fix(ssh-key): title keys by their comment and recognize private keys

ssh-key create - required --title although the key carries a comment, and a private key failed with "supply exactly one valid SSH public key". The title now defaults to the key comment, then the computer's name, the file argument is optional (stdin when piped), and a private key points to its .pub file. Adding a registered key names the key it duplicates. ssh-key list shows ID, TITLE, FINGERPRINT and ADDED with a header, view shows the key instead of its list row, delete asks with the key's title and fingerprint, and mutations print ✓ lines. create gains the gh alias add and -t for --title, key IDs complete, and every command has examples. Signed-off-by: bircni <bircni@icloud.com>
2026-10-26 19:11:25 +01:00 · 2026-10-11 23:42:49 +02:00
1 parent ab3e91acd1
commit f21c05ead4
@@ -4,9 +4,11 @@
 package app

 import (
+	"bytes"
+	"context"
 	"errors"
 	"fmt"
-	"path/filepath"
+	"os"
 	"strconv"
 	"strings"

@@ -18,55 +20,196 @@ import (
 )

 func (a *application) sshKeyCommand() *cobra.Command {
-	group := &cobra.Command{Use: "ssh-key", Short: "Manage account SSH public keys"}
+	group := &cobra.Command{Use: "ssh-key", Short: "Manage SSH keys", Long: "Manage the SSH public keys of your account, which authenticate Git operations over SSH."}
+	group.AddCommand(a.sshKeyListCommand(), a.sshKeyViewCommand(), a.sshKeyCreateCommand(), a.sshKeyDeleteCommand())
+	return group
+}
+
+// sshKeyLabel names a key in messages: `SSH key "laptop" (SHA256:…)`.
+func sshKeyLabel(key services.SSHKey) string {
+	return fmt.Sprintf("SSH key %q (%s)", key.Title, key.Fingerprint)
+}
+
+// completeSSHKeys completes the key IDs of the account with their titles.
+func (a *application) completeSSHKeys() cobra.CompletionFunc {
+	return a.apiCompletion(false, func(ctx context.Context, t target, _ string) ([]cobra.Completion, error) {
+		keys, err := (services.SSHKeys{Client: t.client}).List(ctx, completionLimit, 1)
+		return describe(keys.Items, func(key services.SSHKey) (string, string) {
+			return strconv.FormatInt(key.ID, 10), key.Title + " (" + key.Fingerprint + ")"
+		}), err
+	})
+}
+
+func (a *application) sshKeyListCommand() *cobra.Command {
 	var limit, page int
-	list := &cobra.Command{Use: "list", Short: "List account SSH keys", Args: argsExact(0), RunE: func(cmd *cobra.Command, _ []string) error {
-		target, err := a.resolve(cmd.Context(), false)
-		if err != nil {
-			return err
-		}
-		items, err := (services.SSHKeys{Client: target.client}).List(cmd.Context(), limit, page)
-		if err != nil {
-			return err
-		}
-		return writeList(a, cmd, items, sshKeyRow)
-	}}
-	pageFlags(list, &limit, &page)
-	group.AddCommand(list)
-	var title string
-	create := &cobra.Command{Use: "create <public-key-file>", Short: "Register an SSH public key; - reads stdin", Args: argsExact(1), RunE: func(cmd *cobra.Command, args []string) error {
-		data, err := readFileOrStdin(a.deps.Streams.In, args[0])
-		if err != nil {
-			return fmt.Errorf("read public key: %w", err)
-		}
-		_, _, _, rest, err := ssh.ParseAuthorizedKey(data)
-		if err != nil || len(strings.TrimSpace(string(rest))) != 0 {
-			return clierr.Wrap(clierr.Usage, errors.New("supply exactly one valid SSH public key"))
-		}
-		if title == "" {
-			if args[0] == "-" {
-				return clierr.Wrap(clierr.Usage, errors.New("--title is required when reading a key from stdin"))
+	cmd := &cobra.Command{
+		Use: "list", Short: "List SSH keys", Args: argsExact(0),
+		Example: `$ tea ssh-key list
+$ tea ssh-key list --json title,fingerprint`,
+		RunE: func(cmd *cobra.Command, _ []string) error {
+			target, err := a.resolve(cmd.Context(), false)
+			if err != nil {
+				return err
