diff --git a/README.md b/README.md
index 7410447..1fb7d3d 100644
--- a/README.md
+++ b/README.md
@@ -69,7 +69,8 @@ src/
DodoSSH.Client.Terminal the loopback data plane and credit-based flow control
DodoSSH.Client.Transfer the transfer queue, part files and resume, and the local file listing
DodoSSH.Client.ObjectStore S3-compatible buckets, behind the same interface as SFTP
- DodoSSH.Client.Import reading ~/.ssh/config, and the keys it names when asked
+ DodoSSH.Client.Import reading ~/.ssh/config and the keys it names when asked; reading a Hetzner
+ Cloud project over its API
DodoSSH.Client.Shell the view models both heads drive, the renderer's files, the palette
DodoSSH.Client.App the desktop head: its views, and its Windows, macOS and Linux integration
DodoSSH.Client.Android the phone head: its views, and its Android integration
diff --git a/docs/android-port.md b/docs/android-port.md
index bf044ba..31c7e51 100644
--- a/docs/android-port.md
+++ b/docs/android-port.md
@@ -755,6 +755,12 @@ Recorded so they are choices rather than accidents. Any of them is cheap to revi
local-and-non-roaming requirement more cleanly than any desktop platform does.
- **The device name** on log entries comes from the head, not `Environment.MachineName`, which returns
something like `localhost` on Android and would make every entry from a phone indistinguishable.
+- **The Hetzner Cloud importer is not ported, and it is the one gap here that is not a platform limit.**
+ Its view model is in `DodoSSH.Client.Shell` like every other and its reader is an `HttpClient` call, so
+ both halves already run on a phone — unlike the `~/.ssh/config` importer beside it, which has no file to
+ read under scoped storage and never will. What is missing is a layout: the desktop draws a five-column
+ table of servers, and a phone version of that is a different screen rather than the same one narrower.
+ Said on the Preferences screen rather than left to be discovered.
- **`NativeKeyboardFocus` is not ported.** It exists for a documented Win32 asymmetry — focus crosses into
WebView2 but does not come back — and Android's focus model is different enough that the problem should be
confirmed to exist before anything is written to solve it.
diff --git a/docs/manual-checks.md b/docs/manual-checks.md
index 97a9c47..836458f 100644
--- a/docs/manual-checks.md
+++ b/docs/manual-checks.md
@@ -165,7 +165,9 @@ ordinary nav rail destination does through `MainWindowViewModel.ShowScreen`. An
comes up over settings mode the same way it would over any other screen.
**Failure means:** a back button that never changes label is `SettingsTitleBar.axaml`'s two buttons both
-bound to the same side of `IsImportOpen`. SettingsNav lighting a different row while the importer is up is
+bound to the same side of `IsImporterOpen` — which is the flag now, rather than `IsImportOpen`, because
+there are two importers over that page and the bar behaves identically for both. SettingsNav lighting a
+different row while an importer is up is
`MainWindowViewModel.IsSettingsPreferencesPage` reading `IsImportOpen` when it must not —
`Import.dc.html` draws the rail unmoved on purpose; see the remark on `IsImportOpen`. Ctrl+K doing nothing
over the importer would be a guard added to `OnKeyDown` for `IsSettingsMode` that the design never asked for
@@ -410,6 +412,74 @@ machine. That is the ordinary case rather than an error.
---
+## Phase 2 — Importing from Hetzner Cloud
+
+The reader has its own suite over the shapes the API returns, and the end-to-end path is covered by
+`ImportingFromHetzner_ShowsTheProjectFirstAndThenStoresWhatWasTicked` against a stubbed transport. What no
+test in this repository does is talk to Hetzner — there is no account, no token and no network in the
+ordinary suite — so everything below needs a real project.
+
+### 2.11a A read-only token lists your project
+
+Make a token in the Hetzner console under **Security → API tokens** with **Read** permission only. Settings
+→ Preferences → **OPEN WIZARD**, paste it, press **READ THE PROJECT**.
+
+**Pass:** every server in that project is listed, with the address, the plan and the location the Hetzner
+console shows for it. The token box is **empty** afterwards — it is used for one request and dropped — and
+the Hosts screen is unchanged, because reading writes nothing.
+
+**What to look for specifically:**
+- A project with more than fifty servers must list all of them. Fifty is Hetzner's page size, and a list
+ that stops there exactly is the paginator not being followed.
+- A server with no public IPv4 should show the first address of its `/64` with a warning chip saying so.
+ Check that address against what the server actually answers on — the convention is Hetzner's own images,
+ not a fact the API states, and a machine whose operator moved it elsewhere in the `/64` will not answer.
+- A server the console shows as **off** should still be listed, with `off` in the STATE column.
+
+**Failure means:** the importer and the console disagree about what the project holds, which produces
+bookmarks that dial the wrong machine. Worse than an import that refused.
+
+### 2.11b A wrong token says so, and says where tokens come from
+
+Paste anything that is not a valid token — a truncated one is the realistic case, since the console shows
+the value once.
+
+**Pass:** the wizard stays on the token step, the message names the Hetzner console and the Security → API
+tokens page, and the box is cleared for a fresh paste. Nothing has been stored.
+
+Now try a token from a **different** project.
+
+**Pass:** it lists that project instead. A token belongs to one project and there is no API call that will
+say which — an account with several projects runs this once per project, which the note above the box says.
+
+### 2.11c The private-network choice does not fall back
+
+With a project holding at least one server on a private network and one on none, press **PRIVATE NETWORK**.
+
+**Pass:** the server with no private network shows an em dash for its address, a chip reading *no address of
+that kind*, and a tickbox that cannot be ticked — including by the tick-all box in the header. The other
+one shows its `10.x` address.
+
+**Failure means:** a public address quietly stored under a choice that asked to stay off the internet. This
+is the one asymmetry in how addresses resolve and it is deliberate; v4 and v6 fall back to each other,
+private does not.
+
+### 2.11d Imported hosts are correct, and ask for a password
+
+Import a couple, then open one on the Hosts screen.
+
+**Pass:** the address, port and login user are what the wizard showed, and the notes carry the server id,
+the plan, the location and the image — and **not** the power state, which would be stale the moment somebody
+pressed a button in the console. Connecting asks for a **password**: no key came with these hosts, because
+Hetzner has never held the private half of one. Bind it to a key in your keychain and it connects.
+
+Now go back to the list and import the same project again.
+
+**Pass:** the ones already stored are marked *already here* and arrive unticked. Importing one twice is
+allowed and takes a click.
+
+---
+
## Phase 2 — Drag and drop on the SFTP page
**This is the least-covered thing in the repository, and unavoidably so.** Headless Avalonia has no native
diff --git a/src/DodoSSH.Client.Android/Views/PreferencesScreen.axaml b/src/DodoSSH.Client.Android/Views/PreferencesScreen.axaml
index 5009514..a9ba586 100644
--- a/src/DodoSSH.Client.Android/Views/PreferencesScreen.axaml
+++ b/src/DodoSSH.Client.Android/Views/PreferencesScreen.axaml
@@ -163,6 +163,8 @@
Text="Text size is on the terminal itself, where the text is — the phone puts A− and A+ in the shell's own bar rather than a step away from what they resize." />
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/src/DodoSSH.Client.App/Views/HetznerImportScreen.axaml.cs b/src/DodoSSH.Client.App/Views/HetznerImportScreen.axaml.cs
new file mode 100644
index 0000000..a027899
--- /dev/null
+++ b/src/DodoSSH.Client.App/Views/HetznerImportScreen.axaml.cs
@@ -0,0 +1,25 @@
+using Avalonia.Controls;
+
+namespace DodoSSH.Client.App.Views;
+
+///
+/// Importing hosts from a Hetzner Cloud project.
+///
+///
+///
+/// A task rather than a destination, reached from Preferences and not from the nav rail, and drawn inside
+/// settings mode over the Preferences page — the same shape
+///
+/// No code behind it, unlike HetznerImportViewModel.OnRowChanged — which puts the same wiring where the count actually lives
+/// rather than in a routed-event handler on a control.
+///
+///
+internal sealed partial class HetznerImportScreen : UserControl
+{
+ public HetznerImportScreen() => InitializeComponent();
+}
diff --git a/src/DodoSSH.Client.App/Views/SettingsPreferencesPage.axaml b/src/DodoSSH.Client.App/Views/SettingsPreferencesPage.axaml
index 4812d36..15f9a29 100644
--- a/src/DodoSSH.Client.App/Views/SettingsPreferencesPage.axaml
+++ b/src/DodoSSH.Client.App/Views/SettingsPreferencesPage.axaml
@@ -15,8 +15,10 @@
TERMINAL keeps its one real setting, text size, and drops the design's other five — font, cursor,
scrollback, copy on select, terminal bell — which the renderer hard-codes. KEYCHAIN keeps Lock now,
- Sync now/Sign in, and the importer row exactly as the old screen had them; the design's own SECURITY
- card (clipboard-clear delay, confirm-run-on-insert) has nothing behind either row and is not drawn here.
+ Sync now/Sign in, and the importer rows; the design's own SECURITY card (clipboard-clear delay,
+ confirm-run-on-insert) has nothing behind either row and is not drawn here.
+
+ Two importer rows now rather than the one the old screen had: ~/.ssh/config, and a Hetzner Cloud project.
-->
@@ -95,7 +97,7 @@
-
+
+
+
+
+
+
+
+
+
diff --git a/src/DodoSSH.Client.App/Views/SettingsTitleBar.axaml b/src/DodoSSH.Client.App/Views/SettingsTitleBar.axaml
index 8c8b33f..05bba60 100644
--- a/src/DodoSSH.Client.App/Views/SettingsTitleBar.axaml
+++ b/src/DodoSSH.Client.App/Views/SettingsTitleBar.axaml
@@ -17,9 +17,12 @@
bars needs its own window behaviour a shared base would have to be pulled apart first.
v5c-3: two back buttons rather than one whose text and command a converter swaps, toggled by
- MainWindowViewModel.IsImportOpen — Import.dc.html draws the same 53px bar with "Back to preferences" in
- place of "Back to application" while the importer is up, and CloseImportCommand closes it without leaving
+ MainWindowViewModel.IsImporterOpen — Import.dc.html draws the same 53px bar with "Back to preferences" in
+ place of "Back to application" while an importer is up, and CloseImportCommand closes it without leaving
settings mode, unlike LeaveSettingsCommand.
+
+ IsImporterOpen rather than IsImportOpen because there are two importers now — the ssh_config one and the
+ Hetzner wizard — and this bar behaves identically for both: same label, same destination, same command.
-->
@@ -40,7 +43,7 @@
diff --git a/src/DodoSSH.Client.App/Views/SettingsView.axaml b/src/DodoSSH.Client.App/Views/SettingsView.axaml
index 19b8d21..d19f130 100644
--- a/src/DodoSSH.Client.App/Views/SettingsView.axaml
+++ b/src/DodoSSH.Client.App/Views/SettingsView.axaml
@@ -23,6 +23,11 @@
because ActiveSettingsPage never actually leaves SettingsPage.Preferences; only IsImportOpen and the pair
of IsVisible bindings below move. Its data context is ImportScreen rather than this control's own, the
same split MainWindow.axaml drew before the importer moved in here.
+
+ HetznerImportScreen joined it on identical terms. Two flags rather than one "which importer" value,
+ because they are two independent facts about the content column and every path that opens either closes
+ the other; what the Preferences page below asks is IsSettingsPreferencesContentShowing, which is written
+ against both.
-->
@@ -59,6 +64,11 @@
+
+
diff --git a/src/DodoSSH.Client.Import/DodoSSH.Client.Import.csproj b/src/DodoSSH.Client.Import/DodoSSH.Client.Import.csproj
index caadcee..99402bc 100644
--- a/src/DodoSSH.Client.Import/DodoSSH.Client.Import.csproj
+++ b/src/DodoSSH.Client.Import/DodoSSH.Client.Import.csproj
@@ -1,12 +1,19 @@
diff --git a/src/DodoSSH.Client.Import/HetznerCloudClient.cs b/src/DodoSSH.Client.Import/HetznerCloudClient.cs
new file mode 100644
index 0000000..36494c2
--- /dev/null
+++ b/src/DodoSSH.Client.Import/HetznerCloudClient.cs
@@ -0,0 +1,476 @@
+using System.Globalization;
+using System.Net;
+using System.Net.Http.Headers;
+using System.Net.Http.Json;
+using System.Text.Json;
+using System.Text.Json.Serialization;
+
+namespace DodoSSH.Client.Import;
+
+///
+/// Hetzner Cloud answered, and the answer was not a list of servers.
+///
+///
+/// One exception type with a sentence already fit to show somebody, rather than a status code every caller
+/// would have to translate for itself. The status is kept beside it because "401" and "503" are different
+/// problems with different next steps — one is the token, the other is nothing the user can do — and the
+/// screen distinguishes them by
+public sealed class HetznerCloudException : Exception
+{
+ /// Creates a failure that has no underlying exception — a refusal Hetzner spelled out.
