feat(api): bind encrypted workspaces to accounts and devices

server/src/WebDrop.Core/ChannelService.cs

@@ -6,7 +6,7 @@ namespace WebDrop.Core;
 /// 频道的全部业务逻辑。依赖抽象(存储、blob、时钟、事件),不含 HTTP、SQL、文件细节。
 /// 约定:所有失败以 <see cref="WebDropException"/> 表达;提交成功后才发事件;blob 先写后提交。
 /// </summary>
-public sealed class ChannelService(
+public sealed partial class ChannelService(
     IResourceStore store,
     IBlobStore blobs,
     IClock clock,
@@ -17,8 +17,10 @@ public sealed class ChannelService(
 
     // ───────────────────────── 频道 ─────────────────────────
 
-    public ChannelInfo CreateChannel(CreateChannelRequest req, byte[] endpointHash)
+    public ChannelInfo CreateChannel(CreateChannelRequest req, byte[] endpointHash, string creatorAccount, string? accountDeviceId = null)
     {
+        if (string.IsNullOrWhiteSpace(creatorAccount)) throw new WebDropException(ErrorCode.AccountRequired);
+        if (req.KeyPackage is not null && req.KeyPackage.Length is < 1 or > 16_384) throw new WebDropException(ErrorCode.BadRequest);
         if (!Id16.TryParse(req.Id, out var id)) throw new WebDropException(ErrorCode.BadRequest);
         if (req.Mode is not { } mode) throw new WebDropException(ErrorCode.BadRequest);
 
@@ -44,14 +46,17 @@ public sealed class ChannelService(
             throw new WebDropException(ErrorCode.BadRequest);
 
         long now = clock.NowMs;
+        var (passwordHash, passwordSalt) = HashJoinPassword(req.JoinPassword);
         var channel = new Channel(id, mode, settings, readHash, writeHash, ownerHash,
-            now, now + settings.TtlSeconds * 1000L, 0, 0, 0);
+            now, now + settings.TtlSeconds * 1000L, 0, 0, 0, creatorAccount, passwordHash, passwordSalt);
 
         store.Write(tx =>
         {
             if (tx.HasResourceId(id)) throw new WebDropException(ErrorCode.Conflict);
             tx.InsertChannel(channel);
-            tx.InsertSeat(id, new Seat(endpointHash, now, null));
+            tx.PutChannelMember(id, new ChannelMember(creatorAccount, "owner", now));
+            if (req.KeyPackage is not null) tx.PutKeyPackage(id, creatorAccount, req.KeyPackage, now);
+            tx.InsertSeat(id, new Seat(endpointHash, now, null, creatorAccount, accountDeviceId));
             return 0;
         });
         return ToInfo(channel, 1);
@@ -77,6 +82,12 @@ public sealed class ChannelService(
                 ? clock.NowMs + updated.TtlSeconds * 1000L
                 : channel.ExpiresAt;
             tx.UpdateChannel(id, updated, expiresAt);
+            if (patch.JoinPassword is not null)
+            {
+                var (hash, salt) = HashJoinPassword(patch.JoinPassword);
+                tx.SetJoinPassword(id, hash, salt);
+                channel = channel with { JoinPasswordHash = hash, JoinPasswordSalt = salt };
+            }
             return ToInfo(channel with { Settings = updated, ExpiresAt = expiresAt }, tx.CountSeats(id));
         });
         events.SettingsChanged(id);
@@ -98,19 +109,28 @@ public sealed class ChannelService(
 
     // ───────────────────────── 席位 ─────────────────────────
 
-    public SeatJoined Join(Id16 id, Credentials creds)
+    public SeatJoined Join(Id16 id, Credentials creds, string? password = null)
     {
         var (joined, isNew) = store.Write(tx =>
         {
             var (channel, principal) = Authenticate(tx, id, creds, SeatRule.None);
             var existing = tx.GetSeat(id, principal.EndpointHash);
+            if (existing?.AccountName is not null && existing.AccountName != creds.AccountName) throw new WebDropException(ErrorCode.AccountRequired);
+            if (existing?.AccountDeviceId is not null && existing.AccountDeviceId != creds.AccountDeviceId) throw new WebDropException(ErrorCode.AccountRequired);
             int used = tx.CountSeats(id);
             if (existing is not null)
+            {
+                if (existing.AccountName is not null && existing.AccountDeviceId is null && creds.AccountDeviceId is not null)
+                    tx.BindSeatDevice(id, principal.EndpointHash, creds.AccountDeviceId);
                 return (new SeatJoined { EndpointHash = Codec.Encode(existing.EndpointHash), JoinedAt = existing.JoinedAt, SeatsUsed = used, SeatsMax = channel.Settings.Seats }, false);
+            }
+
+            CheckAdmission(tx, channel, creds, password);
 
