DodoTech-Public/DodoSSH
Public Access
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

Sync and authenticate with SSH keys on the client

Browse Source 
Completes the client half of SSH keys: they sync alongside hosts, appear in
their own list, and can be selected to authenticate a connection instead of
typing a password.

The reconciler and the repository were Host-typed throughout, so the choice was
to generalise them or to keep a second copy per item type. Generalised, because
ItemReconciler's whole premise is that the pull and the push paths must answer
the same collision the same way — two copies would drift the first time one of
them was fixed. What is genuinely per-type now arrives through
IItemKind<TSecret>: the cipher, the merge, the plaintext columns, and the noun
to use when telling a person what happened to their item. Generic where the
server's IItemKind is not, and for the reason that reverses there — the client
needs the concrete type, because it merges field by field.

The pull filter is derived from the same registry that builds the reconcilers.
That is the specific failure being designed out: an item type that encrypts,
merges and lists perfectly and is never once requested from the server, so it
works on the machine that made it and exists nowhere else.

No client cache migration. The item table's primary key and the outbox's unique
index already carry the entity type, and AadResourceTypes already mapped SshKey
— so a host and a key may share an id and never see each other's rows, which
SshKeySyncTests now arranges deliberately.

A key hands the server nothing in plaintext. There is a public_key_fingerprint
column and it would be accepted; leaving it null is deliberate. A fingerprint is
not secret but it is a stable identifier for a key pair, so filling it would let
an operator tell which of their users hold the same key and correlate one across
vaults, for a column nothing reads. The design allows itself one plaintext
concession — the relay address, which the relay cannot work without — and this
is not that.

A key is chosen per connection rather than bound to a host, which works the way
ssh -i does. Binding one needs a field on HostSecret and therefore a payload
schema bump, which makes every host written afterwards read-only on an older
build; worth doing deliberately rather than as a side effect of adding keys.

Three things this found, all of them by being falsified rather than by review:

- Making the reconciler generic silently turned a record comparison into
  reference equality, because == on a type parameter is not value equality. The
  effect would have been a conflict recorded on every pass for an unacknowledged
  create that had in fact landed. Sabotaging the fix left all 73 tests passing —
  nothing covered that branch — so ConflictMatrixTests now has
  AnUnacknowledgedCreateThatDidLand_IsDroppedQuietly, which fails without it.

- A test asserting that a blank passphrase reaches SSH.NET as null was vacuous:
  it exercised the editor, not the credential path, and passed with the guard
  deleted. Resolved by making SshKeySecret.Passphrase normalise an empty string
  to null, so there is one spelling of one state — which also keeps two clients
  from producing different payload bytes for an identical key. That exposed a
  wider gap: SshKeySecret, its codec and its merge had no direct unit tests at
  all. They have 25 now.

- The reason first given for that normalisation was false. It claimed SSH.NET
  rejects a passphrase supplied for an unprotected key; measured against a real
  sshd it ignores it and authenticates anyway. Corrected everywhere it was
  stated and recorded in docs/platform-flags.md. The same test file also closes
  a real hole: SshPrivateKeyCredential had never been exercised against a
  server, because the existing key test builds SSH.NET's auth method directly
  and bypasses the path a vault-held key actually takes.

Only one editor may be open at a time. Both sit in the same 340-pixel column as
Auto rows and their heights together exceed it at the window's minimum size, so
two open editors put the lower one's Save and Cancel past the bottom edge — the
same failure this window already shipped once with the setup screens. Expressed
as a state rule because that is the only form of it this repository can check:
nothing here loads a .axaml. The refusal keeps what was typed, since in the key
editor that is a pasted private key the user may have nowhere else.

The end-to-end slice now carries a key as well as a host, so both item types go
through the real API, the real PostgreSQL and the real crypto in one pass — the
three hand-kept mappings between enums that do not line up are the reason that
is worth doing rather than trusting the unit suites.

