feat(api): bind encrypted workspaces to accounts and devices

server/tests/WebDrop.Core.Tests/TestEnv.cs

@@ -22,7 +22,7 @@ public sealed class RecordingEvents : IChannelEvents
 }
 
 /// <summary>一个频道的全部凭据,模拟客户端从 K / A 派生出的令牌。</summary>
-public sealed class TestChannel(Id16 id, ChannelMode mode, byte[] read, byte[] write, byte[] owner)
+public sealed class TestChannel(Id16 id, ChannelMode mode, byte[] read, byte[] write, byte[] owner, byte[] ownerEndpoint)
 {
     public Id16 Id { get; } = id;
     public ChannelMode Mode { get; } = mode;
@@ -30,9 +30,9 @@ public sealed class TestChannel(Id16 id, ChannelMode mode, byte[] read, byte[] w
     public byte[] WriteToken { get; } = write;
     public byte[] OwnerToken { get; } = owner;
 
-    public Credentials Owner(byte[] endpoint) => new(Role.Owner, OwnerToken, endpoint);
-    public Credentials Member(byte[] endpoint) => new(Role.Write, WriteToken, endpoint);
-    public Credentials Reader(byte[] endpoint) => new(Role.Read, ReadToken, endpoint);
+    public Credentials Owner(byte[] endpoint) => new(Role.Owner, OwnerToken, endpoint, "owner");
+    public Credentials Member(byte[] endpoint) => new(Role.Write, WriteToken, endpoint, endpoint.AsSpan().SequenceEqual(ownerEndpoint) ? "owner" : null);
+    public Credentials Reader(byte[] endpoint) => new(Role.Read, ReadToken, endpoint, endpoint.AsSpan().SequenceEqual(ownerEndpoint) ? "owner" : null);
 }
 
 public sealed class TestEnv : IDisposable
@@ -76,9 +76,9 @@ public sealed class TestEnv : IDisposable
             ReadHash = mode == ChannelMode.Enc ? Codec.Encode(TokenHash.Compute(read)) : null,
             WriteHash = withWriteHash ? Codec.Encode(TokenHash.Compute(write)) : null,
             OwnerHash = Codec.Encode(TokenHash.Compute(owner)),
-        }, ownerEndpoint);
+        }, ownerEndpoint, "owner");
 
-        return new TestChannel(id, mode, read, write, owner);
+        return new TestChannel(id, mode, read, write, owner, ownerEndpoint);
     }
 
     /// <summary>构造一个封装。enc 模式的负载长度必须是 档位+16。</summary>