feat(M2): SSH 密钥管理 — 公钥上传/重命名/吊销、authorized_keys 原子同步与吊销即时失效

- KeyService：crypto/ssh 解析校验（单行/类型/长度/去重指纹，拒 ssh-dss 与 RSA<2048）， Create/Rename/Revoke/List，变更后以 DB 状态全量重写 authorized_keys（同步失败回滚） - system 层：SyncAuthorizedKeys 完善 —— sudo 模式经白名单命令（mkdir/chown/chmod/install）落位并修正属主（sshd StrictModes），direct 模式 root 时同样修正属主；dry-run 计划日志 - API：GET/POST /me/keys、PATCH/DELETE /me/keys/:id（user 会话）、GET /users/:id/keys（admin），密钥操作带审计；deploy/sudoers.example 补充密钥同步白名单 - 版本 0.3.0-m2；测试：service 单元（校验/生命周期/回滚/权限）、system 直写落盘、 API 全流程集成；容器 E2E 32 项 PASS（真实 useradd/authorized_keys/吊销即时失效/禁用清空/删除回收）
2026-08-29 23:55:39 +08:00
parent 630d240dc0
commit a5f501dba4
15 changed files with 998 additions and 59 deletions
@@ -3,15 +3,20 @@ package api_test
 import (
 	"bytes"
 	"context"
+	"crypto/ed25519"
+	"crypto/rand"
 	"encoding/json"
 	"io"
 	"log/slog"
 	"net/http"
 	"net/http/httptest"
 	"strconv"
+	"strings"
+	"sync"
 	"testing"

 	"github.com/gin-gonic/gin"
+	"golang.org/x/crypto/ssh"
 	"gorm.io/gorm"

 	"ws_usernode/internal/api"
@@ -37,7 +42,32 @@ func (m *recordingMailer) Send(_ context.Context, to, subject, body string) erro
 	return nil
 }

-// testApp 完整组装的应用（SQLite 内存库 + dry-run 系统层）。
+// recordingSys 记录 authorized_keys 同步内容，用于断言上传/吊销/禁用即时生效。
+type recordingSys struct {
+	mu   sync.Mutex
+	keys map[string][]system.Key // username -> 最后一次同步的密钥
+}
+
+func newRecordingSys() *recordingSys { return &recordingSys{keys: map[string][]system.Key{}} }
+
+func (s *recordingSys) CreateUser(_ context.Context, _ system.Account) error { return nil }
+func (s *recordingSys) RemoveUser(_ context.Context, _ string) error         { return nil }
+func (s *recordingSys) SetLock(_ context.Context, _ string, _ bool) error    { return nil }
+func (s *recordingSys) Exists(_ context.Context, _ string) (bool, error)     { return true, nil }
+func (s *recordingSys) SyncAuthorizedKeys(_ context.Context, username string, keys []system.Key) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.keys[username] = keys
+	return nil
+}
+
+func (s *recordingSys) synced(username string) []system.Key {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.keys[username]
+}
+
+// testApp 完整组装的应用（SQLite 内存库 + 可注入系统层）。
 type testApp struct {
 	r        http.Handler
 	db       *gorm.DB
@@ -47,6 +77,11 @@ type testApp struct {
 }

 func setupTestApp(t *testing.T) *testApp {
+	return setupTestAppWithSys(t, system.New(config.Default().System, slog.New(slog.NewTextHandler(io.Discard, nil))))
+}
+
+// setupTestAppWithSys 允许注入 system.Manager（观察 authorized_keys 同步等）。
+func setupTestAppWithSys(t *testing.T, sys system.Manager) *testApp {
 	t.Helper()
 	gin.SetMode(gin.TestMode)
 	db, err := model.Open("sqlite", ":memory:", false)
@@ -59,9 +94,9 @@ func setupTestApp(t *testing.T) *testApp {
 	cfg := config.Default()
 	cfg.System.DryRun = true // 集成测试走 dry-run，不触碰真实系统账号

-	sys := system.New(cfg.System)
 	adminSvc := service.NewAdminService(db)
 	userSvc := service.NewUserService(db, sys, cfg)
+	keySvc := service.NewKeyService(db, sys, cfg)
 	auditSvc := service.NewAuditService(db)

 	captchas := auth.NewMemoryCaptchaStore(cfg.Auth.CaptchaTTL)
@@ -73,7 +108,7 @@ func setupTestApp(t *testing.T) *testApp {
 	log := slog.New(slog.NewTextHandler(io.Discard, nil))
 	authSvc := service.NewAuthService(db, cfg, otps, captchas, sessions, resets, limiter, mailer, userSvc, adminSvc, auditSvc, log)

-	h := api.New(cfg, authSvc, userSvc, auditSvc)
+	h := api.New(cfg, authSvc, userSvc, keySvc, auditSvc)
 	r := router.New(cfg, h, sessions, log)