735 tests green, including the container-backed SSH and end-to-end suites. Zero
warnings, dotnet format clean.
This commit is contained in:
jaap-jan
2026-07-29 20:27:23 +02:00
parent 586cb303d5
commit e3fd3e1728
26 changed files with 2804 additions and 505 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/DodoSSH.Client.App/ViewModels/VaultViewModel.cs
+403 -23
View File
@@ -1,5 +1,6 @@
using System.Collections.ObjectModel;
using System.Globalization;
using System.Text;
using CommunityToolkit.Mvvm.ComponentModel;
using CommunityToolkit.Mvvm.Input;
using DodoSSH.Client.Api;
@@ -17,17 +18,17 @@ namespace DodoSSH.Client.App.ViewModels;
/// the flags the list has to show: an edit this machine has not pushed, a change the server refused, and
/// an item a newer client wrote that must not be re-encoded here.
/// </remarks>
internal sealed class HostRowViewModel(VaultHost host)
internal sealed class HostRowViewModel(VaultItem<HostSecret> host)
{
internal Guid EntityId => host.EntityId;
internal HostSecret Host => host.Host;
internal HostSecret Host => host.Secret;
internal string Label => host.Host.Label;
internal string Label => host.Secret.Label;
internal string Address => string.Create(
CultureInfo.InvariantCulture,
$"{host.Host.Username ?? "—"}@{host.Host.Hostname}:{host.Host.Port}");
$"{host.Secret.Username ?? "—"}@{host.Secret.Hostname}:{host.Secret.Port}");
internal bool HasUnsyncedChanges => host.HasUnsyncedChanges;
@@ -36,13 +37,65 @@ internal sealed class HostRowViewModel(VaultHost host)
internal bool IsReadOnly => host.IsReadOnly;
/// <summary>A short marker for the row, so the list says what it knows without a tooltip.</summary>
internal string Badge => host switch
internal string Badge => ItemBadge.For(host.IsBlocked, host.IsReadOnly, host.HasUnsyncedChanges);
}
/// <summary>One SSH key, as a row in the list.</summary>
/// <remarks>
/// <para>
/// Carries the decrypted <see cref="SshKeySecret"/>, as the host row carries its host, so opening the
/// editor or connecting with the key needs no second decryption.
/// </para>
/// <para>
/// <b>Nothing here exposes the private key to the view.</b> <see cref="Key"/> is what the editor and the
/// connect path read, and the members the XAML binds are the label, a description and a badge. That is not
/// a security boundary — the same object holds the material either way — but it does mean no template,
/// tooltip or accessibility surface can end up rendering a private key by being pointed at the obvious
/// property.
/// </para>
/// </remarks>
internal sealed class SshKeyRowViewModel(VaultItem<SshKeySecret> key)
{
internal Guid EntityId => key.EntityId;
internal SshKeySecret Key => key.Secret;
internal string Label => key.Secret.Label;
/// <summary>What the list shows under the name: what is known about the key, never the key.</summary>
internal string Description => key.Secret switch
{
{ IsBlocked: true } => "rejected",
{ IsReadOnly: true } => "newer version",
{ HasUnsyncedChanges: true } => "not synced",
_ => string.Empty,
{ Passphrase: not null, PublicKey: not null } => "passphrase · public half stored",
{ Passphrase: not null } => "passphrase · no public half",
{ PublicKey: not null } => "no passphrase · public half stored",
_ => "no passphrase · no public half",
};
internal bool HasUnsyncedChanges => key.HasUnsyncedChanges;
internal bool IsBlocked => key.IsBlocked;
internal bool IsReadOnly => key.IsReadOnly;
internal string Badge => ItemBadge.For(key.IsBlocked, key.IsReadOnly, key.HasUnsyncedChanges);
}
/// <summary>The one-word marker a row shows for its sync state.</summary>
/// <remarks>
/// Shared by both row types rather than written twice, because the three states mean the same thing for
/// every item type and a list where one kind said "not synced" and the other "unsynced" would read as two
/// different conditions.
/// </remarks>
internal static class ItemBadge
{
internal static string For(bool isBlocked, bool isReadOnly, bool hasUnsyncedChanges) =>
