[6.x] Modernize elevated sessions

[brianjhanson]

Requires a user to re-confirm their password (an "elevated session") before a sensitive change goes through — toggling admin, granting new permissions/groups, changing a password, revealing a GraphQL token, and so on.

Replaces the legacy jQuery/Garnish login modal with a Vue-native confirmation flow, and enforces elevation server-side:

• Server: RequireConfirmedPassword middleware (password.confirm alias) + ConfirmsPasswords::requireConfirmedPassword() return 423 when elevation is missing; a dedicated users/confirm-password endpoint drives the modal.
• Client: a reactive elevatedSessionManager + <ElevatedSessionHost> modal (with 2FA / passkey fallbacks). Works both proactively (prompt before submit) and reactively (retry once on a 423).
• Legacy compatibility: Craft.ElevatedSessionForm and Craft.elevatedSessionManager are shimmed onto the new code, so existing Twig screens keep working. The module follows the standard main-class / custom-element / index-shim shape (like listbox, generated-fields).

Usage

Inertia form — require elevation only when sensitive fields changed:

const {save} = useSettingsSave(form, routeAction, {
  passwordConfirmation: {
    required: ({admin, groups, permissions}) =>
      admin !== initialAdmin ||
      groups.some((g) => !initialGroups.has(g)) ||
      permissions.some((p) => !initialPermissions.has(p)),
  },
});

One-off action — run a callback behind an elevated session (auto-retries on 423):

await elevatedSessionManager.run(() =>
  connectRequest.post(connect({provider}).url)
);

Legacy Twig form — declarative custom element (or the Craft.ElevatedSessionForm global):

<craft-elevated-session-form inputs='["[name=\"admin\"]", "#newPassword"]'>
  <form id="main-form">…</form>
</craft-elevated-session-form>

Server enforcement — middleware or inline:

Route::post('users/{userId}/permissions', [PermissionsController::class, 'update'])
    ->middleware('password.confirm');

// …or inline, only when it matters:
if ($adminParam) {
    $this->requireConfirmedPassword();
}

Fixes #19235

[github-actions]

📚 Storybook previews

@craftcms/cp — open Storybook

No changed components detected in this Storybook.

resources/js — open Storybook

No changed components detected in this Storybook.