a passkey touch */
post: operations["auth_elevation_options"];
delete?: never;
options?: never;
head?: never;
patch?: never;
trace?: never;
};
"/api/admin/auth/me": {
parameters: {
query?: never;
@@ -1370,6 +1406,21 @@ export interface components {
first: boolean;
last: boolean;
};
ElevationAssertionRequest: {
class: string;
credential_id: string;
authenticator_data: string;
client_data_json: string;
signature: string;
};
ElevationDto: {
class: string;
/** Format: date-time */
expires_at: unknown;
};
ElevationRequest: {
class: string;
};
EventDto: {
/** Format: int64 */
id: number | string;
@@ -1668,6 +1719,10 @@ export interface components {
items: components["schemas"]["AuditDto"][];
next_cursor: null | string;
};
PageDtoOfElevationDto: {
items: components["schemas"]["ElevationDto"][];
next_cursor: null | string;
};
PageDtoOfEventDto: {
items: components["schemas"]["EventDto"][];
next_cursor: null | string;
@@ -1779,6 +1834,7 @@ export interface components {
rp_id: string;
/** Format: int32 */
timeout_ms: number | string;
allow_credentials?: null | string[];
};
PatchProbeRequest: {
name: null | string;
@@ -3293,6 +3349,184 @@ export interface operations {
};
};
};
auth_elevation_list: {
parameters: {
query?: never;
header?: never;
path?: never;
cookie?: never;
};
requestBody?: never;
responses: {
/** @description OK */
200: {
headers: {
[name: string]: unknown;
};
content: {
"application/json": components["schemas"]["PageDtoOfElevationDto"];
};
};
/** @description Unauthorized */
401: {
headers: {
[name: string]: unknown;
};
content: {
"application/problem+json": components["schemas"]["ProblemDto"];
};
};
};
};
auth_elevate: {
parameters: {
query?: never;
header?: never;
path?: never;
cookie?: never;
};
requestBody: {
content: {
"application/json": components["schemas"]["ElevationAssertionRequest"];
};
};
responses: {
/** @description OK */
200: {
headers: {
[name: string]: unknown;
};
content: {
"application/json": components["schemas"]["ElevationDto"];
};
};
/** @description Bad Request */
400: {
headers: {
[name: string]: unknown;
};
content: {
"application/problem+json": components["schemas"]["ProblemDto"];
};
};
/** @description Unauthorized */
401: {
headers: {
[name: string]: unknown;
};
content: {
"application/problem+json": components["schemas"]["ProblemDto"];
};
};
/** @description Forbidden */
403: {
headers: {
[name: string]: unknown;
};
content: {
"application/problem+json": components["schemas"]["ProblemDto"];
};
};
/** @description Too Many Requests */
429: {
headers: {
[name: string]: unknown;
};
content: {
"application/problem+json": components["schemas"]["ProblemDto"];
};
};
};
};
auth_elevation_end: {
parameters: {
query?: never;
header?: never;
path?: never;
cookie?: never;
};
requestBody?: never;
responses: {
/** @description No Content */
204: {
headers: {
[name: string]: unknown;
};
content: {
"application/json": unknown;
};
};
/** @description Unauthorized */
401: {
headers: {
[name: string]: unknown;
};
content: {
"application/problem+json": components["schemas"]["ProblemDto"];
};
};
};
};
auth_elevation_options: {
parameters: {
query?: never;
header?: never;
path?: never;
cookie?: never;
};
requestBody: {
content: {
"application/json": components["schemas"]["ElevationRequest"];
};
};
responses: {
/** @description OK */
200: {
headers: {
[name: string]: unknown;
};
content: {
"application/json": components["schemas"]["PasskeyRequestOptionsDto"];
};
};
/** @description Bad Request */
400: {
headers: {
[name: string]: unknown;
};
content: {
"application/problem+json": components["schemas"]["ProblemDto"];
};
};
/** @description Unauthorized */
401: {
headers: {
[name: string]: unknown;
};
content: {
"application/problem+json": components["schemas"]["ProblemDto"];
};
};
/** @description Forbidden */
403: {
headers: {
[name: string]: unknown;
};
content: {
"application/problem+json": components["schemas"]["ProblemDto"];
};
};
/** @description Too Many Requests */
429: {
headers: {
[name: string]: unknown;
};
content: {
"application/problem+json": components["schemas"]["ProblemDto"];
};
};
};
};
auth_me: {
parameters: {
query?: never;