feat/gen ssh key

Taskfile.yml

@@ -22,6 +22,11 @@ tasks:
     desc: Install all build dependencies
     cmds:
       - task: deps:tools
+      - task: deps:image
+
+  deps:image:
+    desc: Install dependencies required to build application artifacts
+    cmds:
       - task: deps:be
       - task: deps:fe
 

api/projects/keys.go

@@ -140,6 +140,7 @@ func (c *KeyController) AddKey(w http.ResponseWriter, r *http.Request) {
 		helpers.WriteError(w, err)
 		return
 	}
+	key.Plain = newKey.Plain
 
 	helpers.WriteJSON(w, http.StatusCreated, key)
 }

db/AccessKey.go

@@ -45,11 +45,12 @@ type AccessKey struct {
 	// You should use methods SerializeSecret to fill this field.
 	Secret      *string `db:"secret" json:"-" backup:"-"`
 	Plain       *string `db:"plain" json:"plain,omitempty"`
-	IgnorePlain bool
+	IgnorePlain bool    `db:"-" json:"-" backup:"-" `
 
 	String         string        `db:"-" json:"string"`
 	LoginPassword  LoginPassword `db:"-" json:"login_password"`
 	SshKey         SshKey        `db:"-" json:"ssh"`
+	GenerateSSHKey bool          `db:"-" json:"generate_ssh_key,omitempty"`
 	OverrideSecret bool          `db:"-" json:"override_secret,omitempty"`
 
 	StorageID *int `db:"storage_id" json:"-" backup:"-"`

db/sql/access_key.go

@@ -82,7 +82,6 @@ func (d *SqlDb) UpdateAccessKey(key db.AccessKey) error {
 	}
 
 	if key.OverrideSecret {
-
 		query += ", type=?, secret=?, source_storage_id=?, source_storage_key=?, source_storage_type=?"
 		args = append(args, key.Type)
 		args = append(args, key.Secret)

deployment/docker/runner/Dockerfile

@@ -26,7 +26,7 @@ RUN if [ -n "$APP_BUILD_TYPE" ]; then \
 
 RUN --mount=type=cache,target=/go/pkg \
     --mount=type=cache,target=/root/.cache/go-build \
-    task deps APP_BUILD_TYPE=${APP_BUILD_TYPE} && \
+    task deps:image APP_BUILD_TYPE=${APP_BUILD_TYPE} && \
     task build GOOS=${TARGETOS} GOARCH=${TARGETARCH} APP_BUILD_TYPE=${APP_BUILD_TYPE}
 
 

deployment/docker/server/Dockerfile

@@ -26,7 +26,7 @@ RUN if [ -n "$APP_BUILD_TYPE" ]; then \
 
 RUN --mount=type=cache,target=/go/pkg \
     --mount=type=cache,target=/root/.cache/go-build \
-    task deps APP_BUILD_TYPE=${APP_BUILD_TYPE} && \
+    task deps:image APP_BUILD_TYPE=${APP_BUILD_TYPE} && \
     task build GOOS=${TARGETOS} GOARCH=${TARGETARCH} APP_BUILD_TYPE=${APP_BUILD_TYPE}
 
 # renovate: datasource=github-releases depName=opentofu/opentofu

services/server/AccessKey_test.go

@@ -3,6 +3,7 @@ package server
 import (
 	"bytes"
 	"encoding/base64"
+	"encoding/json"
 	"os"
 	"path/filepath"
 	"testing"
@@ -119,6 +120,50 @@ func TestCreateSkipsSerializationForReadOnlyStorage(t *testing.T) {
 	assert.Equal(t, "test", created.Name)
 }
 
+func TestUpdateGeneratesSSHKeyWithoutOverrideSecret(t *testing.T) {
+	projectID := 1
+	key := db.AccessKey{
+		ID:             1,
+		Name:           "generated",
+		Type:           db.AccessKeySSH,
+		ProjectID:      &projectID,
+		GenerateSSHKey: true,
+		OverrideSecret: false,
+	}
+
+	var updated db.AccessKey
+	repo := &mockAccessKeyRepo{
+		keys: []db.AccessKey{{
+			ID:        1,
+			ProjectID: &projectID,
+			Type:      db.AccessKeySSH,
+			Name:      "generated",
+		}},
+		UpdateAccessKeyFn: func(k db.AccessKey) error {
+			updated = k
+			return nil
+		},
+	}
+
+	previousConfig := util.Config
+	util.Config = &util.ConfigType{}
+	t.Cleanup(func() { util.Config = previousConfig })
+	encryptionService := NewAccessKeyEncryptionService(nil, nil, nil, nil)
+	svc := NewAccessKeyService(repo, encryptionService, nil)
+
+	err := svc.Update(key)
+	require.NoError(t, err)
+	require.NotEmpty(t, updated.SshKey.PrivateKey)
+	require.NotNil(t, updated.Plain)
+	require.NotNil(t, updated.Secret)
+	secret, err := base64.StdEncoding.DecodeString(*updated.Secret)
+	require.NoError(t, err)
+	var stored db.SshKey
+	require.NoError(t, json.Unmarshal(secret, &stored))
+	assert.Contains(t, *updated.Plain, "public_key")
+	assert.Equal(t, updated.SshKey.PrivateKey, stored.PrivateKey)
+}
+
 func TestRekeyAccessKeysSkipsExternalStorageKeys(t *testing.T) {
 	projectID := 1
 