+ public HetznerCloudException(HttpStatusCode? statusCode, string? code, string message)
+ : this(statusCode, code, message, innerException: null)
+ {
+ }
+
+ /// Creates a failure wrapping the one the transport or the parser threw.
+ public HetznerCloudException(
+ HttpStatusCode? statusCode,
+ string? code,
+ string message,
+ Exception? innerException)
+ : base(message, innerException)
+ {
+ StatusCode = statusCode;
+ Code = code;
+ }
+
+ /// What Hetzner returned, or null where the request never got an answer at all.
+ public HttpStatusCode? StatusCode { get; }
+
+ /// Hetzner's own machine-readable error code, where the body carried one.
+ public string? Code { get; }
+
+ /// Whether the token is the thing to go and fix.
+ ///
+ /// The wizard's first step is where a token gets typed, so a failure that is about the token belongs
+ /// back on that step and a failure that is about Hetzner's weather does not — sending somebody back to
+ /// re-type a token that was fine, because a datacentre had a bad minute, teaches them the token is
+ /// wrong.
+ ///
+ public bool IsTokenProblem =>
+ StatusCode is HttpStatusCode.Unauthorized or HttpStatusCode.Forbidden;
+}
+
+///
+/// Reads the servers in one Hetzner Cloud project.
+///
+///
+///
+/// One token is one project. Hetzner issues Cloud API tokens per project and the API offers no way
+/// to ask which project a token belongs to, or to list the others — so this reads exactly the project whose
+/// token it was handed, and the screen says as much rather than implying it found everything the account
+/// owns. Somebody with four projects runs this four times.
+///
+///
+/// Read is all it does. Only GET /v1/servers is ever called, which is why the screen asks for
+/// a read-only token: a Read & Write token would work identically here and would be a credential capable
+/// of deleting the estate, pasted into a text box for no gain.
+///
+///
+/// The token is never stored. It lives in the view model's field for as long as the wizard is open
+/// and goes no further — not into the vault, not into settings, not into a log. The next import asks again,
+/// which is the same reasoning ImportViewModel.ImportsKeys gives for not remembering its tick.
+///
+///
+/// Dedicated servers are not here. Hetzner's Robot — the dedicated-server and Storage Box side of the
+/// business — is a different API behind different credentials, and nothing in this file touches it. An
+/// account with both gets its cloud servers from this wizard and adds the rest by hand.
+///
+///
+public sealed class HetznerCloudClient
+{
+ /// The Cloud API, and the one address in this file.
+ public static readonly Uri CloudApi = new("https://api.hetzner.cloud/v1/", UriKind.Absolute);
+
+ /// What Hetzner will return per page, which is also its maximum.
+ private const int PerPage = 50;
+
+ ///
+ /// How many pages this will follow before giving up.
+ ///
+ ///
+ /// A backstop against a paginator that never says "no more pages" rather than a limit anybody's estate
+ /// will meet: at fifty a page this is five thousand servers, and the warning it emits on the way out
+ /// says the list is short rather than letting it look complete.
+ ///
+ private const int MaxPages = 100;
+
+ private readonly HttpClient http;
+
+ /// Creates a reader over its own transport, which is how the application builds one.
+ public HetznerCloudClient()
+ : this(new HttpClient { BaseAddress = CloudApi })
+ {
+ }
+
+ /// Creates a reader with its transport supplied, which is how the tests reach it.
+ ///
+ /// The base address is set here when the caller left it unset, so a stubbed HttpMessageHandler
+ /// can be handed over on its own without every test repeating the one URL this class knows.
+ ///
+ public HetznerCloudClient(HttpClient http)
+ {
+ ArgumentNullException.ThrowIfNull(http);
+
+ http.BaseAddress ??= CloudApi;
+
+ this.http = http;
+ }
+
+ ///
+ /// Reads every server the token's project holds.
+ ///
+ ///
+ /// Pages are followed rather than assumed away: twenty-six servers in a project is enough to meet the
+ /// second page, and an importer that quietly showed the first fifty would offer a list that looks
+ /// complete and is not.
+ ///
+ ///
+ /// The token was refused, the project could not be read, or Hetzner could not be reached. Every failure
+ /// arrives as this, with a sentence already fit to put on the screen.
+ ///
+ public async Task ListServersAsync(string token, CancellationToken cancellationToken)
+ {
+ var bearer = Sanitise(token);
+
+ var servers = new List();
+ var warnings = new List();
+ var page = 1;
+
+ while (page <= MaxPages)
+ {
+ var read = await ReadPageAsync(bearer, page, cancellationToken).ConfigureAwait(false);
+
+ foreach (var server in read.Servers ?? [])
+ {
+ servers.Add(Convert(server, warnings));
+ }
+
+ if (read.Meta?.Pagination?.NextPage is not { } next || next <= page)
+ {
+ return new HetznerImport(servers, warnings);
+ }
+
+ page = next;
+ }
+
+ var counted = servers.Count.ToString(CultureInfo.InvariantCulture);
+
+ warnings.Add(
+ $"Stopped after {MaxPages.ToString(CultureInfo.InvariantCulture)} pages. This list is the first "
+ + counted + " servers in the project and not all of them.");
+
+ return new HetznerImport(servers, warnings);
+ }
+
+ ///
+ /// Trims the pasted token and refuses one that could not be a header value.
+ ///
+ ///
+ /// A token copied out of the Hetzner console arrives with a newline behind it often enough to be worth
+ /// handling, and a header value carrying one throws a
+ private static string Sanitise(string token)
+ {
+ var trimmed = token?.Trim() ?? string.Empty;
+
+ if (trimmed.Length == 0)
+ {
+ throw new HetznerCloudException(null, null, "Paste a Hetzner Cloud API token first.");
+ }
+
+ foreach (var character in trimmed)
+ {
+ if (char.IsWhiteSpace(character) || char.IsControl(character))
+ {
+ throw new HetznerCloudException(
+ null,
+ null,
+ "That does not look like a Hetzner Cloud API token — it has a space or a line break in "
+ + "the middle of it. A token is one unbroken run of 64 letters and digits.");
+ }
+ }
+
+ return trimmed;
+ }
+
+ /// Fetches and parses one page, turning every way it can fail into one exception type.
+ private async Task ReadPageAsync(
+ string token,
+ int page,
+ CancellationToken cancellationToken)
+ {
+ using var request = new HttpRequestMessage(
+ HttpMethod.Get,
+ string.Create(CultureInfo.InvariantCulture, $"servers?page={page}&per_page={PerPage}"));
+
+ request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", token);
+
+ HttpResponseMessage response;
+
+ try
+ {
+ response = await http.SendAsync(request, cancellationToken).ConfigureAwait(false);
+ }
+ catch (HttpRequestException failure)
+ {
+ throw new HetznerCloudException(
+ null,
+ null,
+ $"Could not reach {CloudApi.Host}: {failure.Message}",
+ failure);
+ }
+ catch (TaskCanceledException failure) when (!cancellationToken.IsCancellationRequested)
+ {
+ throw new HetznerCloudException(
+ null,
+ null,
+ $"{CloudApi.Host} did not answer in time.",
+ failure);
+ }
+
+ using (response)
+ {
+ if (!response.IsSuccessStatusCode)
+ {
+ throw await FailureAsync(response, cancellationToken).ConfigureAwait(false);
+ }
+
+ try
+ {
+ return await response.Content
+ .ReadFromJsonAsync(HetznerJsonContext.Default.HetznerServersPage, cancellationToken)
+ .ConfigureAwait(false)
+ ?? new HetznerServersPage(null, null);
+ }
+ catch (JsonException failure)
+ {
+ throw new HetznerCloudException(
+ response.StatusCode,
+ null,
+ $"{CloudApi.Host} answered with something that is not a server list. That usually means "
+ + "a proxy answered instead of Hetzner.",
+ failure);
+ }
+ }
+ }
+
+ ///
+ /// Turns a refusal into the sentence the screen shows.
+ ///
+ ///
+ /// Hetzner's own message is kept and something actionable is put in front of it, because "unable to
+ /// authenticate" on its own does not tell somebody where tokens come from — and the token step is
+ /// exactly where they will be standing when they read it.
+ ///
+ private static async Task FailureAsync(
+ HttpResponseMessage response,
+ CancellationToken cancellationToken)
+ {
+ string? code = null;
+ string? detail = null;
+
+ try
+ {
+ var body = await response.Content
+ .ReadFromJsonAsync(HetznerJsonContext.Default.HetznerErrorEnvelope, cancellationToken)
+ .ConfigureAwait(false);
+
+ code = body?.Error?.Code;
+ detail = body?.Error?.Message;
+ }
+ catch (JsonException)
+ {
+ // Not Hetzner's error shape. The status still says what happened, which is what the switch below
+ // is written against — a proxy's HTML 502 must not lose the 502 while being parsed.
+ }
+ catch (NotSupportedException)
+ {
+ // A content type that is not JSON at all, for the same reason.
+ }
+
+ var said = detail is { Length: > 0 } ? $" Hetzner said: {detail}" : string.Empty;
+ var status = ((int)response.StatusCode).ToString(CultureInfo.InvariantCulture);
+
+ var summary = response.StatusCode switch
+ {
+ HttpStatusCode.Unauthorized =>
+ "Hetzner did not accept that token. Cloud API tokens are made per project, in the Hetzner "
+ + "console under Security → API tokens, and the value is shown only once — so a token "
+ + "that was written down half-copied fails exactly like this.",
+ HttpStatusCode.Forbidden =>
+ "That token is not allowed to read this project's servers. A read-only token is enough; a "
+ + "token scoped to something narrower is not.",
+ HttpStatusCode.TooManyRequests =>
+ "Hetzner is rate-limiting this token. Give it a minute and start the scan again.",
+ HttpStatusCode.NotFound =>
+ $"{CloudApi.Host} has no server list at that address, which should not happen and probably "
+ + "means something between here and Hetzner answered instead.",
+ _ when (int)response.StatusCode >= 500 =>
+ $"Hetzner Cloud returned {status}. That is a fault at their end rather than anything about "
+ + "the token.",
+ _ => $"Hetzner Cloud returned {status}.",
+ };
+
+ return new HetznerCloudException(response.StatusCode, code, summary + said);
+ }
+
+ ///
+ /// Turns one server as the API describes it into one the import can offer.
+ ///
+ ///
+ /// Everything the API leaves out is tolerated rather than fatal, and only the name is worth a warning: a
+ /// server with no plan or no image loses a phrase from a note, and a server with no name would arrive as
+ /// a bookmark called nothing.
+ ///
+ private static HetznerServer Convert(HetznerServerDto server, List warnings)
+ {
+ var name = server.Name;
+
+ if (string.IsNullOrWhiteSpace(name))
+ {
+ name = string.Create(CultureInfo.InvariantCulture, $"server-{server.Id}");
+
+ warnings.Add($"A server had no name in the project, so it is offered as {name}.");
+ }
+
+ var privateAddresses = (server.PrivateNet ?? [])
+ .Select(network => network.Ip)
+ .Where(ip => !string.IsNullOrWhiteSpace(ip))
+ .Select(ip => ip!)
+ .ToList();
+
+ var labels = (server.Labels ?? new Dictionary(StringComparer.Ordinal))
+ .Select(label => label.Value is { Length: > 0 }
+ ? $"{label.Key}={label.Value}"
+ : label.Key)
+ .Order(StringComparer.Ordinal)
+ .ToList();
+
+ return new HetznerServer(
+ server.Id,
+ name,
+ server.Status is { Length: > 0 } status ? status : "unknown",
+ Blank(server.PublicNet?.IPv4?.Ip),
+ Blank(server.PublicNet?.IPv6?.Ip),
+ privateAddresses,
+ Blank(server.ServerType?.Name),
+ Where(server.Datacenter),
+ Blank(server.Image?.Name),
+ labels);
+ }
+
+ /// Where a server runs, as a person would say it — or null where the API said nothing useful.
+ private static string? Where(HetznerDatacenterDto? datacenter)
+ {
+ if (datacenter is null)
+ {
+ return null;
+ }
+
+ var location = datacenter.Location;
+ var region = Blank(location?.Name) ?? Blank(datacenter.Name);
+
+ var place = (Blank(location?.City), Blank(location?.Country)) switch
+ {
+ ({ } city, { } country) => $"{city}, {country}",
+ ({ } city, null) => city,
+ (null, { } country) => country,
+ _ => null,
+ };
+
+ return (region, place) switch
+ {
+ ({ } where, { } which) => $"{where} · {which}",
+ ({ } where, null) => where,
+ (null, { } which) => which,
+ _ => null,
+ };
+ }
+
+ /// Folds an absent value and a present-but-empty one together, which JSON does not.