 			}
-			base := filepath.Base(args[0])
-			title = strings.TrimSuffix(base, filepath.Ext(base))
+			keys, err := (services.SSHKeys{Client: target.client}).List(cmd.Context(), limit, page)
+			if err != nil {
+				return err
+			}
+			account := target.login()
+			return writeTable(a, cmd, keys.Items, listSpec[services.SSHKey]{
+				Columns: []terminal.Column{{Header: "ID"}, {Header: "Title", Flex: true}, {Header: "Fingerprint"}, {Header: "Added"}},
+				Row: func(key services.SSHKey) []terminal.Cell {
+					return []terminal.Cell{{Text: strconv.FormatInt(key.ID, 10), Link: webURL(target, "user", "settings", "keys")}, {Text: key.Title, Bold: true}, {Text: key.Fingerprint, Muted: true}, {Time: terminal.ParseTime(key.CreatedAt)}}
+				},
+				Context: "SSH keys of " + account,
+				Empty:   "no SSH keys for " + account + "; add one with: tea ssh-key add ~/.ssh/id_ed25519.pub",
+			}, servicePage(keys, page))
+		},
+	}
+	pageFlags(cmd, &limit, &page)
+	return cmd
+}
+
+func (a *application) sshKeyViewCommand() *cobra.Command {
+	return &cobra.Command{
+		Use: "view <id>", Short: "View an SSH key", Args: argsExact(1), ValidArgsFunction: a.completeSSHKeys(),
+		Example: `$ tea ssh-key view 2
+# print the public key
+$ tea ssh-key view 2 --jq .key`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			id, err := number(args[0])
+			if err != nil {
+				return err
+			}
+			target, err := a.resolve(cmd.Context(), false)
+			if err != nil {
+				return err
+			}
+			key, err := (services.SSHKeys{Client: target.client}).View(cmd.Context(), id)
+			if err != nil {
+				return err
+			}
+			d := a.display()
+			return writeView(a, cmd, key, func(key services.SSHKey) terminal.View {
+				added := timeField("Added", key.CreatedAt, d)
+				meta := ""
+				if added.Value != "" {
+					meta = "added " + added.Value
+				}
+				added.PipedOnly = true
+				algorithm, _, _ := strings.Cut(key.Key, " ")
+				return terminal.View{
+					Title: key.Title, ID: fmt.Sprintf("(ID %d)", key.ID), Meta: meta,
+					Fields:   []terminal.Field{{Label: "Fingerprint", Value: key.Fingerprint}, {Label: "Type", Value: algorithm}, added, {Label: "Key", Value: key.Key}},
+					Bodyless: true, Kind: "SSH key", URL: webURL(target, "user", "settings", "keys"),
+				}
+			})
+		},
+	}
+}
+
+// publicKey reads one SSH public key from data, which came from source, and returns it with its
+// comment. It recognizes a private key and points to its public half.
+func publicKey(data []byte, source string) (ssh.PublicKey, string, error) {
+	if bytes.Contains(data, []byte("PRIVATE KEY-----")) {
+		hint := "pipe the public key (.pub) instead"
+		if source != "-" {
+			hint = "add its public key instead: tea ssh-key add " + source + ".pub"
 		}
-		if strings.TrimSpace(title) == "" {
-			return clierr.Wrap(clierr.Usage, errors.New("key title cannot be empty"))
+		return nil, "", clierr.Wrap(clierr.Usage, fmt.Errorf("%s holds a private key; %s", sshKeySource(source), hint))
+	}
+	key, comment, _, rest, err := ssh.ParseAuthorizedKey(data)
+	if err != nil || len(bytes.TrimSpace(rest)) != 0 {
+		return nil, "", clierr.Wrap(clierr.Usage, fmt.Errorf("%s must hold exactly one valid SSH public key", sshKeySource(source)))
+	}
+	return key, comment, nil
+}
+
+func sshKeySource(source string) string {
+	if source == "-" {
+		return "stdin"
+	}
+	return source
+}
+
+func (a *application) sshKeyCreateCommand() *cobra.Command {
+	var title string
+	cmd := &cobra.Command{
+		Use: "create [<file>]", Aliases: []string{"add"}, Short: "Add an SSH public key from a file or stdin", Args: usageArgs(cobra.MaximumNArgs(1)),
+		Long: `Add an SSH public key to your account. Without a file, or with -, the key is read from stdin.