@@ -290,7 +335,9 @@ func TestRekeyAccessKeysReStampsToActiveID(t *testing.T) {
 }
 
 type mockAccessKeyRepo struct {
-	keys []db.AccessKey
+	keys              []db.AccessKey
+	UpdateAccessKeyFn func(db.AccessKey) error
+	CreateAccessKeyFn func(db.AccessKey) (db.AccessKey, error)
 }
 
 func (m *mockAccessKeyRepo) GetAccessKey(_ int, keyID int) (db.AccessKey, error) {
@@ -307,8 +354,16 @@ func (m *mockAccessKeyRepo) GetAccessKeyRefs(int, int) (db.ObjectReferrers, erro
 func (m *mockAccessKeyRepo) GetAccessKeys(int, db.GetAccessKeyOptions, db.RetrieveQueryParams) ([]db.AccessKey, error) {
 	return nil, nil
 }
-func (m *mockAccessKeyRepo) UpdateAccessKey(db.AccessKey) error { return nil }
+func (m *mockAccessKeyRepo) UpdateAccessKey(key db.AccessKey) error {
+	if m.UpdateAccessKeyFn != nil {
+		return m.UpdateAccessKeyFn(key)
+	}
+	return nil
+}
 func (m *mockAccessKeyRepo) CreateAccessKey(k db.AccessKey) (db.AccessKey, error) {
+	if m.CreateAccessKeyFn != nil {
+		return m.CreateAccessKeyFn(k)
+	}
 	return k, nil
 }
 func (m *mockAccessKeyRepo) DeleteAccessKey(int, int) error { return nil }

services/server/access_key_svc.go

@@ -1,10 +1,14 @@
 package server
 
 import (
+	"bufio"
+	"bytes"
+	"encoding/json"
 	"errors"
 
 	"github.com/semaphoreui/semaphore/db"
 	"github.com/semaphoreui/semaphore/pkg/common_errors"
+	"github.com/semaphoreui/semaphore/util"
 )
 
 type AccessKeyService interface {
@@ -69,7 +73,50 @@ func (s *AccessKeyServiceImpl) GetAll(projectID int, options db.GetAccessKeyOpti
 	return s.accessKeyRepo.GetAccessKeys(projectID, options, params)
 }
 
+func maybeGenerateSSHPrivateKey(key *db.AccessKey) error {
+	if !key.GenerateSSHKey || key.Type != db.AccessKeySSH {
+		key.Plain = nil
+		return nil
+	}
+
+	var b bytes.Buffer
+	privateKeyFile := bufio.NewWriter(&b)
+
+	publicKey, err := util.GeneratePrivateKey(privateKeyFile)
+	if err != nil {
+		return err
+	}
+
+	err = privateKeyFile.Flush()
+	if err != nil {
+		return err
+	}
+
+	key.SshKey.PrivateKey = b.String()
+	key.SshKey.Passphrase = ""
+
+	type sshPublicKey struct {
+		PublicKey string `json:"public_key"`
+	}
+
+	plainBytes, err := json.Marshal(sshPublicKey{
+		PublicKey: publicKey,
+	})
+	if err != nil {
+		return err
+	}
+
+	plain := string(plainBytes)
+	key.Plain = &plain
+	key.IgnorePlain = false
+	return nil
+}
+
 func (s *AccessKeyServiceImpl) Create(key db.AccessKey) (newKey db.AccessKey, err error) {
+	err = maybeGenerateSSHPrivateKey(&key)
+	if err != nil {
+		return
+	}
 
 	// SerializeSecret encrypts/persists the secret for writable backends. For read-only
 	// external storage the secret is not stored in Semaphore, so SerializeSecret fails
@@ -84,6 +131,15 @@ func (s *AccessKeyServiceImpl) Create(key db.AccessKey) (newKey db.AccessKey, er
 }
 
 func (s *AccessKeyServiceImpl) Update(key db.AccessKey) (err error) {
+	err = maybeGenerateSSHPrivateKey(&key)
+	if err != nil {
+		return
+	}
+
+	if key.GenerateSSHKey && key.Type == db.AccessKeySSH {
+		key.OverrideSecret = true
+	}
+
 	if !key.OverrideSecret {
 		err = s.accessKeyRepo.UpdateAccessKey(key)
 		return