+ private static string? Blank(string? value) => string.IsNullOrWhiteSpace(value) ? null : value;
+}
+
+/// One page of GET /v1/servers .
+internal sealed record HetznerServersPage(
+ [property: JsonPropertyName("servers")] IReadOnlyList? Servers,
+ [property: JsonPropertyName("meta")] HetznerMetaDto? Meta);
+
+/// The envelope every Hetzner list response carries its paging in.
+internal sealed record HetznerMetaDto(
+ [property: JsonPropertyName("pagination")] HetznerPaginationDto? Pagination);
+
+/// Only the forward link is read; the rest of Hetzner's paging block is not needed to walk it.
+internal sealed record HetznerPaginationDto(
+ [property: JsonPropertyName("next_page")] int? NextPage);
+
+/// One server, as the API describes it. Every field is optional because the API's are.
+internal sealed record HetznerServerDto(
+ [property: JsonPropertyName("id")] long Id,
+ [property: JsonPropertyName("name")] string? Name,
+ [property: JsonPropertyName("status")] string? Status,
+ [property: JsonPropertyName("public_net")] HetznerPublicNetDto? PublicNet,
+ [property: JsonPropertyName("private_net")] IReadOnlyList? PrivateNet,
+ [property: JsonPropertyName("server_type")] HetznerNamedDto? ServerType,
+ [property: JsonPropertyName("datacenter")] HetznerDatacenterDto? Datacenter,
+ [property: JsonPropertyName("image")] HetznerNamedDto? Image,
+ [property: JsonPropertyName("labels")] IReadOnlyDictionary? Labels);
+
+/// A server's public addresses. Either half can be absent on a server that has only the other.
+internal sealed record HetznerPublicNetDto(
+ [property: JsonPropertyName("ipv4")] HetznerIpDto? IPv4,
+ [property: JsonPropertyName("ipv6")] HetznerIpDto? IPv6);
+
+///
+/// One public address.
+///
+///
+/// The v6 case puts a network in this field rather than an address — see
+///
+internal sealed record HetznerIpDto([property: JsonPropertyName("ip")] string? Ip);
+
+/// A server's attachment to one private network.
+internal sealed record HetznerPrivateNetDto([property: JsonPropertyName("ip")] string? Ip);
+
+/// The shape shared by the server type and the image, of which only the name is read.
+internal sealed record HetznerNamedDto([property: JsonPropertyName("name")] string? Name);
+
+/// Where a server runs.
+internal sealed record HetznerDatacenterDto(
+ [property: JsonPropertyName("name")] string? Name,
+ [property: JsonPropertyName("location")] HetznerLocationDto? Location);
+
+/// How Hetzner wraps a refusal.
+internal sealed record HetznerErrorEnvelope(
+ [property: JsonPropertyName("error")] HetznerErrorDto? Error);
+
+///
+/// The serializer for everything above.
+///
+///
+/// Source-generated rather than reflective, for the reason every other JSON context in this repository is:
+/// the Android head publishes trimmed, and a reflective deserializer in an assembly the phone links is a
+/// trim warning at best and a runtime failure at worst.
+///
+[JsonSourceGenerationOptions(UnmappedMemberHandling = JsonUnmappedMemberHandling.Skip)]
+[JsonSerializable(typeof(HetznerServersPage))]
+[JsonSerializable(typeof(HetznerErrorEnvelope))]
+internal sealed partial class HetznerJsonContext : JsonSerializerContext;
diff --git a/src/DodoSSH.Client.Import/HetznerServer.cs b/src/DodoSSH.Client.Import/HetznerServer.cs
new file mode 100644
index 0000000..cf43749
--- /dev/null
+++ b/src/DodoSSH.Client.Import/HetznerServer.cs
@@ -0,0 +1,237 @@
+using System.Globalization;
+using System.Net;
+using System.Net.Sockets;
+using DodoSSH.Client.Domain;
+
+namespace DodoSSH.Client.Import;
+
+///
+/// Which of a Hetzner server's addresses an import should dial.
+///
+///
+/// One choice for the whole import rather than one per row, for the reason the ssh_config screen's key tick
+/// is one control: an estate is reached the same way throughout — everything over the public internet, or
+/// everything across the private network from a machine already inside it — and a per-server dropdown would
+/// be forty answers to one question.
+///
+public enum HetznerAddressKind
+{
+ /// The public IPv4 address, which is how all but the cheapest Hetzner servers are reached.
+ PublicIPv4 = 0,
+
+ /// The public IPv6 address, for an estate that is v6 throughout — or a server with no v4 at all.
+ PublicIPv6 = 1,
+
+ /// The address on the first private network the server is attached to.
+ Private = 2,
+}
+
+///
+/// An address an import settled on, and what it had to assume to get there.
+///
+///
+/// One server a Hetzner Cloud project holds, as the import sees it.
+///
+///
+///
+/// Deliberately not a
+///
+/// There is no key here and there cannot be. The Cloud API will name the SSH keys a project holds and
+/// hand over their public halves; the private halves have never been in Hetzner's hands. So an imported host
+/// authenticates with a key that was already in this keychain or it asks for a password, and the import
+/// screen says so rather than leaving somebody to find out at connect time.
+///
+///
+/// running , off , initializing and the rest. Shown on the row and deliberately not
+/// stored: it stays true for as long as it takes somebody to press a button in the Hetzner console.
+///
+/// network — Hetzner routes a whole /64 and the API reports the prefix, not an
+/// address. See cx22 , ccx13 — or null where the API did not say.
+/// fsn1 · Falkenstein, DE .
+/// key=value , sorted.
+public sealed record HetznerServer(
+ long Id,
+ string Name,
+ string Status,
+ string? PublicIPv4,
+ string? PublicIPv6Network,
+ IReadOnlyList PrivateAddresses,
+ string? ServerType,
+ string? Location,
+ string? Image,
+ IReadOnlyList Labels)
+{
+ /// Whether the API gave this server a public IPv4 address at all.
+ ///
+ /// Not a formality. Hetzner bills IPv4 separately now, and a project built since then can be entirely
+ /// IPv6-only — which is exactly the case an import that assumed a v4 would get silently wrong.
+ ///
+ public bool HasPublicIPv4 => PublicIPv4 is { Length: > 0 };
+
+ ///
+ /// The address inside the routed /64 that a stock Hetzner image actually answers on.
+ ///
+ ///
+ ///
+ /// This is a convention and not a fact the API stated , which is why every use of it carries a
+ /// warning. What the API reports is 2a01:4f8:1c17:d00::/64 — a network, which nothing can dial.
+ /// The address Hetzner's own images configure is the first one in it, and the console shows the same
+ /// thing; a server whose operator moved it elsewhere in the /64 will not answer here.
+ ///
+ ///
+ /// Computed by setting the low byte rather than by string surgery on the prefix, so a network the API
+ /// spells some other way still yields an address rather than a malformed string.
+ ///
+ ///
+ public string? FirstIPv6Address
+ {
+ get
+ {
+ if (PublicIPv6Network is not { Length: > 0 } network)
+ {
+ return null;
+ }
+
+ var slash = network.IndexOf('/', StringComparison.Ordinal);
+ var prefix = slash < 0 ? network : network[..slash];
+
+ if (!IPAddress.TryParse(prefix, out var parsed)
+ || parsed.AddressFamily != AddressFamily.InterNetworkV6)
+ {
+ return null;
+ }
+
+ var bytes = parsed.GetAddressBytes();
+ bytes[^1] = 1;
+
+ return new IPAddress(bytes).ToString();
+ }
+ }
+
+ ///
+ /// Settles on the address this server would be dialled at, or null where the choice has none to offer.
+ ///
+ ///
+ /// The two public choices fall back to each other and the private one does not, and that asymmetry is
+ /// deliberate. Falling back between v4 and v6 reaches the same machine over the same internet, so the
+ /// worst case is a route somebody did not pick; falling back from a private address to a public one
+ /// would put an address on the open internet into a bookmark that was asked to stay off it. So a server
+ /// with no private address is simply not importable under that choice, and the screen says which.
+ ///
+ public HetznerAddress? Resolve(HetznerAddressKind kind)
+ {
+ var six = FirstIPv6Address;
+
+ return kind switch
+ {
+ HetznerAddressKind.PublicIPv4 when HasPublicIPv4 => new(PublicIPv4!, null),
+ HetznerAddressKind.PublicIPv4 when six is not null => new(
+ six,
+ $"No public IPv4. This is the first address of {PublicIPv6Network}, which is where Hetzner's "
+ + "own images put the server — the API reports the network, not an address."),
+ HetznerAddressKind.PublicIPv6 when six is not null => new(
+ six,
+ $"The API reports {PublicIPv6Network} rather than an address. This is the first address in "
+ + "it, which is where Hetzner's own images put the server."),
+ HetznerAddressKind.PublicIPv6 when HasPublicIPv4 => new(
+ PublicIPv4!,
+ "No public IPv6 on this server, so this is its IPv4 address."),
+ HetznerAddressKind.Private when PrivateAddresses.Count > 1 => new(
+ PrivateAddresses[0],
+ $"On {PrivateAddresses.Count} private networks. This is the first the API listed."),
+ HetznerAddressKind.Private when PrivateAddresses.Count == 1 => new(PrivateAddresses[0], null),
+ _ => null,
+ };
+ }
+
+ /// Turns this into the host that would be stored.
+ ///
+ ///
+ /// Nothing here authenticates. There is no key to bring — see the remark on this record — so the
+ /// host arrives bound to nothing and asks for a password until somebody points it at a key already in
+ /// the keychain. That is the same shape an ssh_config import has with its key tick off, and it is
+ /// stated on the screen rather than discovered at connect time.
+ ///
+ ///
+ /// What goes in the notes is what does not go stale. The id, the plan, the location and the image
+ /// survive; the power state does not, so it is a column on the import screen and never a note. A note
+ /// saying "running" about a machine somebody switched off last March is worse than no note.
+ ///
+ ///
+ /// What the note says about where this came from, plus whatever the address had to assume.
+ private string Describe(HetznerAddress address)
+ {
+ var facts = new List { string.Create(CultureInfo.InvariantCulture, $"server {Id}") };
+
+ if (ServerType is { Length: > 0 } plan)
+ {
+ facts.Add(plan);
+ }
+
+ if (Location is { Length: > 0 } where)
+ {
+ facts.Add(where);
+ }
+
+ if (Image is { Length: > 0 } image)
+ {
+ facts.Add($"image {image}");
+ }
+
+ if (Labels.Count > 0)
+ {
+ facts.Add($"labels {string.Join(", ", Labels)}");
+ }
+
+ var sentence = $"Imported from Hetzner Cloud: {string.Join(", ", facts)}.";
+
+ return address.Warning is { Length: > 0 } warning ? $"{sentence} {warning}" : sentence;
+ }
+}
+
+///
+/// Everything a Hetzner Cloud project yielded: the servers it can offer, and what it could not.
+///
+/// Servers, IReadOnlyList Warnings);
diff --git a/src/DodoSSH.Client.Shell/ViewModels/HetznerImportViewModel.cs b/src/DodoSSH.Client.Shell/ViewModels/HetznerImportViewModel.cs
new file mode 100644
index 0000000..33a866a
--- /dev/null
+++ b/src/DodoSSH.Client.Shell/ViewModels/HetznerImportViewModel.cs
@@ -0,0 +1,646 @@
+using System.Collections.ObjectModel;
+using System.Globalization;
+using CommunityToolkit.Mvvm.ComponentModel;
+using CommunityToolkit.Mvvm.Input;
+using DodoSSH.Client.Import;
+
+namespace DodoSSH.Client.Shell.ViewModels;
+
+/// Which of the wizard's three steps is on screen.
+///
+/// A wizard rather than one screen, unlike ssh_config is free and local, so that screen scans the moment it opens and shows
+/// a list. This one cannot: it needs a credential the user has to go and make in somebody else's console,
+/// and it then makes a request over the internet. Those are two different moments, and a screen that mixed
+/// the token box in with the list would ask for the credential again every time somebody came back to look
+/// at the list.
+///
+internal enum HetznerImportStep
+{
+ /// Paste a token. Nothing has been sent yet.
+ Token = 0,
+
+ /// The project's servers, and what to do with them. Nothing has been stored yet.
+ Choose = 1,
+
+ /// What was stored.
+ Done = 2,
+}
+
+///
+/// One Hetzner server, as a row somebody decides about.
+///
+///
+/// The address is not a property of the server but of the server and the choice above the list , so
+/// it is pushed down by
+internal sealed partial class HetznerRowViewModel(HetznerServer server) : ObservableObject
+{
+ private HetznerAddress? resolved;
+
+ internal HetznerServer Server => server;
+
+ internal string Name => server.Name;
+
+ /// Whether it is running, off, or somewhere in between — a fact of the moment, never stored.
+ internal string Status => server.Status;
+
+ /// The plan and where it runs, as one cell.
