Windows elevation patterns

int main(int argc, char** argv) {
    // Runs ELEVATED (your strategy relaunches the exe with this arg). Creates the
    // AK + activates it, relaying the two blobs through your backend, and stays
    // resident across the relay round-trip. See the device-enrollment guide.
    if (argc >= 2 && strcmp(argv[1], "--enroll-worker") == 0)
        return RunEnrollWorker(/* IPC channel to your unprivileged process */);
    /* ... normal startup ... */
}

// Inside the elevated worker, on ONE session h:
//   RootHeraldEnrollBegin(h, buf, cap, &len);                       // -> relay + challengeId to backend
//   /* backend returns the sealed credential (or 422 admission_refused) */
//   RootHeraldEnrollComplete(h, cred, cred_len, buf, cap, &len);   // -> relay
// Keep 'h' open across both calls (the EK+AK context must persist).

// Runs inside your ALREADY-ELEVATED installer. ELEVATION_REQUIRED never appears here.
// challengeId names the challenge your backend minted for this install; admission
// runs under its policy.
static bool EnrollDeviceAtInstall(RH_HANDLE h, const std::string& challengeId) {
    char buf[8192]; size_t len = 0;
    if (RootHeraldEnrollBegin(h, buf, sizeof buf, &len) != RH_OK)
        return false;                       // no TPM, or TPM unavailable -- see below

    // Relay to YOUR backend, which holds the rh_sk_ secret and calls
    // POST /api/v1/attest/enroll on your behalf. Blocks for one round-trip.
    // An empty result here includes 422 admission_refused: the policy says no.
    std::string credential = MyBackend_RelayEnroll(std::string(buf, len - 1), challengeId);
    if (credential.empty()) return false;

    if (RootHeraldEnrollComplete(h, credential.data(), credential.size(),
                                 buf, sizeof buf, &len) != RH_OK)
        return false;

    return MyBackend_RelayActivate(std::string(buf, len - 1));   // POST /api/v1/attest/activate
    // device is now enrolled, for the life of the machine; nothing to free
}

// Returns the elevated child's exit code (0 = enrolled, non-zero = UAC declined / failed).
static int RunSelfElevationShim(const wchar_t* pipeName) {
    wchar_t exe[MAX_PATH] = {0};
    GetModuleFileNameW(NULL, exe, MAX_PATH);

    wchar_t args[512] = {0};
    swprintf_s(args, 512, L"--enroll-worker \"%s\"", pipeName);

    SHELLEXECUTEINFOW sei = { sizeof(sei) };
    sei.fMask  = SEE_MASK_NOCLOSEPROCESS;
    sei.lpVerb = L"runas";          // the UAC consent prompt
    sei.lpFile = exe;
    sei.lpParameters = args;
    sei.nShow  = SW_HIDE;
    if (!ShellExecuteExW(&sei) || !sei.hProcess) return 1; // declined / no desktop

    WaitForSingleObject(sei.hProcess, INFINITE);
    DWORD code = 1; GetExitCodeProcess(sei.hProcess, &code);
    CloseHandle(sei.hProcess);
    return (int)code;
}

// Use it: only when the device has no key yet (attest-first — see re-attestation).
if (st == RH_ERR_NOT_ENROLLED /* from RootHeraldRespond */)
    RunSelfElevationShim(pipeName);

// Runs inside YOUR already-elevated helper / service. No ELEVATION_REQUIRED here.
char buf[8192]; size_t len = 0;
RootHeraldEnrollBegin(h, buf, sizeof buf, &len);                     // -> relay + challengeId to your backend
/* backend returns the sealed credential */
RootHeraldEnrollComplete(h, cred, cred_len, buf, sizeof buf, &len); // -> relay
// The device's attestation key is now persisted; the key context is evicted to a
// persistent handle, so your unprivileged app can Respond and Sign with no prompt.

char buf[8192]; size_t len = 0;
RH_STATUS st = RootHeraldEnrollBegin(h, buf, sizeof buf, &len);
if (st == RH_ERR_ELEVATION_REQUIRED) {
    // We can't elevate here. Don't prompt; record it and continue without
    // hardware attestation (or defer enrollment to a context that can elevate).
    log_warn("device not hardware-attested: enrollment needs elevation");
    return CONTINUE_WITHOUT_ATTESTATION;
}