(isBlocked, isReadOnly, hasUnsyncedChanges) switch
{
(true, _, _) => "rejected",
(_, true, _) => "newer version",
(_, _, true) => "not synced",
_ => string.Empty,
};
}
/// <summary>A conflict, as a row.</summary>
@@ -88,10 +141,16 @@ internal sealed class ConflictRowViewModel(ConflictNotice notice)
/// A background pass is deliberately quieter than the button: see <see cref="AutoSyncAsync" />.
/// </para>
/// <para>
/// <b>Credentials are not in the vault yet.</b> <c>SyncEntityType.Credential</c> exists in the contract
/// but is not synced, so connecting still asks for a password each time. That is a real M1 limitation
/// rather than a design choice, and the interface says so rather than implying the vault holds more than
/// it does.
/// <b>Keys are in the vault; passwords are not.</b> An SSH key is a synced item, so it is stored once and
/// available on every machine. <c>SyncEntityType.Credential</c> exists in the contract and is still not
/// synced, so password authentication asks for the password each time. That is a real M1 limitation rather
/// than a design choice, and the interface says so rather than implying the vault holds more than it does.
/// </para>
/// <para>
/// <b>A key is chosen per connection, not per host.</b> Binding a key to a host is the better answer and it
/// is not free: it means a new field on <c>HostSecret</c>, which means bumping the payload schema version,
/// which makes every host written afterwards read-only on an older build. Worth doing deliberately rather
/// than as a side effect of adding keys, so for now this works the way <c>ssh -i</c> does.
/// </para>
/// </remarks>
internal sealed partial class VaultViewModel(
@@ -118,6 +177,9 @@ internal sealed partial class VaultViewModel(
/// <summary>The hosts to show, unpushed local state included.</summary>
internal ObservableCollection<HostRowViewModel> Hosts { get; } = [];
/// <summary>The SSH keys to show, unpushed local state included.</summary>
internal ObservableCollection<SshKeyRowViewModel> Keys { get; } = [];
/// <summary>Whatever the merge had to override and the user has not acknowledged.</summary>
internal ObservableCollection<ConflictRowViewModel> Conflicts { get; } = [];
@@ -127,6 +189,9 @@ internal sealed partial class VaultViewModel(
[ObservableProperty]
private HostRowViewModel? selectedHost;
[ObservableProperty]
private SshKeyRowViewModel? selectedKey;
[ObservableProperty]
private string status = string.Empty;
@@ -165,6 +230,37 @@ internal sealed partial class VaultViewModel(
/// <summary>The item being edited, or null when creating.</summary>
private Guid? editingEntityId;
// ---- The key editor ----
// A second set of editor state rather than a shared one. The two editors hold unrelated fields, and
// sharing them would mean a half-typed host reappearing inside a key editor.
[ObservableProperty]
private bool isEditingKey;
[ObservableProperty]
private string keyEditorLabel = string.Empty;
/// <remarks>
/// Bound to a text box the user pastes a private key into, so this holds key material for as long as
/// the editor is open, and <see cref="CancelKeyEdit" /> clears it. Neither that nor anything else here
/// can wipe it — see <c>SshKeySecret</c>, which explains why a .NET string is the honest choice for
/// this and what it does not buy.
/// </remarks>
[ObservableProperty]
private string keyEditorPrivateKey = string.Empty;
[ObservableProperty]
private string keyEditorPassphrase = string.Empty;
[ObservableProperty]
private string keyEditorPublicKey = string.Empty;
[ObservableProperty]
private string keyEditorNotes = string.Empty;
/// <summary>The key being edited, or null when creating.</summary>
private Guid? editingKeyId;
// ---- Connecting ----
/// <remarks>
@@ -173,6 +269,17 @@ internal sealed partial class VaultViewModel(
[ObservableProperty]
private string connectPassword = string.Empty;
/// <summary>
/// Whether to authenticate with the selected key rather than a password.
/// </summary>
/// <remarks>
