feat(api): bind encrypted workspaces to accounts and devices

server/src/WebDrop.Core/Models.cs

@@ -11,7 +11,10 @@ public sealed record Channel(
     long ExpiresAt,
     long LastSeq,
     long CompactedThrough,
-    long Bytes);
+    long Bytes,
+    string CreatorAccount,
+    byte[]? JoinPasswordHash = null,
+    byte[]? JoinPasswordSalt = null);
 
 public sealed record Share(
     Id16 Id,
@@ -23,7 +26,8 @@ public sealed record Share(
     long ExpiresAt,
     long? SealedAt,
     Id16? ManifestItemId,
-    long Bytes)
+    long Bytes,
+    string CreatorAccount)
 {
     public bool IsSealed => SealedAt is not null;
 }
@@ -71,14 +75,17 @@ public sealed record Item(
     long CreatedAt,
     long ExpiresAt,
     long? CloseDeadline,
-    string? Label)
+    string? AuthorAccount)
 {
     public bool IsGated => (Flags & FrameFlags.Gated) != 0;
     public bool IsSnapshot => (Flags & FrameFlags.Snapshot) != 0;
     public bool IsComplete => FinalIndex is { } f && FrameCount == f + 1;
 }
 
-public sealed record Seat(byte[] EndpointHash, long JoinedAt, byte[]? Label);
+public sealed record Seat(byte[] EndpointHash, long JoinedAt, byte[]? Label, string? AccountName = null, string? AccountDeviceId = null);
+public sealed record ChannelInvitation(Id16 ChannelId, string Username, string Payload, long CreatedAt);
+public sealed record ChannelMember(string Username, string Role, long JoinedAt);
+public sealed record ChannelKeyPackage(Id16 ChannelId, string Username, string Role, string Payload, long CreatedAt);
 
 /// <summary>已存储的一帧(完整封装)。Inline 与 BlobKey 二选一。</summary>
 public sealed record StoredFrame(
@@ -94,7 +101,7 @@ public sealed record StoredFrame(
 public sealed record LogEntry(long Seq, LogKind Kind, Id16 ItemId, uint FrameIndex, byte Aux, long CreatedAt);
 
 /// <summary>一次请求验证通过后的身份。</summary>
-public sealed record Principal(Role Role, byte[] EndpointHash);
+public sealed record Principal(Role Role, byte[] EndpointHash, string? AccountName = null);
 
 /// <summary>请求携带的凭据,尚未验证。</summary>
-public sealed record Credentials(Role ClaimedRole, byte[]? Token, byte[] EndpointHash);
+public sealed record Credentials(Role ClaimedRole, byte[]? Token, byte[] EndpointHash, string? AccountName = null, string? AccountDeviceId = null);