[6.x] Elevated Sessions

[duncanmcclean]

This pull request introduces the concept of "elevated sessions", which prompts you for your password before allowing you to take certain actions. Similar to GitHub's sudo mode.

After "starting" an elevated session, you won't be prompted for your password again until the session expires. By default, elevated sessions last for 15 minutes.

For now, I've implemented this in front of the following actions:

• Changing another user's password
• Copying a password reset link
• Updating permissions on a role
• Impersonating a user

We'll also use this in #11664 before allowing you to view recovery codes, or deactivate 2FA on your account.

Extending

Addon developers can require elevated sessions in their code by applying the RequireElevatedSession middleware to applicable routes, and using the requireElevatedSession JS function.

Route::get('foo', [FooController::class, 'index'])
  ->middleware(RequireElevatedSession::class);

import { requireElevatedSession } from '@statamic';

methods: {
    submit() {
        requireElevatedSession()
            .then(() => this.actuallySubmit())
            .catch(() => {});
    },
    actuallySubmit() {
        // ...
    }
}