/// An explicit switch rather than "use the key if one happens to be selected". The key list's selection
/// exists to edit and delete keys, and letting it silently change how the next connection authenticates
/// would make clicking a row to rename it alter what Connect does.
/// </remarks>
[ObservableProperty]
private bool useKeyAuthentication;
[ObservableProperty]
private HostKeyPresentation? pendingHostKey;
@@ -202,9 +309,13 @@ internal sealed partial class VaultViewModel(
{
await ReloadAsync(cancellationToken).ConfigureAwait(true);
Status = Hosts.Count == 0
? "No hosts yet. Add one."
: $"{Hosts.Count} host(s) in {VaultName}.";
Status = (Hosts.Count, Keys.Count) switch
{
(0, 0) => "No hosts yet. Add one.",
(0, var keys) => $"No hosts yet, and {keys} key(s) in {VaultName}.",
(var hosts, 0) => $"{hosts} host(s) in {VaultName}.",
var (hosts, keys) => $"{hosts} host(s) and {keys} key(s) in {VaultName}.",
};
}
/// <summary>
@@ -217,6 +328,19 @@ internal sealed partial class VaultViewModel(
/// "the background pass is quiet" false on the one path that mattered.
/// </remarks>
private async Task ReloadAsync(CancellationToken cancellationToken)
{
var unreadable = await ReloadHostsAsync(cancellationToken).ConfigureAwait(true);
unreadable += await ReloadKeysAsync(cancellationToken).ConfigureAwait(true);
UnreadableItems = unreadable;
PendingChanges = await session.PendingChangeCountAsync(cancellationToken).ConfigureAwait(true);
await LoadConflictsAsync(cancellationToken).ConfigureAwait(true);
}
/// <returns>How many hosts would not decrypt.</returns>
private async Task<int> ReloadHostsAsync(CancellationToken cancellationToken)
{
var listing = await session.Hosts
.ListAsync(session.ActiveVaultId, cancellationToken)
@@ -226,7 +350,7 @@ internal sealed partial class VaultViewModel(
Hosts.Clear();
foreach (var host in listing.Hosts.OrderBy(host => host.Host.Label, StringComparer.CurrentCulture))
foreach (var host in listing.Items.OrderBy(host => host.Secret.Label, StringComparer.CurrentCulture))
{
Hosts.Add(new HostRowViewModel(host));
}
@@ -235,10 +359,33 @@ internal sealed partial class VaultViewModel(
// under the user.
SelectedHost = Hosts.FirstOrDefault(row => row.EntityId == selectedId) ?? Hosts.FirstOrDefault();
UnreadableItems = listing.Unreadable;
PendingChanges = await session.PendingChangeCountAsync(cancellationToken).ConfigureAwait(true);
return listing.Unreadable;
}
await LoadConflictsAsync(cancellationToken).ConfigureAwait(true);
/// <returns>How many keys would not decrypt.</returns>
/// <remarks>
/// Unlike the host list, the selection is <em>not</em> defaulted to the first row. A key selection is
/// what <see cref="UseKeyAuthentication" /> authenticates with, and quietly selecting one on load would
/// mean a connection made with a key the user never chose.
/// </remarks>
private async Task<int> ReloadKeysAsync(CancellationToken cancellationToken)
{
var listing = await session.SshKeys
.ListAsync(session.ActiveVaultId, cancellationToken)
.ConfigureAwait(true);
var selectedId = SelectedKey?.EntityId;
Keys.Clear();
foreach (var key in listing.Items.OrderBy(key => key.Secret.Label, StringComparer.CurrentCulture))
{
Keys.Add(new SshKeyRowViewModel(key));
}
SelectedKey = Keys.FirstOrDefault(row => row.EntityId == selectedId);
return listing.Unreadable;
}
/// <summary>Runs a synchronisation pass, if there is a server to talk to.</summary>
@@ -386,6 +533,11 @@ internal sealed partial class VaultViewModel(
[RelayCommand]
private void NewHost()
{
if (KeyEditorIsInTheWay())
{
return;
}
editingEntityId = null;
EditorLabel = string.Empty;
EditorHostname = string.Empty;
@@ -401,7 +553,7 @@ internal sealed partial class VaultViewModel(
[RelayCommand]
private void EditSelectedHost()
{
if (SelectedHost is not { } row)
if (SelectedHost is not { } row || KeyEditorIsInTheWay())
{
return;
}
@@ -505,6 +657,129 @@ internal sealed partial class VaultViewModel(
await AutoSyncAsync(cancellationToken).ConfigureAwait(true);
}
/// <summary>Starts a new SSH key.</summary>
