Replace the raw errors.New private key path failures, the duplicated
algorithm mismatch gin.H response and the ad hoc 500 for a failed key
removal with scoped errors (ErrPrivateKeyPathRequired,
ErrPrivateKeyPathNotAbsolute, ErrKeyfileDelete in host_setup;
ErrHostKeyAlgorithmMismatch in host_ssh). Validation failures keep their
400 status via abortBadRequest, the remove failure goes through
cosy.ErrHandler.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
POST host/setup/known-host and hostSetup.trustHostKey had no UI callers
and were a weaker duplicate of host-key/trust, which checks the algorithm
and requires explicit confirmation. hostssh.ScanHostKeys had no callers
and ClassifyHostKeys was only used by tests; the tests now exercise
ClassifyScannedHostKeys like production code does. forgetDetected in the
wizard composable was exported but unused.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Use settings.DefaultHostKnownHostsPath instead of repeating the literal,
and add setup.IsPersistedDataPath so the verify pipeline and the host key
scan handler share one definition of the persisted data directory.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
- Reject the whole host/setup group in demo mode.
- Require a verified two-factor session (or a proxied node principal) for
every endpoint that writes SSH material or opens an outbound connection,
sharing the guard with POST settings/nginx/control via internal/middleware.
- Validate host_address before it reaches known_hosts, where a comma,
wildcard or newline would trust a key for other hosts.
- Only read the public key of an unmanaged private key path for a verified
session, so the endpoint stops being a container-wide file oracle.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Align known_hosts defaults across setup and runtime, require explicit host key confirmation from the UI, and persist the host SSH wizard settings needed by verification and runner flows.
- Adds ErrPublicKeyParse (510010) so TrustHostKey returns a semantically
correct error instead of reusing ErrHostKeyMismatch's expected/got template.
- The TrustHostKey HTTP handler now recomputes the SHA256 fingerprint of
the submitted public key and rejects requests where the client-confirmed
fingerprint does not match. Closes a security gap where a tampered
request body could install an unverified key in known_hosts.
Adds /api/host/setup/{preview,keypair,publickey,verify,known-host} and
wires the CLI 'host-setup test' subcommand through the shared
setup.NewClientFromSettings + setup.Verify helpers introduced in this
commit. Mounted under the authenticated router group.