+ internal string Kind => (server.ServerType, server.Location) switch
+ {
+ ({ Length: > 0 } plan, { Length: > 0 } place) => $"{plan} · {place}",
+ ({ Length: > 0 } plan, _) => plan,
+ (_, { Length: > 0 } place) => place,
+ _ => "—",
+ };
+
+ /// What this row would dial, or an em dash where the address choice leaves it nothing.
+ internal string Address => resolved?.Value ?? "—";
+
+ /// Whether the address choice above the list can reach this server at all.
+ ///
+ /// False is the private-network case: a server on no private network has no private address, and this
+ /// import will not quietly fall back to a public one. Such a row cannot be ticked, which is what stops
+ /// an import that was asked to stay off the internet from putting a public address in the keychain.
+ ///
+ internal bool CanImport => resolved is not null;
+
+ /// Whether the keychain already has a host pointing where this one would.
+ internal bool AlreadyPresent { get; private set; }
+
+ /// What had to be assumed to reach that address, if anything.
+ internal string Warning => resolved?.Warning ?? string.Empty;
+
+ internal bool HasWarning => resolved?.Warning is { Length: > 0 };
+
+ ///
+ /// The row's own chip: the single most actionable thing true about it.
+ ///
+ ///
+ /// Ordered by what a person has to do something about. "No address" means this row cannot be imported
+ /// at all and wins outright; a warning is a fact about where it will connect and wins over "already
+ /// here", which is only about whether it is worth ticking. Deliberately parallel to
+ /// ssh_config entry always has a hostname.
+ ///
+ internal string Meaning => (CanImport, HasWarning, AlreadyPresent) switch
+ {
+ (false, _, _) => "no address of that kind",
+ (_, true, _) => Warning,
+ (_, _, true) => "already here",
+ _ => "new host",
+ };
+
+ internal bool IsMeaningWarned => !CanImport || HasWarning;
+
+ internal bool IsMeaningExisting => CanImport && !HasWarning && AlreadyPresent;
+
+ internal bool IsMeaningNew => CanImport && !HasWarning && !AlreadyPresent;
+
+ /// The address, resolved, or null where there is none of the chosen kind.
+ internal HetznerAddress? Resolved => resolved;
+
+ [ObservableProperty]
+ private bool isSelected;
+
+ ///
+ /// Re-resolves this row against the address choice above the list.
+ ///
+ /// isAlreadyPresent,
+ bool resetSelection)
+ {
+ resolved = server.Resolve(kind);
+ AlreadyPresent = resolved is not null && isAlreadyPresent(resolved);
+
+ if (resetSelection)
+ {
+ // A server the keychain already points at starts unticked, exactly as the ssh_config import's
+ // rows do: importing it again is allowed — a second bookmark for one machine is a thing people
+ // want — but it should take a click rather than be the default.
+ IsSelected = CanImport && !AlreadyPresent;
+ }
+ else if (!CanImport)
+ {
+ IsSelected = false;
+ }
+
+ OnPropertyChanged(nameof(Address));
+ OnPropertyChanged(nameof(CanImport));
+ OnPropertyChanged(nameof(AlreadyPresent));
+ OnPropertyChanged(nameof(Warning));
+ OnPropertyChanged(nameof(HasWarning));
+ OnPropertyChanged(nameof(Meaning));
+ OnPropertyChanged(nameof(IsMeaningWarned));
+ OnPropertyChanged(nameof(IsMeaningExisting));
+ OnPropertyChanged(nameof(IsMeaningNew));
+ }
+}
+
+///
+/// Importing the servers in a Hetzner Cloud project.
+///
+///
+///
+/// Three steps, and the first two write nothing. Step one takes a token and sends one request; step
+/// two shows what the project holds and lets somebody choose; step three says what was stored. The split is
+/// the same argument
+///
+/// The token is never stored. It lives in
+///
+/// Nothing imported here authenticates. Hetzner has never held the private half of an SSH key, so
+/// every host arrives bound to nothing and asks for a password until somebody points it at a key already in
+/// the keychain. The screen says so before the button rather than leaving it to be discovered at connect
+/// time — see
+///
+internal sealed partial class HetznerImportViewModel(
+ VaultViewModel vault,
+ HetznerCloudClient hetzner,
+ Action? onCancel = null) : ObservableObject
+{
+ ///
+ /// The user a stock Hetzner Linux image logs in as.
+ ///
+ ///
+ /// Every image Hetzner publishes puts the project's SSH keys on root and no other account exists yet, so
+ /// this is right far more often than it is wrong — and where it is wrong, it is wrong for a whole
+ /// estate at once, which is why the box is above the list rather than on each row.
+ ///
+ internal const string DefaultUsername = "root";
+
+ internal ObservableCollection Rows { get; } = [];
+
+ /// What the project could not be made to say, at project level.
+ internal ObservableCollection Warnings { get; } = [];
+
+ [ObservableProperty]
+ private HetznerImportStep step = HetznerImportStep.Token;
+
+ ///
+ /// The Cloud API token, held only for as long as the wizard needs it.
+ ///
+ ///
+ /// A plain bound string, like the passphrase box on the unlock screen, and it carries the same caveat:
+ /// a .NET string cannot be zeroed, so what this really promises is that nothing here writes it anywhere
+ /// that outlives the process.
+ [ObservableProperty]
+ private string token = string.Empty;
+
+ [ObservableProperty]
+ private string status = string.Empty;
+
+ [ObservableProperty]
+ private bool isBusy;
+
+ /// The login user every imported host gets.
+ [ObservableProperty]
+ private string username = DefaultUsername;
+
+ ///
+ /// The SSH port, as typed.
+ ///
+ ///
+ /// A string rather than an int because a text box passes through "" and "2" on the way to "22", and a
+ /// bound int would either refuse the keystroke or silently substitute a number nobody typed. Parsed by
+ ///
+ [ObservableProperty]
+ private string portText = HetznerPort.ToString(CultureInfo.InvariantCulture);
+
+ private const int HetznerPort = 22;
+
+ [ObservableProperty]
+ private HetznerAddressKind addressKind = HetznerAddressKind.PublicIPv4;
+
+ internal bool IsTokenStep => Step is HetznerImportStep.Token;
+
+ internal bool IsChooseStep => Step is HetznerImportStep.Choose;
+
+ internal bool IsDoneStep => Step is HetznerImportStep.Done;
+
+ /// "Step 2 of 3", for the header — a wizard that does not say how long it is is a maze.
+ internal string StepLabel => $"STEP {(int)Step + 1} OF 3";
+
+ /// What this step is for, in the header, beside
+ internal string StepTitle => Step switch
+ {
+ HetznerImportStep.Token => "Connect to a project",
+ HetznerImportStep.Choose => "Choose what to import",
+ _ => "Imported",
+ };
+
+ ///
+ /// Which of the three address chips above the list is lit.
+ ///
+ ///
+ /// Read-only bools beside a command that sets the enum, rather than two-way bound ones, because the
+ /// control is a chip that runs HetznerImportScreen.axaml
+ /// for why chips rather than radio buttons, which this application has no style for.
+ ///
+ internal bool UsesPublicIPv4 => AddressKind is HetznerAddressKind.PublicIPv4;
+
+ /// What the chosen address means for the list, said once above it rather than per row.
+ internal string AddressNote => AddressKind switch
+ {
+ HetznerAddressKind.PublicIPv4 =>
+ "The public IPv4 address, which is how all but the cheapest Hetzner servers are reached. A "
+ + "server with no IPv4 falls back to its IPv6 and the row says so.",
+ HetznerAddressKind.PublicIPv6 =>
+ "The public IPv6 address. Hetzner routes a whole /64 and the API reports the network rather "
+ + "than an address, so this is the first address in it — where Hetzner's own images put "
+ + "the server, and not something the API states.",
+ _ =>
+ "The address on the server's own private network, which only reaches it from inside that "
+ + "network. Servers on no private network are not importable under this choice, and this "
+ + "will never quietly fall back to a public address.",
+ };
+
+ internal bool HasRows => Rows.Count > 0;
+
+ internal bool HasWarnings => Warnings.Count > 0;
+
+ /// The port every imported host gets, or null where what is typed is not one.
+ internal int? Port =>
+ int.TryParse(PortText, NumberStyles.None, CultureInfo.InvariantCulture, out var port)
+ && port is >= 1 and <= 65535
+ ? port
+ : null;
+
+ internal bool IsPortValid => Port is not null;
+
+ internal int SelectedCount => Rows.Count(row => row.IsSelected && row.CanImport);
+
+ internal string ImportLabel => SelectedCount == 1 ? "IMPORT 1 SERVER" : $"IMPORT {SelectedCount} SERVERS";
+
+ /// How many rows the address choice can actually reach.
+ internal int ImportableCount => Rows.Count(row => row.CanImport);
+
+ /// Whether every importable row is ticked — what the header's tick-all box shows.
+ internal bool AllTicked => ImportableCount > 0 && SelectedCount == ImportableCount;
+
+ /// Whether IMPORT would do anything.
+ internal bool CanImport => SelectedCount > 0 && IsPortValid && !IsBusy;
+
+ ///
+ /// The vault every import lands in — see
+ ///
+ /// Fixed rather than offered as a picker, exactly as the ssh_config importer's is: the import goes
+ /// through the same active vault every other bulk write does, and there is no per-import target to bind.
+ /// Printed as a fact instead of drawn as a dropdown.
+ ///
+ internal string VaultName => vault.VaultName;
+
+ /// How many ticked, out of how many, and where they land.
+ internal string SelectionSummary
+ {
+ get
+ {
+ var noun = Rows.Count == 1 ? "server" : "servers";
+
+ return $"{SelectedCount} of {Rows.Count} {noun} selected · saving to {VaultName}";
+ }
+ }
+
+ ///
+ /// The sentence that says an imported host will not connect on its own.
+ ///
+ ///
+ /// Said before the button rather than after, on exactly the reasoning ImportScreen.axaml gives
+ /// for its own version: whether the credential comes with the host is the difference between a bookmark
+ /// that connects and one that asks for a password, and somebody who is not told will conclude the
+ /// import was broken.
+ ///
+ internal static string AuthenticationNote =>
+ "Hetzner has never held the private half of an SSH key, so nothing here can bring one. A server "
+ + "imported this way arrives asking for a password until you bind it to a key already in your "
+ + "keychain — from the host's own editor, or in bulk from the Hosts screen.";
+
+ /// What the token step says about the token it is asking for.
+ ///
+ /// Three facts, each of which somebody would otherwise have to learn the hard way: a token is per
+ /// project rather than per account, read-only is enough, and nothing here keeps it. The first is the one
+ /// that surprises people — an account with four projects runs this four times, and a wizard that did not
+ /// say so would look like it had lost most of the estate.
+ ///
+ internal static string TokenNote =>
+ "A Cloud API token belongs to one project, so this imports one project's servers — an account with "
+ + "several runs this once per project. Make one in the Hetzner console under Security → API "
+ + "tokens; Read is the only permission this needs, and the token is used for a single request "
+ + "and then forgotten. Dedicated servers live behind Hetzner's Robot instead and are not "
+ + "covered here.";
+
+ /// Reads the project. Writes nothing, and forgets the token on the way out.
+ [RelayCommand]
+ private async Task ScanAsync(CancellationToken cancellationToken)
+ {
+ ClearRows();
+
+ IsBusy = true;
+
+ try
+ {
+ var import = await hetzner.ListServersAsync(Token, cancellationToken).ConfigureAwait(true);
+
+ foreach (var server in import.Servers)
+ {
+ var row = new HetznerRowViewModel(server);
+
+ // The footer counts ticks, so it has to hear about one. Subscribed here rather than bound
+ // from the item template, because a template binding cannot reach the list it is inside
+ // without a parent binding — and the count is on the parent by definition.
+ row.PropertyChanged += OnRowChanged;
+
+ Rows.Add(row);
+ }
+
+ foreach (var warning in import.Warnings)
+ {
+ Warnings.Add(warning);
+ }
+
+ Refresh(resetSelection: true);
+
+ if (Rows.Count == 0)
+ {
+ // Deliberately not an error, and deliberately not a step forward: an empty project is a
+ // real answer to a correct token, and a list screen with nothing on it says less than this.
+ Status = "That project has no servers in it.";
+ return;
+ }
+
+ Status = Rows.Count == 1
+ ? "Found 1 server. Nothing is stored until you press the button below."
+ : $"Found {Rows.Count} servers. Nothing is stored until you press the button below.";
+
+ Step = HetznerImportStep.Choose;
+ }
+ catch (HetznerCloudException failure)
+ {
+ // Stays on the token step, which is where the box is. See HetznerCloudException.IsTokenProblem
+ // for why a fault at Hetzner's end is worded differently from a refused token even though both
+ // land here: one of them is something the person reading this can act on.