 	if _, err := adminSvc.Create(context.Background(), "root", "Passw0rd", "root@example.com"); err != nil {
@@ -324,3 +359,124 @@ func TestAPIAdminForgotReset(t *testing.T) {
 func itoa(u uint) string {
 	return strconv.FormatUint(uint64(u), 10)
 }
+
+func TestAPIKeyLifecycle(t *testing.T) {
+	rec := newRecordingSys()
+	app := setupTestAppWithSys(t, rec)
+
+	// 管理员创建外部用户
+	w := app.doJSON(http.MethodPost, "/api/v1/auth/admin/login", map[string]string{"username": "root", "password": "Passw0rd"})
+	ck := sessionCookie(t, w)
+	w = app.doJSON(http.MethodPost, "/api/v1/users", map[string]any{"username": "wangwu", "email": "ww@example.com"}, ck)
+	if w.Code != http.StatusOK {
+		t.Fatalf("create user status = %d, body=%s", w.Code, w.Body.String())
+	}
+	userID := uint(decodeBody(t, w)["data"].(map[string]any)["id"].(float64))
+
+	// 外部用户 OTP 登录
+	cap, err := app.captchas.New()
+	if err != nil {
+		t.Fatalf("captcha new: %v", err)
+	}
+	w = app.doJSON(http.MethodPost, "/api/v1/auth/otp/send", map[string]any{"username": "ext_wangwu", "captcha_id": cap.ID, "captcha_code": cap.Text})
+	if w.Code != http.StatusOK {
+		t.Fatalf("otp send status = %d, body=%s", w.Code, w.Body.String())
+	}
+	code, err := app.otps.Current(context.Background(), "ext_wangwu")
+	if err != nil {
+		t.Fatalf("otp current: %v", err)
+	}
+	w = app.doJSON(http.MethodPost, "/api/v1/auth/otp/login", map[string]string{"username": "ext_wangwu", "code": code})
+	if w.Code != http.StatusOK {
+		t.Fatalf("otp login status = %d, body=%s", w.Code, w.Body.String())
+	}
+	userCk := sessionCookie(t, w)
+
+	// 未登录访问 /me/keys → 401
+	w = app.doJSON(http.MethodGet, "/api/v1/me/keys", nil)
+	if w.Code != http.StatusUnauthorized {
+		t.Fatalf("unauth me/keys status = %d, want 401", w.Code)
+	}
+
+	// 上传公钥 → 同步到 authorized_keys
+	pub := testSSHPubKey(t)
+	w = app.doJSON(http.MethodPost, "/api/v1/me/keys", map[string]any{"name": "workstation", "public_key": pub}, userCk)
+	if w.Code != http.StatusOK {
+		t.Fatalf("create key status = %d, body=%s", w.Code, w.Body.String())
+	}
+	key := decodeBody(t, w)["data"].(map[string]any)
+	keyID := uint(key["id"].(float64))
+	if key["fingerprint"] == "" || key["status"] != "active" {
+		t.Fatalf("key fields: %v", key)
+	}
+	if synced := rec.synced("ext_wangwu"); len(synced) != 1 {
+		t.Fatalf("after create synced = %+v, want 1 key", synced)
+	}
+
+	// 重复上传同一公钥 → 409
+	w = app.doJSON(http.MethodPost, "/api/v1/me/keys", map[string]any{"name": "dup", "public_key": pub}, userCk)
+	if w.Code != http.StatusConflict {
+		t.Fatalf("duplicate key status = %d, want 409", w.Code)
+	}
+
+	// 列表
+	w = app.doJSON(http.MethodGet, "/api/v1/me/keys", nil, userCk)
+	if w.Code != http.StatusOK {
+		t.Fatalf("list keys status = %d", w.Code)
+	}
+	if items := decodeBody(t, w)["data"].(map[string]any)["items"].([]any); len(items) != 1 {
+		t.Fatalf("list items = %d, want 1", len(items))
+	}
+
+	// 重命名
+	w = app.doJSON(http.MethodPatch, "/api/v1/me/keys/"+itoa(keyID), map[string]any{"name": "home-laptop"}, userCk)
+	if w.Code != http.StatusOK {
+		t.Fatalf("rename status = %d, body=%s", w.Code, w.Body.String())
+	}
+	if name := decodeBody(t, w)["data"].(map[string]any)["name"]; name != "home-laptop" {
+		t.Fatalf("renamed = %v", name)
+	}
+
+	// 管理员查看用户密钥；外部用户访问 admin 接口 → 403
+	w = app.doJSON(http.MethodGet, "/api/v1/users/"+itoa(userID)+"/keys", nil, ck)
+	if w.Code != http.StatusOK {
+		t.Fatalf("admin list keys status = %d, body=%s", w.Code, w.Body.String())
+	}
+	if items := decodeBody(t, w)["data"].(map[string]any)["items"].([]any); len(items) != 1 {
+		t.Fatalf("admin items = %d, want 1", len(items))
+	}
+	w = app.doJSON(http.MethodGet, "/api/v1/users/"+itoa(userID)+"/keys", nil, userCk)
+	if w.Code != http.StatusForbidden {
+		t.Fatalf("user access admin keys status = %d, want 403", w.Code)
+	}
+
+	// 吊销 → authorized_keys 清空（立即失效），状态 revoked；再次吊销幂等
+	w = app.doJSON(http.MethodDelete, "/api/v1/me/keys/"+itoa(keyID), nil, userCk)
+	if w.Code != http.StatusOK {
+		t.Fatalf("revoke status = %d, body=%s", w.Code, w.Body.String())
+	}
+	if status := decodeBody(t, w)["data"].(map[string]any)["status"]; status != "revoked" {
+		t.Fatalf("revoked status = %v", status)
+	}
+	if synced := rec.synced("ext_wangwu"); len(synced) != 0 {
+		t.Fatalf("after revoke synced = %+v, want empty", synced)
+	}
+	w = app.doJSON(http.MethodDelete, "/api/v1/me/keys/"+itoa(keyID), nil, userCk)
+	if w.Code != http.StatusOK {
+		t.Fatalf("revoke again status = %d", w.Code)
+	}
+}
+
+// testSSHPubKey 生成一条合法的 ed25519 公钥行。
+func testSSHPubKey(t *testing.T) string {
+	t.Helper()
+	pub, _, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		t.Fatalf("gen ed25519: %v", err)
+	}
+	sshPub, err := ssh.NewPublicKey(pub)
+	if err != nil {
+		t.Fatalf("ssh key: %v", err)
+	}
+	return strings.TrimSpace(string(ssh.MarshalAuthorizedKey(sshPub)))
+}