internal/cli/ca.go

Ref: main v0.0.5   Size: 1.2 KiB   History

package cli

import (
	"context"
	"fmt"
	"os"

	"golang.org/x/crypto/ssh"

	"github.com/a73x/eitri/internal/server/api/client"
)

// UploadUserCA registers the user-CA public key in pubFile with the server
// under the PAT token. An empty tenant registers on the token's own tenant (the
// credential names it); a non-empty tenant pins one explicitly. The key is
// parse-validated locally — garbage is rejected before it leaves the machine —
// and the returned summary line carries the locally computed fingerprint
// (identical to the server's echo: both fingerprint the same key), naming the
// tenant only when we pinned one.
func UploadUserCA(ctx context.Context, baseURL, token, tenant, pubFile string) (string, error) {
	pub, err := os.ReadFile(pubFile)
	if err != nil {
		return "", err
	}
	pk, _, _, _, err := ssh.ParseAuthorizedKey(pub)
	if err != nil {
		return "", fmt.Errorf("%s: not an SSH public key: %w", pubFile, err)
	}
	c := &client.Client{BaseURL: baseURL, Token: token}
	if err := c.UploadUserCA(ctx, tenant, string(pub)); err != nil {
		return "", err
	}
	fp := ssh.FingerprintSHA256(pk)
	if tenant == "" {
		return fmt.Sprintf("registered user CA %s", fp), nil
	}
	return fmt.Sprintf("registered user CA %s for tenant %s", fp, tenant), nil
}