feat(api): add account workspaces and signed content events

server/tests/WebDrop.Api.Tests/PasskeyCeremonyTests.cs

@@ -0,0 +1,20 @@
+using WebDrop.Api;
+using WebDrop.Core;
+
+namespace WebDrop.Api.Tests;
+
+public sealed class PasskeyCeremonyTests
+{
+    [Fact]
+    public void CeremoniesAreOneTimeAndBoundToTheAuthenticatedAccountAndSession()
+    {
+        var ceremonies = new PasskeyCeremonies();
+        PasskeyCeremony state = new("alice", "register", "server-state", "salt", PasskeyCeremonies.Hash("token-a"), DateTimeOffset.UtcNow.AddMinutes(1));
+        var id = ceremonies.Put(state); Assert.Equal(state, ceremonies.Take(id, "alice", "register", "token-a"));
+        Assert.Throws<WebDropException>(() => ceremonies.Take(id, "alice", "register", "token-a"));
+        id = ceremonies.Put(state); Assert.Throws<WebDropException>(() => ceremonies.Take(id, "bob", "register", "token-a"));
+        id = ceremonies.Put(state); Assert.Throws<WebDropException>(() => ceremonies.Take(id, "alice", "register", "token-b"));
+        id = ceremonies.Put(state); Assert.Throws<WebDropException>(() => ceremonies.Take(id, "alice", "login", "token-a"));
+        id = ceremonies.Put(state with { Expires = DateTimeOffset.UtcNow.AddSeconds(-1) }); Assert.Throws<WebDropException>(() => ceremonies.Take(id, "alice", "register", "token-a"));
+    }
+}