+ Status = failure.Message;
+ }
+ finally
+ {
+ // Cleared whatever happened, including on the way to a list somebody is about to import from:
+ // the read is over and the token has no further use. A failed attempt clears it too, so a
+ // mistyped token is retyped rather than corrected in place — the lesser of the two annoyances
+ // against a credential sitting in a text box for the rest of the session.
+ Token = string.Empty;
+
+ IsBusy = false;
+ RaiseListState();
+ }
+ }
+
+ /// Stores the ticked servers as hosts.
+ [RelayCommand]
+ private async Task ImportAsync(CancellationToken cancellationToken)
+ {
+ if (Port is not { } port)
+ {
+ Status = "That is not a port. Give a number between 1 and 65535.";
+ return;
+ }
+
+ var chosen = Rows.Where(row => row.IsSelected && row.CanImport).ToList();
+
+ if (chosen.Count == 0)
+ {
+ Status = "Nothing is ticked.";
+ return;
+ }
+
+ IsBusy = true;
+
+ try
+ {
+ var requests = chosen
+ .Select(row => new ImportedHostRequest(
+ row.Server.ToSecret(row.Resolved!, Username, port),
+ Key: null,
+ KeyPath: null))
+ .ToList();
+
+ var outcome = await vault.ImportHostsAsync(requests, cancellationToken).ConfigureAwait(true);
+
+ // Re-resolved rather than cleared, so a row that was just imported now says "already here" —
+ // which is what makes coming back to the list and importing the rest of the project harmless
+ // and visible rather than harmless and confusing.
+ Refresh(resetSelection: true);
+
+ // This screen's own sentence rather than the vault's, which the push that follows an import
+ // overwrites with a sync report — right on a screen somebody is about to leave, wrong on the one
+ // they are still standing on.
+ Status = outcome.Hosts == 1
+ ? "Imported 1 server. It is on the Hosts screen, asking for a password until you bind it "
+ + "to a key."
+ : $"Imported {outcome.Hosts} servers. They are on the Hosts screen, asking for a password "
+ + "until you bind them to a key.";
+
+ Step = HetznerImportStep.Done;
+ }
+ finally
+ {
+ IsBusy = false;
+ RaiseListState();
+ }
+ }
+
+ /// Back to the token step, with the list dropped.
+ ///
+ /// The list goes because the token did. Nothing here can refresh what it is showing without asking for a
+ /// credential again, and a "back" that left forty rows on screen over a step that no longer has the
+ /// means to have produced them would be showing a list it cannot stand behind.
+ ///
+ [RelayCommand]
+ private void Restart()
+ {
+ ClearRows();
+ Status = string.Empty;
+ Step = HetznerImportStep.Token;
+ }
+
+ ///
+ /// Back from the last step to the list, with what was just stored marked as already here.
+ ///
+ ///
+ /// Unlike
+ [RelayCommand]
+ private void Review()
+ {
+ if (Rows.Count > 0)
+ {
+ Step = HetznerImportStep.Choose;
+ }
+ }
+
+ /// Points the whole import at one of the three kinds of address.
+ [RelayCommand]
+ private void UseAddress(HetznerAddressKind kind) => AddressKind = kind;
+
+ /// Ticks or unticks every importable row at once.
+ [RelayCommand]
+ private void ToggleAll()
+ {
+ var importable = Rows.Where(row => row.CanImport).ToList();
+ var target = SelectedCount < importable.Count;
+
+ foreach (var row in importable)
+ {
+ row.IsSelected = target;
+ }
+
+ RaiseListState();
+ }
+
+ /// The footer's Cancel button: back to the Preferences page, nothing stored.
+ ///
+ /// A delegate rather than a reference up to MainWindowViewModel , on the reasoning
+ ///
+ [RelayCommand]
+ private void Cancel() => onCancel?.Invoke();
+
+ /// Drops the list, unsubscribing from what it held.
+ ///
+ /// The detach matters: rows outlive the list only through this handler, and a scan run four times would
+ /// otherwise leave three sets of dead rows still calling into a live view model on every tick.
+ ///
+ private void ClearRows()
+ {
+ foreach (var row in Rows)
+ {
+ row.PropertyChanged -= OnRowChanged;
+ }
+
+ Rows.Clear();
+ Warnings.Clear();
+ RaiseListState();
+ }
+
+ ///
+ /// Only the tick moves the footer. Every other property on a row changes as part of a refresh this type
+ /// started, which already ends in
+ private void OnRowChanged(object? sender, System.ComponentModel.PropertyChangedEventArgs args)
+ {
+ if (string.Equals(args.PropertyName, nameof(HetznerRowViewModel.IsSelected), StringComparison.Ordinal))
+ {
+ RaiseListState();
+ }
+ }
+
+ /// Re-resolves every row against the current address choice.
+ private void Refresh(bool resetSelection)
+ {
+ foreach (var row in Rows)
+ {
+ row.Refresh(AddressKind, IsAlreadyPresent, resetSelection);
+ }
+
+ RaiseListState();
+ }
+
+ ///
+ /// Whether the keychain already holds a host that would dial where this one does.
+ ///
+ ///
+ /// Matched on address, port and user rather than on name, for the reason
+ /// resolved host so that a stored host inheriting its port
+ /// or user from a group still matches.
+ ///
+ private bool IsAlreadyPresent(HetznerAddress address) => vault.Hosts.Any(existing =>
+ string.Equals(existing.Host.Hostname, address.Value, StringComparison.OrdinalIgnoreCase)
+ && existing.Resolved.Port.Value == Port
+ && string.Equals(
+ existing.Resolved.Username.Value,
+ string.IsNullOrWhiteSpace(Username) ? null : Username.Trim(),
+ StringComparison.OrdinalIgnoreCase));
+
+ partial void OnStepChanged(HetznerImportStep value)
+ {
+ OnPropertyChanged(nameof(IsTokenStep));
+ OnPropertyChanged(nameof(IsChooseStep));
+ OnPropertyChanged(nameof(IsDoneStep));
+ OnPropertyChanged(nameof(StepLabel));
+ OnPropertyChanged(nameof(StepTitle));
+ }
+
+ partial void OnAddressKindChanged(HetznerAddressKind value)
+ {
+ OnPropertyChanged(nameof(UsesPublicIPv4));
+ OnPropertyChanged(nameof(UsesPublicIPv6));
+ OnPropertyChanged(nameof(UsesPrivate));
+ OnPropertyChanged(nameof(AddressNote));
+
+ Refresh(resetSelection: false);
+ }
+
+ ///
+ /// The user and the port are half of what "already here" is decided on, so changing either has to
+ /// re-ask the question — otherwise a row would go on claiming the keychain has it while the thing it
+ /// would now store is different.
+ ///
+ partial void OnUsernameChanged(string value) => Refresh(resetSelection: false);
+
+ /// Importing hosts from a Hetzner Cloud project.
+ ///
+ /// Reached from preferences and not from the nav rail, exactly as
+ HetznerImport = 11,
}
///
@@ -1030,6 +1041,10 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
[ObservableProperty]
private ImportViewModel? importScreen;
+ ///
- /// Whether the Preferences page itself, rather than the importer drawn over it, is what settings mode's
+ /// Whether the Hetzner wizard, rather than the ssh_config importer, is the one drawn over Preferences.
+ ///
+ ///
+ /// A second flag rather than a second value of one, because they are two independent facts about the
+ /// content column and a single "which importer" enum would have to carry a "neither" member that
+ ///
+ [ObservableProperty]
+ private bool isHetznerImportOpen;
+
+ ///
+ /// Whether either importer is up, which is the one thing the titlebar's back button cares about.
+ ///
+ ///
+ /// Both back out to the same place by the same command, so the bar asks this rather than asking twice.
+ /// See SettingsTitleBar.axaml .
+ ///
+ internal bool IsImporterOpen => IsImportOpen || IsHetznerImportOpen;
+
+ ///
+ /// Whether the Preferences page itself, rather than an importer drawn over it, is what settings mode's
/// content column shows.
///
- internal bool IsSettingsPreferencesContentShowing => IsSettingsPreferencesPage && !IsImportOpen;
+ internal bool IsSettingsPreferencesContentShowing => IsSettingsPreferencesPage && !IsImporterOpen;
partial void OnActiveSettingsPageChanged(SettingsPage? value)
{
@@ -1611,8 +1654,16 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
OnPropertyChanged(nameof(IsSettingsPreferencesContentShowing));
}
- partial void OnIsImportOpenChanged(bool value) =>
+ partial void OnIsImportOpenChanged(bool value) => RaiseImporterState();
+
+ /// Enters settings mode on a page, remembering where "Back to application" returns to.
///
@@ -1635,6 +1686,7 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
ActiveSettingsPage = page;
IsImportOpen = false;
+ IsHetznerImportOpen = false;
Screen = page switch
{
@@ -1656,9 +1708,32 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
IsImportOpen = true;
}
- /// "Back to preferences": closes the importer without leaving settings mode.
+ ///
+ /// Opens the Hetzner wizard over the Preferences page — the Preferences row's own button, and
+ ///
+ ///
+ /// Reopened from the first step each time rather than resumed where it was left, and that is a decision
+ /// rather than an omission: the wizard's first step holds a credential it deliberately does not keep, so
+ /// a "resumed" second step would be a list nothing on screen could refresh. See
+ ///
+ private void OpenHetznerImport()
+ {
+ EnterSettings(SettingsPage.Preferences);
+
+ HetznerImportScreen?.RestartCommand.Execute(null);
+
+ IsHetznerImportOpen = true;
+ }
+
+ /// "Back to preferences": closes whichever importer is up, without leaving settings mode.
[RelayCommand]
- private void CloseImport() => IsImportOpen = false;
+ private void CloseImport()
+ {
+ IsImportOpen = false;
+ IsHetznerImportOpen = false;
+ }
/// "Back to application": leaves settings mode for wherever it was entered from.
[RelayCommand]
@@ -1671,6 +1746,7 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
ActiveSettingsPage = null;
IsImportOpen = false;
+ IsHetznerImportOpen = false;
Screen = settingsReturnScreen;
Surface = settingsReturnSurface;
}
@@ -3553,6 +3629,12 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
? null
: new ImportViewModel(newValue, new SshConfigLocator(), CloseImport);
+ // Its own transport, built once with the vault rather than per scan: an HttpClient is meant to be
+ // long-lived, and this one goes exactly one place — see HetznerCloudClient.CloudApi.
+ HetznerImportScreen = newValue is null
+ ? null
+ : new HetznerImportViewModel(newValue, new HetznerCloudClient(), CloseImport);
+
SnippetsScreen?.Detach();
SnippetsScreen = newValue is null
? null
diff --git a/tests/DodoSSH.Client.App.Layout.Tests/SettingsPagesLayoutTests.cs b/tests/DodoSSH.Client.App.Layout.Tests/SettingsPagesLayoutTests.cs
index 910c0a7..7c1af73 100644
--- a/tests/DodoSSH.Client.App.Layout.Tests/SettingsPagesLayoutTests.cs
+++ b/tests/DodoSSH.Client.App.Layout.Tests/SettingsPagesLayoutTests.cs
@@ -416,6 +416,32 @@ public sealed class SettingsPagesLayoutTests : IAsyncLifetime
await ScannedImportAsync());
}
+ // ---- The Hetzner wizard ----
+ //
+ // Measured against the same SettingsContentWidth/SettingsContentHeight budget, because it is drawn in
+ // the same content column over the same Preferences page — see MainWindowViewModel.IsHetznerImportOpen.
+ // Two shapes, because the two steps are different layouts rather than one with a section hidden: the
+ // token step is a card, and the choose step is a table with an options card above it and a footer below.
+
+ [Fact]
+ public async Task TheHetznerWizardFitsOnTheStepItOpensOn()
+ {
+ await MeasureHetznerAsync(faults => faults.ShouldBeEmpty("the token step"));
+ }
+
+ ///
+ /// The shape with something to decide about, and the two rows that must not be pushed off the bottom are
+ /// the sentence saying no key comes with these hosts and the IMPORT button under it — the same pair
+ ///
+ [Fact]
+ public async Task TheHetznerWizardFitsWithServersToChooseFromAndWarnings()
+ {
+ await MeasureHetznerAsync(
+ faults => faults.ShouldBeEmpty("with a scanned project"),
+ await ScannedHetznerAsync());
+ }
+
// ---- Helpers ----
///
@@ -538,4 +564,93 @@ public sealed class SettingsPagesLayoutTests : IAsyncLifetime
Directory.Delete(directory, recursive: true);
}
}
+
+ /// > assert,
+ HetznerImportViewModel? wizard = null) =>
+ LayoutHarness.OnTheUiThreadAsync(
+ () =>
+ {
+ var screen = new HetznerImportScreen
+ {
+ DataContext = wizard ?? new HetznerImportViewModel(vault, new HetznerCloudClient()),
+ };
+
+ var window = LayoutHarness.HostAtMinimumSize(
+ screen, LayoutHarness.SettingsContentWidth, LayoutHarness.SettingsContentHeight);
+
+ try
+ {
+ assert(LayoutHarness.Unreachable(window));
+ }
+ finally
+ {
+ window.Close();
+ }
+ },
+ Token);
+
+ ///
+ /// A wizard that has read a project, so the table has rows in it.