+
+The title defaults to the key's comment, such as alice@laptop, or else to this computer's name.`,
+		Example: `$ tea ssh-key add ~/.ssh/id_ed25519.pub
+$ tea ssh-key add ~/.ssh/id_ed25519.pub --title "Work laptop"
+$ cat key.pub | tea ssh-key add`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			source := "-"
+			if len(args) > 0 {
+				source = args[0]
+			}
+			if source == "-" && a.deps.Streams.InTTY {
+				return clierr.Wrap(clierr.Usage, errors.New("supply a public key file, such as ~/.ssh/id_ed25519.pub, or pipe a key to stdin"))
+			}
+			data, err := readFileOrStdin(a.deps.Streams.In, source)
+			if err != nil {
+				return fmt.Errorf("read public key: %w", err)
+			}
+			key, comment, err := publicKey(data, source)
+			if err != nil {
+				return err
+			}
+			if !cmd.Flags().Changed("title") {
+				title = comment
+				if title == "" {
+					title, _ = os.Hostname()
+				}
+			}
+			if strings.TrimSpace(title) == "" {
+				return clierr.Wrap(clierr.Usage, errors.New("key title cannot be empty; pass --title"))
+			}
+			target, err := a.resolve(cmd.Context(), false)
+			if err != nil {
+				return err
+			}
+			service := services.SSHKeys{Client: target.client}
+			created, err := service.Create(cmd.Context(), title, strings.TrimSpace(string(data)))
+			if err != nil {
+				return a.registeredKey(cmd.Context(), service, key, services.ClassifyRequest(err))
+			}
+			a.done(cmd, "Added %s", sshKeyLabel(created))
+			return a.jsonResult(cmd, created)
+		},
+	}
+	cmd.Flags().StringVarP(&title, "title", "t", "", "Key title (defaults to the key comment, then the computer's name)")
+	return cmd
+}
+
+// registeredKey names the key of the account that already holds key when Gitea refuses to add it.
+func (a *application) registeredKey(ctx context.Context, service services.SSHKeys, key ssh.PublicKey, err error) error {
+	conflict, ok := errors.AsType[*services.ConflictError](err)
+	if !ok || conflict.Reason != services.ReasonKeyInUse {
+		return err
+	}
+	keys, listErr := service.List(ctx, maxLimit, 1)
+	if listErr != nil {
+		return conflict
+	}
+	fingerprint := ssh.FingerprintSHA256(key)
+	for _, registered := range keys.Items {
+		if registered.Fingerprint == fingerprint {
+			conflict.Hint = fmt.Sprintf("it is your SSH key %q (ID %d)", registered.Title, registered.ID)
 		}
-		target, err := a.resolve(cmd.Context(), false)
-		if err != nil {
-			return err
-		}
-		item, err := (services.SSHKeys{Client: target.client}).Create(cmd.Context(), title, strings.TrimSpace(string(data)))
-		if err != nil {
-			return err
-		}
-		return writeItem(a, cmd, item, sshKeyRow)
-	}}
-	create.Flags().StringVar(&title, "title", "", "Key title (defaults to filename)")
-	group.AddCommand(create)
-	for _, verb := range []string{"view", "delete"} {
-		command := &cobra.Command{Use: verb + " <id>", Short: titleCase(verb) + " an SSH key", Args: argsExact(1), RunE: func(cmd *cobra.Command, args []string) error {
+	}
+	return conflict
+}
+
+func (a *application) sshKeyDeleteCommand() *cobra.Command {
+	return &cobra.Command{
+		Use: "delete <id>", Short: "Delete an SSH key", Args: argsExact(1), ValidArgsFunction: a.completeSSHKeys(),
+		Example: `$ tea ssh-key delete 2
+$ tea ssh-key delete 2 --yes`,
+		Annotations: map[string]string{"tea.text": "SSH key deletion does not return a resource", "tea.confirm": "true"},
+		RunE: func(cmd *cobra.Command, args []string) error {
 			id, err := number(args[0])
 			if err != nil {
 				return err
@@ -76,26 +219,18 @@ func (a *application) sshKeyCommand() *cobra.Command {
 				return err
 			}
 			service := services.SSHKeys{Client: target.client}
-			if verb == "delete" {
-				if err := a.confirm(cmd, "Delete SSH key "+args[0]); err != nil {
-					return err
-				}
-				return service.Delete(cmd.Context(), id)
-			}
-			item, err := service.View(cmd.Context(), id)
+			key, err := service.View(cmd.Context(), id)
 			if err != nil {
 				return err
 			}
-			return writeItem(a, cmd, item, sshKeyRow)
-		}}
-		if verb == "delete" {
-			command.Annotations = textOutput("SSH key deletion does not return a resource")
-		}
-		group.AddCommand(command)
+			if err := a.confirmAction(cmd, terminal.Confirmation{Prompt: "Delete " + sshKeyLabel(key) + "?", NonTTY: "delete " + sshKeyLabel(key)}); err != nil {
+				return err
+			}
+			if err := service.Delete(cmd.Context(), id); err != nil {
+				return err
+			}
+			a.done(cmd, "Deleted %s", sshKeyLabel(key))
+			return nil
+		},
 	}
-	return group
-}
-
-func sshKeyRow(key services.SSHKey) []terminal.Cell {
-	return terminal.Row(strconv.FormatInt(key.ID, 10), key.Title, key.Fingerprint)
 }