[RelayCommand]
private void NewKey()
{
if (HostEditorIsInTheWay())
{
return;
}
editingKeyId = null;
ClearKeyEditor();
IsEditingKey = true;
Status = "Adding an SSH key.";
}
/// <summary>Opens the selected key for editing.</summary>
/// <remarks>
/// The private key is loaded into the editor, which is the only way an edit can preserve it: the
/// codec has no notion of a partial update, so saving re-encodes every field.
/// </remarks>
[RelayCommand]
private void EditSelectedKey()
{
if (SelectedKey is not { } row || HostEditorIsInTheWay())
{
return;
}
if (row.IsReadOnly)
{
Status = "This key was written by a newer version of DodoSSH. Update before editing it.";
return;
}
editingKeyId = row.EntityId;
KeyEditorLabel = row.Key.Label;
KeyEditorPrivateKey = row.Key.PrivateKeyPem;
KeyEditorPassphrase = row.Key.Passphrase ?? string.Empty;
KeyEditorPublicKey = row.Key.PublicKey ?? string.Empty;
KeyEditorNotes = row.Key.Notes ?? string.Empty;
IsEditingKey = true;
Status = $"Editing {row.Label}.";
}
/// <summary>Abandons the key editor, clearing the material out of it.</summary>
[RelayCommand]
private void CancelKeyEdit()
{
IsEditingKey = false;
editingKeyId = null;
ClearKeyEditor();
Status = string.Empty;
}
/// <summary>Stores the key editor's contents, encrypted, and queues it for the server.</summary>
[RelayCommand]
private async Task SaveKeyAsync(CancellationToken cancellationToken)
{
var key = BuildKey();
if (!key.TryValidate(out var reason))
{
Status = reason;
return;
}
await RunAsync(
"Saving…",
async () =>
{
if (editingKeyId is { } entityId)
{
await session.SshKeys
.UpdateAsync(session.ActiveVaultId, entityId, key, cancellationToken)
.ConfigureAwait(true);
}
else
{
editingKeyId = await session.SshKeys
.CreateAsync(session.ActiveVaultId, key, cancellationToken)
.ConfigureAwait(true);
}
IsEditingKey = false;
ClearKeyEditor();
await ReloadAsync(cancellationToken).ConfigureAwait(true);
SelectedKey = Keys.FirstOrDefault(row => row.EntityId == editingKeyId);
editingKeyId = null;
Status = connection() is null
? $"Saved '{key.Label}'. It will sync when you are online."
: $"Saved '{key.Label}'.";
}).ConfigureAwait(true);
await AutoSyncAsync(cancellationToken).ConfigureAwait(true);
}
/// <summary>Queues a tombstone for the selected key.</summary>
[RelayCommand]
private async Task DeleteKeyAsync(CancellationToken cancellationToken)
{
if (SelectedKey is not { } row)
{
return;
}
await RunAsync(
"Deleting…",
async () =>
{
await session.SshKeys
.DeleteAsync(session.ActiveVaultId, row.EntityId, cancellationToken)
.ConfigureAwait(true);
await ReloadAsync(cancellationToken).ConfigureAwait(true);
Status = $"Deleted '{row.Label}'.";
}).ConfigureAwait(true);
await AutoSyncAsync(cancellationToken).ConfigureAwait(true);
}
/// <summary>Opens a terminal on the selected host.</summary>
[RelayCommand]
private async Task ConnectAsync(CancellationToken cancellationToken)
@@ -521,6 +796,15 @@ internal sealed partial class VaultViewModel(
return;
}
if (UseKeyAuthentication && SelectedKey is null)
{
// Refused rather than quietly falling back to the password box. Silently authenticating a
// different way than the user asked for is how a password reaches a host that was meant to
// only ever see a key.
Status = "Choose a key to authenticate with, or turn key authentication off.";
return;
}
PendingHostKey = null;
HostKeyMismatch = null;
@@ -617,7 +901,7 @@ internal sealed partial class VaultViewModel(
row.Host.Hostname,
row.Host.Port,
row.Host.Username!,
new SshPasswordCredential(ConnectPassword));
BuildCredential());
await workspace
.OpenSessionAsync(request, TerminalSize.Default, cancellationToken)
@@ -652,6 +936,30 @@ internal sealed partial class VaultViewModel(
}
}
/// <summary>
/// How the next connection authenticates.
/// </summary>
/// <remarks>
/// The key material is handed over as UTF-8 bytes, which is what <c>PrivateKeyFile</c> reads from a
/// <c>MemoryStream</c> — so the key reaches SSH.NET without ever becoming a file on disk. The