services/server/access_key_svc_test.go

@@ -0,0 +1,93 @@
+package server
+
+import (
+	"encoding/base64"
+	"encoding/json"
+	"testing"
+
+	"github.com/semaphoreui/semaphore/db"
+	"github.com/semaphoreui/semaphore/util"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestAccessKeyService_Update_GeneratedSSHKeyIsPersisted(t *testing.T) {
+	previousConfig := util.Config
+	util.Config = &util.ConfigType{}
+	t.Cleanup(func() { util.Config = previousConfig })
+
+	projectID := 1
+	repo := &mockAccessKeyRepo{
+		keys: []db.AccessKey{{ID: 10, ProjectID: &projectID, Name: "old", Type: db.AccessKeySSH}},
+	}
+
+	var persisted *db.AccessKey
+	repo.UpdateAccessKeyFn = func(k db.AccessKey) error {
+		persisted = &k
+		return nil
+	}
+
+	svc := NewAccessKeyService(repo, NewAccessKeyEncryptionService(repo, nil, nil, nil), nil)
+
+	err := svc.Update(db.AccessKey{
+		ID:             10,
+		ProjectID:      &projectID,
+		Name:           "generated",
+		Type:           db.AccessKeySSH,
+		GenerateSSHKey: true,
+		OverrideSecret: false,
+	})
+
+	require.NoError(t, err)
+	require.NotNil(t, persisted)
+
+	// The generated key must reach the store as a secret override,
+	// otherwise UpdateAccessKey silently skips the secret column.
+	assert.True(t, persisted.OverrideSecret)
+	assert.False(t, persisted.IgnorePlain)
+	require.NotNil(t, persisted.Secret)
+
+	// Without an encryption key configured the secret is base64-encoded.
+	raw, err := base64.StdEncoding.DecodeString(*persisted.Secret)
+	require.NoError(t, err)
+
+	var sshKey db.SshKey
+	require.NoError(t, json.Unmarshal(raw, &sshKey))
+	assert.Contains(t, sshKey.PrivateKey, "PRIVATE KEY")
+	assert.Empty(t, sshKey.Passphrase)
+
+	require.NotNil(t, persisted.Plain)
+	var plain struct {
+		PublicKey string `json:"public_key"`
+	}
+	require.NoError(t, json.Unmarshal([]byte(*persisted.Plain), &plain))
+	assert.NotEmpty(t, plain.PublicKey)
+}
+
+func TestAccessKeyService_Update_NoGenerateNoOverrideKeepsSecret(t *testing.T) {
+	util.Config = &util.ConfigType{}
+
+	projectID := 1
+	repo := &mockAccessKeyRepo{}
+
+	var persisted *db.AccessKey
+	repo.UpdateAccessKeyFn = func(k db.AccessKey) error {
+		persisted = &k
+		return nil
+	}
+
+	svc := NewAccessKeyService(repo, NewAccessKeyEncryptionService(repo, nil, nil, nil), nil)
+
+	err := svc.Update(db.AccessKey{
+		ID:        10,
+		ProjectID: &projectID,
+		Name:      "renamed",
+		Type:      db.AccessKeySSH,
+	})
+
+	require.NoError(t, err)
+	require.NotNil(t, persisted)
+	assert.False(t, persisted.OverrideSecret)
+	assert.Nil(t, persisted.Secret)
+	assert.Nil(t, persisted.Plain)
+}

util/encryption.go

@@ -1,8 +1,6 @@
 package util
 
 import (
-	"bufio"
-	"bytes"
 	"crypto/aes"
 	"crypto/cipher"
 	"crypto/rand"
@@ -13,6 +11,8 @@ import (
 	"errors"
 	"fmt"
 	"io"
+
+	"golang.org/x/crypto/ssh"
 )
 
 // EncryptAESGCM encrypts a plaintext using AES-256-GCM with the given base64-encoded key. If the key is empty, it returns the plaintext as base64.
@@ -90,23 +90,12 @@ func GeneratePrivateKey(privateKeyFile io.Writer) (publicKey string, err error)
 		return
 	}
 
-	publicKeyBytes := x509.MarshalPKCS1PublicKey(&privateKey.PublicKey)
-	publicKeyPem := &pem.Block{
-		Type:  "PUBLIC KEY",
-		Bytes: publicKeyBytes,
-	}
-
-	var b bytes.Buffer
-	publicKeyFile := bufio.NewWriter(&b)
-
-	if err = pem.Encode(publicKeyFile, publicKeyPem); err != nil {
-		return
-	}
-
-	if err = publicKeyFile.Flush(); err != nil {
+	// 4. Encode the public key in OpenSSH authorized_keys format
+	sshPublicKey, err := ssh.NewPublicKey(&privateKey.PublicKey)
+	if err != nil {
 		return
 	}
 
-	publicKey = b.String()
+	publicKey = string(ssh.MarshalAuthorizedKey(sshPublicKey))
 	return
 }