+ ///
+ ///
+ /// Through the real client over a stubbed transport rather than by populating the rows directly, on the
+ /// reasoning
+ private async Task ScannedHetznerAsync()
+ {
+ var http = new HttpClient(new StubHetzner("""
+ {
+ "servers": [
+ {
+ "id": 1,
+ "name": "web-01",
+ "status": "running",
+ "public_net": { "ipv4": { "ip": "203.0.113.10" } },
+ "server_type": { "name": "cx22" },
+ "datacenter": { "location": { "name": "fsn1", "city": "Falkenstein", "country": "DE" } },
+ "image": { "name": "ubuntu-24.04" }
+ },
+ {
+ "id": 2,
+ "name": "edge-v6",
+ "status": "off",
+ "public_net": { "ipv6": { "ip": "2a01:4f8:1c17:d00::/64" } },
+ "server_type": { "name": "cax11" },
+ "datacenter": { "location": { "name": "hel1", "city": "Helsinki", "country": "FI" } }
+ },
+ { "id": 3, "status": "initializing" }
+ ],
+ "meta": { "pagination": { "page": 1, "per_page": 50, "next_page": null } }
+ }
+ """));
+
+ var wizard = new HetznerImportViewModel(vault, new HetznerCloudClient(http))
+ {
+ Token = "abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789",
+ };
+
+ await wizard.ScanCommand.ExecuteAsync(null);
+
+ wizard.HasRows.ShouldBeTrue("the fixture has servers in it");
+ wizard.HasWarnings.ShouldBeTrue("the fixture has a server the API left unnamed");
+
+ return wizard;
+ }
+
+ /// Answers anything asked of it with one page. There is no sequence to model here.
+ private sealed class StubHetzner(string body) : HttpMessageHandler
+ {
+ protected override Task SendAsync(
+ HttpRequestMessage request,
+ CancellationToken cancellationToken) =>
+ Task.FromResult(new HttpResponseMessage(System.Net.HttpStatusCode.OK)
+ {
+ Content = new StringContent(body, System.Text.Encoding.UTF8, "application/json"),
+ });
+ }
}
diff --git a/tests/DodoSSH.Client.App.Tests/ShellFlowTests.Hetzner.cs b/tests/DodoSSH.Client.App.Tests/ShellFlowTests.Hetzner.cs
new file mode 100644
index 0000000..a23deb9
--- /dev/null
+++ b/tests/DodoSSH.Client.App.Tests/ShellFlowTests.Hetzner.cs
@@ -0,0 +1,445 @@
+using System.Net;
+using System.Text;
+using DodoSSH.Client.Import;
+using DodoSSH.Client.Shell.ViewModels;
+
+namespace DodoSSH.Client.App.Tests;
+
+///
+/// The Hetzner Cloud wizard, from a token to hosts on the server.
+///
+///
+///
+/// What this establishes beyond HetznerCloudClientTests is the half that suite cannot reach: that
+/// reading a project stores nothing, that importing goes through the ordinary create-and-push path every
+/// other write uses, that a server the keychain already points at arrives unticked rather than silently
+/// duplicated, and that the token does not outlive the request it was typed for.
+///
+///
+/// Hetzner is a stubbed HttpMessageHandler . Everything else — the vault, the cache, the server — is
+/// this fixture's real one, which is the point: the assertion that matters most is that the imported hosts
+/// reached the server without anything pressing Sync.
+///
+///
+public sealed partial class ShellFlowTests
+{
+ private const string HetznerToken =
+ "abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789";
+
+ ///
+ /// The whole wizard.
+ ///
+ ///
+ /// One server already in the keychain and one not, so the two halves of the default are both exercised:
+ /// the new one arrives ticked, the known one does not, and only the ticked one is stored.
+ ///
+ [Fact]
+ public async Task ImportingFromHetzner_ShowsTheProjectFirstAndThenStoresWhatWasTicked()
+ {
+ await UnlockedAsync();
+ var vault = shell.Vault!;
+
+ // db.internal:deploy is what AddHostAsync creates, so the first server is one the keychain has.
+ await AddHostAsync(vault, "prod-db");
+
+ var wizard = Wizard(Project("""
+ {
+ "id": 1,
+ "name": "already-here",
+ "status": "running",
+ "public_net": { "ipv4": { "ip": "db.internal" } }
+ }
+ """,
+ """
+ {
+ "id": 2,
+ "name": "web-01",
+ "status": "running",
+ "public_net": { "ipv4": { "ip": "203.0.113.10" } },
+ "server_type": { "name": "cx22" },
+ "datacenter": { "name": "fsn1-dc14", "location": { "name": "fsn1", "city": "Falkenstein", "country": "DE" } },
+ "image": { "name": "ubuntu-24.04" }
+ }
+ """));
+
+ wizard.Step.ShouldBe(HetznerImportStep.Token, "it opens on the box, having sent nothing");
+
+ wizard.Token = HetznerToken;
+ wizard.Username = "deploy";
+
+ await wizard.ScanCommand.ExecuteAsync(null);
+
+ wizard.Step.ShouldBe(HetznerImportStep.Choose);
+ wizard.Rows.Count.ShouldBe(2);
+ vault.Hosts.Count.ShouldBe(1, "reading the project stores nothing");
+
+ var known = wizard.Rows.Single(row => string.Equals(row.Name, "already-here", StringComparison.Ordinal));
+
+ known.AlreadyPresent.ShouldBeTrue("it points at a machine the keychain already has");
+ known.IsSelected.ShouldBeFalse("a duplicate takes a click rather than being the default");
+
+ var fresh = wizard.Rows.Single(row => string.Equals(row.Name, "web-01", StringComparison.Ordinal));
+
+ fresh.IsSelected.ShouldBeTrue();
+ fresh.Address.ShouldBe("203.0.113.10");
+
+ await wizard.ImportCommand.ExecuteAsync(null);
+
+ wizard.Step.ShouldBe(HetznerImportStep.Done);
+
+ var imported = vault.Hosts.Single(row => string.Equals(row.Label, "web-01", StringComparison.Ordinal));
+
+ imported.Address.ShouldBe("deploy@203.0.113.10:22");
+ imported.Host.SshKeyId.ShouldBeNull("Hetzner has no private key to hand over");
+ imported.Host.Notes.ShouldNotBeNull().ShouldContain("cx22");
+
+ vault.Hosts.Count.ShouldBe(2, "only the ticked one was stored");
+
+ // Through the ordinary path, which is the point of routing it through the vault: it reached the
+ // server without anything pressing Sync.
+ server.LiveRowCount.ShouldBe(2);
+ }
+
+ ///
+ /// The token does not outlive the request it was typed for.
+ ///
+ ///
+ /// This is the whole of what makes pasting a credential capable of listing somebody's estate into a text
+ /// box acceptable: it is used once and dropped. Asserted on the success path deliberately — a wizard
+ /// that cleared the box only when something went wrong would leave the token sitting there for the
+ /// entire time somebody spends reading a list of forty servers.
+ ///
+ [Fact]
+ public async Task TheTokenIsForgottenAsSoonAsTheProjectHasBeenRead()
+ {
+ await UnlockedAsync();
+
+ var wizard = Wizard(Project(WebServer));
+
+ wizard.Token = HetznerToken;
+
+ await wizard.ScanCommand.ExecuteAsync(null);
+
+ wizard.Token.ShouldBeEmpty();
+ wizard.Rows.ShouldHaveSingleItem();
+ }
+
+ ///
+ /// A refused token is the failure this meets most often, and the recovery is to type a different one —
+ /// so it stays on the step that has the box, with a message that says where tokens come from.
+ ///
+ [Fact]
+ public async Task ARefusedToken_StaysOnTheTokenStepAndStoresNothing()
+ {
+ await UnlockedAsync();
+
+ var wizard = Wizard(new StubHetznerResponse(
+ HttpStatusCode.Unauthorized,
+ """{ "error": { "code": "unauthorized", "message": "unable to authenticate" } }"""));
+
+ wizard.Token = HetznerToken;
+
+ await wizard.ScanCommand.ExecuteAsync(null);
+
+ wizard.Step.ShouldBe(HetznerImportStep.Token);
+ wizard.Status.ShouldContain("API tokens");
+ wizard.Rows.ShouldBeEmpty();
+ wizard.Token.ShouldBeEmpty("a refused token is retyped rather than corrected in place");
+ shell.Vault!.Hosts.ShouldBeEmpty();
+ }
+
+ ///
+ /// An empty project is a correct answer to a correct token, so it is not an error — and it is not a step
+ /// forward either, because a list screen with nothing on it says less than the sentence does.
+ ///
+ [Fact]
+ public async Task AnEmptyProject_SaysSoWithoutMovingOn()
+ {
+ await UnlockedAsync();
+
+ var wizard = Wizard(Project());
+
+ wizard.Token = HetznerToken;
+
+ await wizard.ScanCommand.ExecuteAsync(null);
+
+ wizard.Step.ShouldBe(HetznerImportStep.Token);
+ wizard.Status.ShouldContain("no servers");
+ }
+
+ ///
+ /// Choosing the private network does not quietly put a public address in the keychain.
+ ///
+ ///
+ /// The one asymmetry in how addresses resolve, and the reason for it: falling back between v4 and v6
+ /// reaches the same machine over the same internet, where falling back from a private address to a
+ /// public one would put an address on the open internet into a bookmark that was asked to stay off it.
+ /// So the row loses its tick and cannot get it back while that choice stands.
+ ///
+ [Fact]
+ public async Task ChoosingThePrivateNetwork_LeavesAServerWithoutOneUnimportable()
+ {
+ await UnlockedAsync();
+
+ var wizard = Wizard(Project(WebServer, """
+ {
+ "id": 3,
+ "name": "db-01",
+ "status": "running",
+ "public_net": { "ipv4": { "ip": "203.0.113.20" } },
+ "private_net": [ { "ip": "10.0.0.4" } ]
+ }
+ """));
+
+ wizard.Token = HetznerToken;
+
+ await wizard.ScanCommand.ExecuteAsync(null);
+
+ wizard.SelectedCount.ShouldBe(2);
+
+ wizard.UseAddressCommand.Execute(HetznerAddressKind.Private);
+
+ var public_ = wizard.Rows.Single(row => string.Equals(row.Name, "web-01", StringComparison.Ordinal));
+ var inside = wizard.Rows.Single(row => string.Equals(row.Name, "db-01", StringComparison.Ordinal));
+
+ public_.CanImport.ShouldBeFalse("it is on no private network");
+ public_.IsSelected.ShouldBeFalse();
+ public_.Address.ShouldBe("—");
+
+ inside.CanImport.ShouldBeTrue();
+ inside.Address.ShouldBe("10.0.0.4");
+
+ wizard.SelectedCount.ShouldBe(1);
+
+ // Neither direction of "tick everything" can reach it, which is what "not importable" has to mean.
+ wizard.ToggleAllCommand.Execute(null);
+
+ public_.IsSelected.ShouldBeFalse();
+ inside.IsSelected.ShouldBeFalse("that press was the untick, since everything reachable was ticked");
+
+ wizard.ToggleAllCommand.Execute(null);
+
+ public_.IsSelected.ShouldBeFalse();
+ inside.IsSelected.ShouldBeTrue();
+
+ await wizard.ImportCommand.ExecuteAsync(null);
+
+ shell.Vault!.Hosts.ShouldHaveSingleItem().Host.Hostname.ShouldBe("10.0.0.4");
+ }
+
+ ///
+ /// Changing the address choice must not throw away ticks somebody set — but changing the login user has
+ /// to re-ask "is this already here", because the user is half of what that is decided on.
+ ///
+ [Fact]
+ public async Task ChangingTheLoginUser_ReasksWhetherTheKeychainAlreadyHasIt()
+ {
+ await UnlockedAsync();
+ var vault = shell.Vault!;
+
+ await AddHostAsync(vault, "prod-db");
+
+ var wizard = Wizard(Project("""
+ {
+ "id": 1,
+ "name": "db",
+ "status": "running",
+ "public_net": { "ipv4": { "ip": "db.internal" } }
+ }
+ """));
+
+ wizard.Token = HetznerToken;
+ wizard.Username = "deploy";
+
+ await wizard.ScanCommand.ExecuteAsync(null);
+
+ wizard.Rows.ShouldHaveSingleItem().AlreadyPresent.ShouldBeTrue();
+
+ wizard.Username = "ubuntu";
+
+ wizard.Rows[0].AlreadyPresent.ShouldBeFalse("a different account on that machine is a different host");
+ }
+
+ ///
+ /// A server with no public IPv4 still imports, and the row says what was assumed to reach it.