             if (used >= channel.Settings.Seats) throw new WebDropException(ErrorCode.SeatsFull);
             long now = clock.NowMs;
-            tx.InsertSeat(id, new Seat(principal.EndpointHash, now, null));
+            tx.InsertSeat(id, new Seat(principal.EndpointHash, now, null, creds.AccountName, creds.AccountDeviceId));
+            if (creds.AccountName is not null) tx.PutChannelMember(id, new ChannelMember(creds.AccountName, "member", now));
             return (new SeatJoined { EndpointHash = Codec.Encode(principal.EndpointHash), JoinedAt = now, SeatsUsed = used + 1, SeatsMax = channel.Settings.Seats }, true);
         });
         if (isNew) events.SeatsChanged(id);
@@ -126,13 +146,13 @@ public sealed class ChannelService(
             EndpointHash = Codec.Encode(s.EndpointHash),
             JoinedAt = s.JoinedAt,
             Label = s.Label is null ? null : Codec.Encode(s.Label),
+            AccountName = s.AccountName,
         }).ToList();
     });
 
     public void SetSeatLabel(Id16 id, Credentials creds, byte[] label)
     {
-        if (label.Length == 0) throw new WebDropException(ErrorCode.BadRequest);
-        if (label.Length > limits.MaxSeatLabelBytes) throw new WebDropException(ErrorCode.TooLarge);
+        ValidateSeatLabel(label);
         store.Write(tx =>
         {
             var (_, principal) = Authenticate(tx, id, creds, SeatRule.Required);
@@ -142,6 +162,26 @@ public sealed class ChannelService(
         events.SeatsChanged(id);
     }
 
+    public void SetSeatLabelForEndpoint(Id16 id, Credentials creds, byte[] endpointHash, byte[] label)
+    {
+        ValidateSeatLabel(label);
+        store.Write(tx =>
+        {
+            var (_, principal) = Authenticate(tx, id, creds, SeatRule.None);
+            RequireOwner(principal);
+            if (tx.GetSeat(id, endpointHash) is null) throw new WebDropException(ErrorCode.NotFound);
+            tx.SetSeatLabel(id, endpointHash, label);
+            return 0;
+        });
+        events.SeatsChanged(id);
+    }
+
+    private void ValidateSeatLabel(byte[] label)
+    {
+        if (label.Length == 0) throw new WebDropException(ErrorCode.BadRequest);
+        if (label.Length > limits.MaxSeatLabelBytes) throw new WebDropException(ErrorCode.TooLarge);
+    }
+
     public void ReleaseSeat(Id16 id, Credentials creds, byte[] endpointHash)
     {
         store.Write(tx =>
@@ -149,6 +189,7 @@ public sealed class ChannelService(
             var (_, principal) = Authenticate(tx, id, creds, SeatRule.None);
             RequireOwner(principal);
             if (!tx.DeleteSeat(id, endpointHash)) throw new WebDropException(ErrorCode.NotFound);
+            tx.DenyEndpoint(id, endpointHash);
             return 0;
         });
         events.SeatsChanged(id);
@@ -158,12 +199,10 @@ public sealed class ChannelService(
 
     public async Task<AppendResult> AppendFrameAsync(
         Id16 channelId, Credentials creds, ReadOnlyMemory<byte> body,
-        long? maxDownloads, string? label, CancellationToken ct = default)
+        long? maxDownloads, CancellationToken ct = default)
     {
         if (!Envelope.TryParse(body.Span, out var env)) throw new WebDropException(ErrorCode.BadRequest);
         if (env.PayloadLength > limits.MaxPayloadBytes) throw new WebDropException(ErrorCode.TooLarge);
-        if (label is not null && System.Text.Encoding.UTF8.GetByteCount(label) > limits.MaxLabelBytes)
-            throw new WebDropException(ErrorCode.BadRequest);
         ValidateShape(env);
 