/// passphrase goes with it: a key stored in the vault together with its passphrase is the whole point
/// of a vault, and <c>SshKeySecret</c> says why.
/// <para>
/// The passphrase is passed straight through, with no empty-to-null check, because
/// <c>SshKeySecret.Passphrase</c> cannot hold an empty string — it normalises one to null on the way in.
/// </para>
/// </remarks>
private SshCredential BuildCredential()
{
if (!UseKeyAuthentication || SelectedKey is not { } row)
{
return new SshPasswordCredential(ConnectPassword);
}
return new SshPrivateKeyCredential(
Encoding.UTF8.GetBytes(row.Key.PrivateKeyPem), row.Key.Passphrase);
}
private HostSecret BuildHost() =>
new()
{
@@ -663,6 +971,76 @@ internal sealed partial class VaultViewModel(
RelayEnabled = EditorRelayEnabled,
};
/// <remarks>
/// The private key is not trimmed. Its armour is whitespace-significant and a client that tidied it up
/// would eventually tidy a format it did not fully understand — the same reason
/// <c>SshKeySecret.PrivateKeyPem</c> stores it verbatim. Everything else is trimmed, because a label
/// with a trailing space sorts oddly and reads as a different name.
/// </remarks>
private SshKeySecret BuildKey() =>
new()
{
Label = KeyEditorLabel.Trim(),
PrivateKeyPem = KeyEditorPrivateKey,
// Not trimmed and not emptied: leading or trailing spaces are legitimate in a passphrase, and
// the record turns an empty one into null on its own.
Passphrase = KeyEditorPassphrase,
PublicKey = string.IsNullOrWhiteSpace(KeyEditorPublicKey) ? null : KeyEditorPublicKey.Trim(),
Notes = string.IsNullOrWhiteSpace(KeyEditorNotes) ? null : KeyEditorNotes,
};
/// <summary>
/// Whether the key editor has to be dealt with before another one can open.
/// </summary>
/// <remarks>
/// <para>
/// Only one editor open at a time, and this is a layout constraint rather than a style rule. Both
/// editors sit in the same 340-pixel column as <c>Auto</c> rows, and their desired heights together
/// exceed the column at the window's minimum height — so opening both pushes the lower one's Save and
/// Cancel past the bottom edge, where they cannot be clicked. That is the same failure this window has
/// already shipped once, when the setup screens rendered sliced with their buttons unreachable, and it is
/// the failure that nothing in this repository can catch: no test loads a <c>.axaml</c>. Making it a
/// state rule instead of a sizing hope is what makes it testable at all.
/// </para>
/// <para>
/// Refused rather than resolved by closing the other editor, because closing it would silently discard
/// what was typed there — and in the key editor that is a pasted private key the user may have nowhere
/// else. One sentence and one click is the cheaper of the two.
/// </para>
/// </remarks>
private bool KeyEditorIsInTheWay()
{
if (!IsEditingKey)
{
return false;
}
Status = "Finish or cancel the SSH key you are editing first.";
return true;
}
/// <inheritdoc cref="KeyEditorIsInTheWay" />
private bool HostEditorIsInTheWay()
{
if (!IsEditing)
{
return false;
}
Status = "Finish or cancel the host you are editing first.";
return true;
}
private void ClearKeyEditor()
{
KeyEditorLabel = string.Empty;
KeyEditorPrivateKey = string.Empty;
KeyEditorPassphrase = string.Empty;
KeyEditorPublicKey = string.Empty;
KeyEditorNotes = string.Empty;
}
private async Task LoadConflictsAsync(CancellationToken cancellationToken)
{
var notices = await session.ReadConflictsAsync(cancellationToken).ConfigureAwait(true);
@@ -693,9 +1071,11 @@ internal sealed partial class VaultViewModel(
var notes = new List<string>();
// "item(s)", not "host(s)": a vault now holds keys as well, and a report that named the wrong kind
// would send someone looking through the wrong list for something that was not there.
if (report.Resurrected > 0)
{
notes.Add($"{report.Resurrected} host(s) deleted elsewhere were kept under a new name");
notes.Add($"{report.Resurrected} item(s) deleted elsewhere were kept under a new name");
}
if (report.DeletesAbandoned > 0)