+ ///
+ ///
+ /// IPv6-only is a whole Hetzner price tier rather than an edge case. The address is the first in the
+ /// routed /64 — the API reports a network, which nothing can dial — and that is a convention of
+ /// Hetzner's own images rather than a fact, so it is on the row and in the stored note.
+ ///
+ [Fact]
+ public async Task AnIPv6OnlyServer_ImportsWithWhatWasAssumedWrittenDown()
+ {
+ await UnlockedAsync();
+
+ var wizard = Wizard(Project("""
+ {
+ "id": 5,
+ "name": "v6-only",
+ "status": "running",
+ "public_net": { "ipv4": null, "ipv6": { "ip": "2a01:4f8:1c17:d00::/64" } }
+ }
+ """));
+
+ wizard.Token = HetznerToken;
+
+ await wizard.ScanCommand.ExecuteAsync(null);
+
+ var row = wizard.Rows.ShouldHaveSingleItem();
+
+ row.Address.ShouldBe("2a01:4f8:1c17:d00::1");
+ row.HasWarning.ShouldBeTrue();
+ row.Meaning.ShouldContain("No public IPv4");
+
+ await wizard.ImportCommand.ExecuteAsync(null);
+
+ var host = shell.Vault!.Hosts.ShouldHaveSingleItem();
+
+ host.Host.Hostname.ShouldBe("2a01:4f8:1c17:d00::1");
+ host.Host.Notes.ShouldNotBeNull().ShouldContain("No public IPv4");
+ }
+
+ ///
+ /// After an import the list is asked again rather than cleared, so a row that was just stored says
+ /// "already here" — which is what makes coming back and importing the rest of the project harmless and
+ /// visible rather than harmless and confusing.
+ ///
+ [Fact]
+ public async Task AfterImporting_TheListSaysWhichOnesAreNowHere()
+ {
+ await UnlockedAsync();
+
+ var wizard = Wizard(Project(WebServer));
+
+ wizard.Token = HetznerToken;
+
+ await wizard.ScanCommand.ExecuteAsync(null);
+ await wizard.ImportCommand.ExecuteAsync(null);
+
+ wizard.ReviewCommand.Execute(null);
+
+ wizard.Step.ShouldBe(HetznerImportStep.Choose);
+
+ var row = wizard.Rows.ShouldHaveSingleItem();
+
+ row.AlreadyPresent.ShouldBeTrue();
+ row.IsSelected.ShouldBeFalse("importing it twice takes a click");
+ }
+
+ // ---- Where it lives in the shell ----
+
+ ///
+ /// The wizard is drawn over the Preferences page inside settings mode, exactly as the ssh_config
+ /// importer is: the nav stays lit on Preferences and the titlebar offers "Back to preferences". What
+ /// would silently come apart is the content column — two importers and one page beneath them.
+ ///
+ [Fact]
+ public async Task TheHetznerWizardOpensOverPreferencesAndBacksOutToIt()
+ {
+ await UnlockedAsync();
+
+ shell.ShowScreenCommand.Execute(ShellScreen.HetznerImport);
+
+ shell.IsHetznerImportOpen.ShouldBeTrue();
+ shell.IsImporterOpen.ShouldBeTrue("the titlebar's back button asks this one");
+ shell.IsSettingsPreferencesPage.ShouldBeTrue("the nav stays lit on Preferences");
+ shell.IsSettingsPreferencesContentShowing.ShouldBeFalse("the wizard is what the column draws");
+
+ shell.CloseImportCommand.Execute(null);
+
+ shell.IsHetznerImportOpen.ShouldBeFalse();
+ shell.IsSettingsMode.ShouldBeTrue("back to preferences, not out of settings");
+ shell.IsSettingsPreferencesContentShowing.ShouldBeTrue();
+ }
+
+ ///
+ /// Opening one closes the other. They share a content column, and two importers drawn over each other
+ /// would leave whichever was on top looking like the one the back button belongs to.
+ ///
+ [Fact]
+ public async Task OpeningOneImporterClosesTheOther()
+ {
+ await UnlockedAsync();
+
+ shell.ShowScreenCommand.Execute(ShellScreen.Import);
+ shell.IsImportOpen.ShouldBeTrue();
+
+ shell.ShowScreenCommand.Execute(ShellScreen.HetznerImport);
+
+ shell.IsImportOpen.ShouldBeFalse();
+ shell.IsHetznerImportOpen.ShouldBeTrue();
+
+ shell.ShowScreenCommand.Execute(ShellScreen.Import);
+
+ shell.IsHetznerImportOpen.ShouldBeFalse();
+ shell.IsImportOpen.ShouldBeTrue();
+ }
+
+ ///
+ /// Reopening the wizard puts it back on step one.
+ ///
+ ///
+ /// A decision rather than an omission. The first step holds a credential this deliberately does not
+ /// keep, so a "resumed" second step would be a list nothing on screen has the means to refresh — and it
+ /// would go on looking current for as long as somebody left the application open.
+ ///
+ [Fact]
+ public async Task ReopeningTheWizard_StartsAtTheTokenAgain()
+ {
+ await UnlockedAsync();
+
+ var wizard = shell.HetznerImportScreen.ShouldNotBeNull();
+
+ // Driven through the shell's own view model rather than the one this file builds, because what is
+ // being checked is what OpenHetznerImport does to the screen the shell is holding.
+ wizard.Token = HetznerToken;
+ wizard.Step = HetznerImportStep.Choose;
+
+ shell.ShowScreenCommand.Execute(ShellScreen.HetznerImport);
+
+ wizard.Step.ShouldBe(HetznerImportStep.Token);
+ wizard.Rows.ShouldBeEmpty();
+ }
+
+ // ---- Helpers ----
+
+ /// A server carrying enough to be imported, used wherever the shape is not what is being tested.
+ private const string WebServer = """
+ {
+ "id": 2,
+ "name": "web-01",
+ "status": "running",
+ "public_net": { "ipv4": { "ip": "203.0.113.10" } }
+ }
+ """;
+
+ /// The wizard, over a Hetzner that answers with exactly this.
+ private HetznerImportViewModel Wizard(StubHetznerResponse response) =>
+ new(shell.Vault!, new HetznerCloudClient(new HttpClient(new StubHetzner(response))));
+
+ /// One page holding these servers and saying there are no more.
+ private static StubHetznerResponse Project(params string[] servers) =>
+ new(
+ HttpStatusCode.OK,
+ $$"""
+ {
+ "servers": [ {{string.Join(",", servers)}} ],
+ "meta": { "pagination": { "page": 1, "per_page": 50, "next_page": null } }
+ }
+ """);
+
+ private sealed record StubHetznerResponse(HttpStatusCode Status, string Body);
+
+ /// Answers every request the same way. What varies between these tests is the body, not the sequence.
+ private sealed class StubHetzner(StubHetznerResponse response) : HttpMessageHandler
+ {
+ protected override Task SendAsync(
+ HttpRequestMessage request,
+ CancellationToken cancellationToken) =>
+ Task.FromResult(new HttpResponseMessage(response.Status)
+ {
+ Content = new StringContent(response.Body, Encoding.UTF8, "application/json"),
+ });
+ }
+}
diff --git a/tests/DodoSSH.Client.App.Tests/ShellFlowTests.cs b/tests/DodoSSH.Client.App.Tests/ShellFlowTests.cs
index 057d859..e505a0b 100644
--- a/tests/DodoSSH.Client.App.Tests/ShellFlowTests.cs
+++ b/tests/DodoSSH.Client.App.Tests/ShellFlowTests.cs
@@ -26,7 +26,12 @@ namespace DodoSSH.Client.App.Tests;
/// wrong — the one that must not be skipped, and the one that has to work offline — are checked by a test
/// rather than by remembering to click through them.
///
-public sealed class ShellFlowTests : IAsyncLifetime
+///
+/// Split across two files rather than one: the Hetzner wizard's own path is in
+/// ShellFlowTests.Hetzner.cs , which needs this fixture's unlocked vault and nothing else of it. The
+/// same reason FakeVaultServer keeps its team endpoints in a file of their own.
+///
+public sealed partial class ShellFlowTests : IAsyncLifetime
{
private const string Passphrase = "a sufficiently long passphrase";
diff --git a/tests/DodoSSH.Client.Import.Tests/DodoSSH.Client.Import.Tests.csproj b/tests/DodoSSH.Client.Import.Tests/DodoSSH.Client.Import.Tests.csproj
index c989bff..61f7911 100644
--- a/tests/DodoSSH.Client.Import.Tests/DodoSSH.Client.Import.Tests.csproj
+++ b/tests/DodoSSH.Client.Import.Tests/DodoSSH.Client.Import.Tests.csproj
@@ -1,9 +1,15 @@
diff --git a/tests/DodoSSH.Client.Import.Tests/HetznerCloudClientTests.cs b/tests/DodoSSH.Client.Import.Tests/HetznerCloudClientTests.cs
new file mode 100644
index 0000000..6a9b3ad
--- /dev/null
+++ b/tests/DodoSSH.Client.Import.Tests/HetznerCloudClientTests.cs
@@ -0,0 +1,416 @@
+using System.Net;
+using System.Text;
+using DodoSSH.Client.Import;
+
+namespace DodoSSH.Client.Import.Tests;
+
+///
+/// Reading a Hetzner Cloud project, against a stubbed transport.
+///
+///
+///
+/// No socket, for the reason LinuxUpdateChannelTests gives: every question here is what this client
+/// decides from what Hetzner said, and a real request would add an account, a token and a network to the
+/// assertions without adding anything to what is being checked.
+///
+///
+/// The bodies are real shapes rather than minimal ones. An importer's whole value is agreeing with the
+/// source about what it means — the IPv6 field holding a network rather than an address, and a server that
+/// has no IPv4 at all, are both ordinary in a Hetzner project and both are exactly where an importer that
+/// was nearly right would produce bookmarks that nearly connect.
+///
+///
+public sealed class HetznerCloudClientTests
+{
+ private const string Token = "abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789";
+
+ private static CancellationToken Cancellation => TestContext.Current.CancellationToken;
+
+ [Fact]
+ public async Task APageOfServers_ArrivesWithWhatTheProjectSaidAboutThem()
+ {
+ var import = await ReadAsync(OnePage(OneServer));
+
+ var server = import.Servers.ShouldHaveSingleItem();
+
+ server.Id.ShouldBe(42);
+ server.Name.ShouldBe("web-01");
+ server.Status.ShouldBe("running");
+ server.PublicIPv4.ShouldBe("203.0.113.10");
+ server.ServerType.ShouldBe("cx22");
+ server.Location.ShouldBe("fsn1 · Falkenstein, DE");
+ server.Image.ShouldBe("ubuntu-24.04");
+ server.Labels.ShouldBe(["env=prod", "role=web"]);
+ import.Warnings.ShouldBeEmpty();
+ }
+
+ ///
+ /// The token goes in an Authorization: Bearer header and nowhere else — never a query parameter,
+ /// which is the shape that ends up in somebody's proxy log.
+ ///
+ [Fact]
+ public async Task TheTokenTravelsAsABearerHeader()
+ {
+ var stub = new StubHetzner([OnePage(OneServer)]);
+
+ await new HetznerCloudClient(new HttpClient(stub)).ListServersAsync(Token, Cancellation);
+
+ var request = stub.Requests.ShouldHaveSingleItem();
+
+ request.Authorization.ShouldBe($"Bearer {Token}");
+ request.Uri.ShouldNotContain(Token);
+ request.Uri.ShouldContain("per_page=50");
+ }
+
+ ///
+ /// Every page is followed, which is what keeps a short list from looking like a complete one.
+ ///
+ ///
+ /// Fifty-one servers in a project is enough to meet this, and an importer that showed the first fifty
+ /// would present a list nobody has any reason to doubt.
+ ///
+ [Fact]
+ public async Task EveryPageIsFollowed()
+ {
+ var stub = new StubHetzner([
+ Page(nextPage: 2, """{ "id": 1, "name": "web-01" }"""),
+ Page(nextPage: 3, """{ "id": 2, "name": "web-02" }"""),
+ Page(nextPage: null, """{ "id": 3, "name": "web-03" }"""),
+ ]);
+
+ var import = await new HetznerCloudClient(new HttpClient(stub))
+ .ListServersAsync(Token, Cancellation);
+
+ import.Servers.Select(server => server.Name).ShouldBe(["web-01", "web-02", "web-03"]);
+ stub.Requests.Select(request => request.Uri).ShouldAllBe(uri => uri.Contains("page="));
+ stub.Requests.Count.ShouldBe(3);
+ }
+
+ ///
+ /// A refused token is the failure this wizard meets most, because the value is shown once in the Hetzner
+ /// console and a half-copied one fails exactly like a wrong one. So the message says where tokens come
+ /// from, and IsTokenProblem is what sends the wizard back to the step that has the box.