         byte[] digest = SHA256.HashData(body.Span);
@@ -189,7 +228,7 @@ public sealed class ChannelService(
         AppendOutcome outcome;
         try
         {
-            outcome = store.Write(tx => AppendInTx(tx, channelId, creds, env, body, digest, blobKey, maxDownloads, label));
+            outcome = store.Write(tx => AppendInTx(tx, channelId, creds, env, body, digest, blobKey, maxDownloads));
         }
         catch
         {
@@ -212,7 +251,7 @@ public sealed class ChannelService(
 
     private AppendOutcome AppendInTx(
         IResourceTx tx, Id16 channelId, Credentials creds, Envelope env, ReadOnlyMemory<byte> body,
-        byte[] digest, string? blobKey, long? maxDownloads, string? label)
+        byte[] digest, string? blobKey, long? maxDownloads)
     {
         var (channel, principal) = Authenticate(tx, channelId, creds, SeatRule.Required);
         CheckWritable(channel, principal, env);
@@ -227,10 +266,11 @@ public sealed class ChannelService(
 
         if (env.FrameIndex == 0)
         {
+            if (env.IsControl && tx.CountControlItems(channelId) >= 4096) throw new WebDropException(ErrorCode.TooLarge);
             if (item is not null) throw new WebDropException(ErrorCode.BadRequest);
             long max = env.IsGated ? Math.Clamp(maxDownloads ?? channel.Settings.FileMaxDownloads, 0, 1_000_000) : 0;
             item = new Item(channelId, env.ItemId, principal.EndpointHash, env.ItemFlags, max, 0, 0, -1, null, 0,
-                now, now + ttlMs, null, label);
+                now, env.IsControl ? long.MaxValue : now + ttlMs, null, principal.AccountName);
             tx.InsertItem(item);
         }
         else
@@ -305,6 +345,7 @@ public sealed class ChannelService(
 
     private void ValidateShape(Envelope env)
     {
+        if (env.IsControl && (env.IsGated || env.IsSnapshot || env.FrameIndex != 0 || !env.IsFinal || env.PayloadLength > 16_400)) throw new WebDropException(ErrorCode.BadRequest);
         // 非 GATED 条目只能是单帧且必须 FINAL;快照只能是非 GATED 的单帧
         if (!env.IsGated && (env.FrameIndex != 0 || !env.IsFinal)) throw new WebDropException(ErrorCode.BadRequest);
         if (env.IsSnapshot && env.IsGated) throw new WebDropException(ErrorCode.BadRequest);
@@ -541,9 +582,16 @@ public sealed class ChannelService(
         if (channel is null || channel.ExpiresAt <= clock.NowMs) throw new WebDropException(ErrorCode.NotFound);
 
         var role = VerifyRole(channel, creds);
-        if (seat == SeatRule.Required && tx.GetSeat(id, creds.EndpointHash) is null)
-            throw new WebDropException(ErrorCode.NotJoined);
-        return (channel, new Principal(role, creds.EndpointHash));
+        var member = creds.AccountName is null ? null : tx.GetChannelMember(id, creds.AccountName);
+        if (role == Role.Owner && member?.Role != "owner") throw new WebDropException(ErrorCode.AccountRequired);
+        if (seat == SeatRule.Required)
+        {
+            var endpoint = tx.GetSeat(id, creds.EndpointHash);
+            if (endpoint is null) throw new WebDropException(ErrorCode.NotJoined);
+            if (endpoint.AccountName is not null && (endpoint.AccountName != creds.AccountName || member is null)) throw new WebDropException(ErrorCode.AccountRequired);
+            if (endpoint.AccountDeviceId is not null && endpoint.AccountDeviceId != creds.AccountDeviceId) throw new WebDropException(ErrorCode.AccountRequired);
+        }
+        return (channel, new Principal(role, creds.EndpointHash, creds.AccountName));
     }
 
     private static Role VerifyRole(Channel channel, Credentials creds)
@@ -573,6 +621,8 @@ public sealed class ChannelService(
     private static ChannelInfo ToInfo(Channel channel, int seatsUsed) => new()
     {
         Id = channel.Id.ToBase64Url(),
+        CreatorAccount = channel.CreatorAccount,
+        PasswordRequired = channel.JoinPasswordHash is not null,
         Mode = channel.Mode,
         Settings = channel.Settings,
         SeatsUsed = seatsUsed,