+ ///
+ [Fact]
+ public async Task ARefusedToken_SaysWhereTokensComeFromAndIsMarkedAsTheTokensFault()
+ {
+ var stub = new StubHetzner([
+ new StubResponse(
+ HttpStatusCode.Unauthorized,
+ """{ "error": { "code": "unauthorized", "message": "unable to authenticate" } }"""),
+ ]);
+
+ var failure = await Should.ThrowAsync(
+ () => new HetznerCloudClient(new HttpClient(stub)).ListServersAsync(Token, Cancellation));
+
+ failure.IsTokenProblem.ShouldBeTrue();
+ failure.Code.ShouldBe("unauthorized");
+ failure.Message.ShouldContain("API tokens");
+ failure.Message.ShouldContain("unable to authenticate", Case.Insensitive);
+ }
+
+ ///
+ /// The other half of that split: Hetzner having a bad minute is not a reason to send somebody back to
+ /// re-type a token that was fine.
+ ///
+ [Fact]
+ public async Task AFaultAtHetznersEnd_IsNotTheTokensFault()
+ {
+ var stub = new StubHetzner([new StubResponse(HttpStatusCode.BadGateway, "nope")]);
+
+ var failure = await Should.ThrowAsync(
+ () => new HetznerCloudClient(new HttpClient(stub)).ListServersAsync(Token, Cancellation));
+
+ failure.IsTokenProblem.ShouldBeFalse();
+ failure.Message.ShouldContain("502");
+ }
+
+ ///
+ /// Refused before anything is sent, because a header value carrying a line break throws from inside
+ /// HttpClient — a stack trace where the honest answer is a sentence.
+ ///
+ [Fact]
+ public async Task ATokenWithALineBreakInTheMiddle_IsRefusedWithoutAskingHetzner()
+ {
+ var stub = new StubHetzner([OnePage(OneServer)]);
+
+ var failure = await Should.ThrowAsync(
+ () => new HetznerCloudClient(new HttpClient(stub))
+ .ListServersAsync("abcdef\n0123456789", Cancellation));
+
+ failure.Message.ShouldContain("64 letters and digits");
+ stub.Requests.ShouldBeEmpty();
+ }
+
+ /// Pasting out of the console brings a trailing newline often enough to be worth handling.
+ [Fact]
+ public async Task ATokenPastedWithSurroundingWhitespace_IsTrimmedRatherThanRefused()
+ {
+ var stub = new StubHetzner([OnePage(OneServer)]);
+
+ await new HetznerCloudClient(new HttpClient(stub)).ListServersAsync($" {Token}\n", Cancellation);
+
+ stub.Requests.ShouldHaveSingleItem().Authorization.ShouldBe($"Bearer {Token}");
+ }
+
+ ///
+ /// A server with no IPv4 at all, which is a whole Hetzner price tier rather than an edge case.
+ ///
+ ///
+ /// Two things are being checked and the second is the one that matters. The address is the first in the
+ /// routed /64, because what the API reports is a network and nothing can dial a network. And it carries
+ /// a warning, because that address is a convention of Hetzner's own images rather than a fact the API
+ /// stated — an import that silently guessed would produce a bookmark that fails to connect with no
+ /// indication of why.
+ ///
+ [Fact]
+ public async Task AServerWithNoIPv4_DialsTheFirstAddressOfItsSixtyFourAndSaysSo()
+ {
+ var import = await ReadAsync(OnePage("""
+ {
+ "id": 7,
+ "name": "v6-only",
+ "status": "running",
+ "public_net": {
+ "ipv4": null,
+ "ipv6": { "ip": "2a01:4f8:1c17:d00::/64" }
+ }
+ }
+ """));
+
+ var server = import.Servers.ShouldHaveSingleItem();
+
+ server.HasPublicIPv4.ShouldBeFalse();
+ server.FirstIPv6Address.ShouldBe("2a01:4f8:1c17:d00::1");
+
+ var address = server.Resolve(HetznerAddressKind.PublicIPv4).ShouldNotBeNull();
+
+ address.Value.ShouldBe("2a01:4f8:1c17:d00::1");
+ address.Warning.ShouldNotBeNull().ShouldContain("No public IPv4");
+ }
+
+ ///
+ /// The v6 choice warns even where it is the one that was asked for, on the same reasoning: the address
+ /// is inferred from a network either way.
+ ///
+ [Fact]
+ public async Task ChoosingIPv6_StillSaysTheAddressWasInferredFromANetwork()
+ {
+ var import = await ReadAsync(OnePage(OneServer));
+
+ var address = import.Servers[0].Resolve(HetznerAddressKind.PublicIPv6).ShouldNotBeNull();
+
+ address.Value.ShouldBe("2a01:4f8:1c17:d00::1");
+ address.Warning.ShouldNotBeNull().ShouldContain("2a01:4f8:1c17:d00::/64");
+ }
+
+ ///
+ /// The private choice does not fall back, and that asymmetry is the point.
+ ///
+ ///
+ /// Falling back between v4 and v6 reaches the same machine over the same internet. Falling back from a
+ /// private address to a public one would put an address on the open internet into a bookmark that was
+ /// asked to stay off it, so a server with no private network is simply not importable under that choice.
+ ///
+ [Fact]
+ public async Task AServerOnNoPrivateNetwork_HasNoPrivateAddressToOffer()
+ {
+ var import = await ReadAsync(OnePage(OneServer));
+
+ import.Servers[0].Resolve(HetznerAddressKind.Private).ShouldBeNull();
+ }
+
+ [Fact]
+ public async Task AServerOnAPrivateNetwork_DialsItWithoutAWarning()
+ {
+ var import = await ReadAsync(OnePage("""
+ {
+ "id": 9,
+ "name": "db-01",
+ "private_net": [ { "ip": "10.0.0.4" } ]
+ }
+ """));
+
+ var address = import.Servers[0].Resolve(HetznerAddressKind.Private).ShouldNotBeNull();
+
+ address.Value.ShouldBe("10.0.0.4");
+ address.Warning.ShouldBeNull();
+ }
+
+ ///
+ /// Two private networks is a real shape and the first one is a choice this makes rather than a fact, so
+ /// it is said out loud — the same rule the IPv6 address follows.
+ ///
+ [Fact]
+ public async Task AServerOnTwoPrivateNetworks_TakesTheFirstAndSaysThereWereTwo()
+ {
+ var import = await ReadAsync(OnePage("""
+ {
+ "id": 9,
+ "name": "db-01",
+ "private_net": [ { "ip": "10.0.0.4" }, { "ip": "10.1.0.4" } ]
+ }
+ """));
+
+ var address = import.Servers[0].Resolve(HetznerAddressKind.Private).ShouldNotBeNull();
+
+ address.Value.ShouldBe("10.0.0.4");
+ address.Warning.ShouldNotBeNull().ShouldContain("2 private networks");
+ }
+
+ /// What is stored, and what is deliberately not.
+ ///
+ /// The note keeps what does not go stale — the id, the plan, where it runs, what it was built from. The
+ /// power state is not in it: a note saying "running" about a machine somebody switched off last March is
+ /// worse than no note, so status is a column on the import screen and never a stored fact.
+ ///
+ [Fact]
+ public async Task WhatIsStored_CarriesTheProjectsContextAndNotItsPowerState()
+ {
+ var import = await ReadAsync(OnePage(OneServer));
+ var server = import.Servers[0];
+
+ var host = server.ToSecret(
+ server.Resolve(HetznerAddressKind.PublicIPv4).ShouldNotBeNull(),
+ "root",
+ 22);
+
+ host.Label.ShouldBe("web-01");
+ host.Hostname.ShouldBe("203.0.113.10");
+ host.Username.ShouldBe("root");
+ host.Port.ShouldBe(22);
+ host.SshKeyId.ShouldBeNull("the private half of a key was never Hetzner's to hand over");
+
+ var notes = host.Notes.ShouldNotBeNull();
+
+ notes.ShouldContain("server 42");
+ notes.ShouldContain("cx22");
+ notes.ShouldContain("fsn1 · Falkenstein, DE");
+ notes.ShouldContain("ubuntu-24.04");
+ notes.ShouldContain("env=prod");
+ notes.ShouldNotContain("running");
+
+ host.TryValidate(out _).ShouldBeTrue();
+ }
+
+ ///
+ /// A blank login user stores none rather than storing an empty one, which is what the ssh_config import
+ /// does for an entry that named no User .
+ ///
+ [Fact]
+ public async Task ABlankLoginUser_StoresNoUsername()
+ {
+ var import = await ReadAsync(OnePage(OneServer));
+ var server = import.Servers[0];
+
+ server.ToSecret(server.Resolve(HetznerAddressKind.PublicIPv4)!, " ", 22).Username.ShouldBeNull();
+ }
+
+ ///
+ /// A server with no name would arrive as a bookmark called nothing, which HostSecret.TryValidate
+ /// refuses outright — so it is named for its id and the project-level warning says one was.
+ ///
+ [Fact]
+ public async Task AServerWithNoName_IsOfferedUnderItsIdAndWarnedAbout()
+ {
+ var import = await ReadAsync(OnePage("""{ "id": 512, "status": "off" }"""));
+
+ import.Servers.ShouldHaveSingleItem().Name.ShouldBe("server-512");
+ import.Warnings.ShouldHaveSingleItem().ShouldContain("server-512");
+ }
+
+ ///
+ /// Everything but the id is optional in practice — a server built from a snapshot has no image, and one
+ /// mid-creation has no datacentre yet. None of that is a reason to refuse the whole page.
+ ///
+ [Fact]
+ public async Task AServerTheApiDescribedSparsely_StillImports()
+ {
+ var import = await ReadAsync(OnePage("""{ "id": 3, "name": "fresh", "status": "initializing" }"""));
+
+ var server = import.Servers.ShouldHaveSingleItem();
+
+ server.ServerType.ShouldBeNull();
+ server.Location.ShouldBeNull();
+ server.Image.ShouldBeNull();
+ server.Labels.ShouldBeEmpty();
+ server.Resolve(HetznerAddressKind.PublicIPv4).ShouldBeNull("it has no address of any kind yet");
+ }
+
+ // ---- Helpers ----
+
+ /// A server carrying everything the API can say about one, used wherever the shape is not the point.
+ private const string OneServer = """
+ {
+ "id": 42,
+ "name": "web-01",
+ "status": "running",
+ "public_net": {
+ "ipv4": { "id": 1, "ip": "203.0.113.10", "blocked": false },
+ "ipv6": { "id": 2, "ip": "2a01:4f8:1c17:d00::/64", "blocked": false }
+ },
+ "private_net": [],
+ "server_type": { "id": 22, "name": "cx22", "cores": 2 },
+ "datacenter": {
+ "id": 4,
+ "name": "fsn1-dc14",
+ "location": { "name": "fsn1", "city": "Falkenstein", "country": "DE" }
+ },
+ "image": { "id": 100, "name": "ubuntu-24.04", "os_flavor": "ubuntu" },
+ "labels": { "role": "web", "env": "prod" }
+ }
+ """;
+
+ private static Task ReadAsync(StubResponse page) =>
+ new HetznerCloudClient(new HttpClient(new StubHetzner([page]))).ListServersAsync(Token, Cancellation);
+
+ private static StubResponse OnePage(string server) => Page(nextPage: null, server);
+
+ private static StubResponse Page(int? nextPage, string server) =>
+ new(
+ HttpStatusCode.OK,
+ $$"""
+ {
+ "servers": [ {{server}} ],
+ "meta": { "pagination": { "page": 1, "per_page": 50, "next_page": {{Next(nextPage)}} } }
+ }
+ """);
+
+ private static string Next(int? page) =>
+ page is { } value ? value.ToString(System.Globalization.CultureInfo.InvariantCulture) : "null";
+
+ private sealed record StubResponse(HttpStatusCode Status, string Body);
+
+ private sealed record SeenRequest(string Uri, string? Authorization);
+
+ ///
+ /// Answers each request with the next scripted response, and remembers what was asked.
+ ///
+ ///
+ /// Scripted in order rather than keyed by URL, because the thing being checked in the paging test is the
+ /// sequence: a client that asked for page one three times would pass a lookup by address and produce the
+ /// same list three times over.
+ ///
+ private sealed class StubHetzner(IReadOnlyList responses) : HttpMessageHandler
+ {
+ private int served;
+
+ internal List Requests { get; } = [];
+
+ protected override Task SendAsync(
+ HttpRequestMessage request,
+ CancellationToken cancellationToken)
+ {
+ Requests.Add(new SeenRequest(
+ request.RequestUri!.AbsoluteUri,
+ request.Headers.Authorization?.ToString()));
+
+ var scripted = responses[Math.Min(served++, responses.Count - 1)];
+
+ return Task.FromResult(new HttpResponseMessage(scripted.Status)
+ {
+ Content = new StringContent(scripted.Body, Encoding.UTF8, "application/json"),
+ });
+ }
+ }
+}