b76d6744

feat(cli): one guided command stands between a token and a first shell

a73x 2026-08-11 15:18

Commit message

feat(cli): one guided command stands between a token and a first shell

`eitri init` is the first run. It asks for a personal access token, proves it
against /api/v1/me, settles the tenant's SSH CA, and writes the config every
other command reads — printing what each step will do and doing it only on a
yes. Afterwards `eitri ssh <vm>` needs no environment at all: the config names
the plane and the tenant, the certificate is signed locally, and the host-CA
pin comes from a public endpoint.

The CA step never blind-generates, because a CA is an identity and a second one
where a first exists is how a laptop ends up signing certs that are perfectly
formed and refused by every guest. It lists what the tenant has registered,
recognizes the key already on this machine, offers to register a key found
elsewhere, and only when there is neither offers to make one — naming both
files and their modes first. A signing key that matches nothing the tenant
registered is called out in those words, rather than left to arrive later as a
bare permission denied.

The client gains a config file, ~/.eitri/config.json, resolved beneath the
environment: an EITRI_* variable overrides it, it overrides the hosted
defaults. A file that exists but does not parse is named rather than silently
replaced by a default, and it is written through a rename so an interrupted
init leaves the previous config whole.

The gate stops being a constant the client assumes. A plane names its own on
/me, so `eitri ssh` takes it from there when nothing pins it, and the hosted
address survives only as the rung below — for a server too old to send the
field, or a pinned tenant with no credential to ask with. One /me probe now
answers both halves of a connect name, identity and plane.

docs/quickstart.md

Old		New
@@ -123,15 +123,13 @@ a Mac's guests sit on vmnet's subnet. The host reports that subnet to the fleet,
123	so it is what the console shows—no allocation is made for a Mac and none is	123	so it is what the console shows—no allocation is made for a Mac and none is
124	used. Everything above that—`eitri ssh`, the console, reconcile—is the same.	124	used. Everything above that—`eitri ssh`, the console, reconcile—is the same.
125		125
126	### Register your CA	126	### Set up your laptop
127		127
128	SSH access uses certificates signed by your CA—eitri never holds a	128	SSH access uses certificates signed by your CA—eitri never holds a
129	user key that can enter your VMs. A guest trusts the CA set it is created with,	129	user key that can enter your VMs. A guest trusts the CA set it is created with,
130	so this comes before your first VM.	130	so this comes before your first VM.
131		131
132	On your laptop, download the client CLI. It	132	Download the client CLI. It targets the hosted service by default:
133	targets the hosted service by default, so the only thing to set is a personal
134	access token:
135		133
136	```sh	134	```sh
137	OS=$(uname -s \| tr A-Z a-z) ARCH=amd64 # arm64 laptop → ARCH=arm64	135	OS=$(uname -s \| tr A-Z a-z) ARCH=amd64 # arm64 laptop → ARCH=arm64
@@ -141,13 +139,43 @@ curl -fsSLO "https://eitri.sh/dl/latest/eitri-cli_${V}_${OS}_${ARCH}.tar.gz"
141	sha256sum -c SHA256SUMS --ignore-missing	139	sha256sum -c SHA256SUMS --ignore-missing
142	tar xzf "eitri-cli_${V}_${OS}_${ARCH}.tar.gz"	140	tar xzf "eitri-cli_${V}_${OS}_${ARCH}.tar.gz"
143	sudo install -m 0755 "eitri-cli_${V}_${OS}_${ARCH}/eitri" /usr/local/bin/eitri	141	sudo install -m 0755 "eitri-cli_${V}_${OS}_${ARCH}/eitri" /usr/local/bin/eitri
		142	```
		143
		144	Then run the guided setup:
144		145
145	export EITRI_TOKEN=<pat> # mint one in the console → Settings → Personal access tokens	146	```sh
		147	eitri init
146	```	148	```
147		149
148	Register a user CA once—eitri gets the public key, never the private one:	150	It asks for a personal access token—mint one in the console under **Settings →
		151	Personal access tokens**—and walks three steps, printing what each will do and
		152	doing it only on a `y`:
		153
		154	1. Identity. Calls `/api/v1/me` with the token to learn your tenant and
		155	which SSH gate this plane runs. The token is used once and never stored;
		156	entered at the prompt it is not echoed.
		157	2. CA. Lists the CAs your tenant has already registered. If the signing key
		158	on this laptop is one of them, there is nothing to do. If you have a key it
		159	does not know—here or at a path you give it—init offers to register the
		160	public half. Only when there is neither does it offer to generate an ed25519
		161	pair, naming both files and their modes before writing anything.
		162	3. Config. Writes `~/.eitri/config.json`—plane, gate, tenant, CA and key
		163	paths—after showing the current values beside what would change.
		164
		165	Run it again whenever: each step reports what is already settled and touches
		166	nothing. It is also how you find out that the key on this laptop signs certs
		167	your tenant never registered—the failure that otherwise arrives as a bare
		168	"permission denied" from a guest that was never going to trust you.
		169
		170	After init, `eitri ssh` needs no environment at all: the config names the plane
		171	and the tenant, the certificate is signed locally, and the host-CA pin comes
		172	from a public endpoint. Every `EITRI_*` variable still overrides the file, and
		173	the file still overrides the hosted defaults.
		174
		175	By hand instead—`eitri init` does exactly this, and asks first:
149		176
150	```sh	177	```sh
		178	export EITRI_TOKEN=<pat>
151	ssh-keygen -t ed25519 -N '' -f ~/.ssh/eitri_user_ca -C "my eitri user CA"	179	ssh-keygen -t ed25519 -N '' -f ~/.ssh/eitri_user_ca -C "my eitri user CA"
152	eitri ca upload ~/.ssh/eitri_user_ca.pub	180	eitri ca upload ~/.ssh/eitri_user_ca.pub
153	```	181	```
@@ -171,14 +199,18 @@ tool—then create the VM.
171		199
172	### SSH in	200	### SSH in
173		201
174	The console and gate are hosted defaults, and `eitri ssh` uses	202	`eitri init` wrote the plane, the gate and your tenant, so there is nothing
175	your token to look up your tenant for the connect name—nothing else to set:	203	left to set:
176		204
177	```sh	205	```sh
178	eitri ssh <vm-name>	206	eitri ssh <vm-name>
179	eitri ssh <vm-name> uptime	207	eitri ssh <vm-name> uptime
180	```	208	```
181		209
		210	Skipped init? The console and gate fall back to the hosted defaults, and
		211	`EITRI_TOKEN` alone is enough—`eitri ssh` asks the plane for your tenant and
		212	its gate.
		213
182	### Expose a service	214	### Expose a service
183		215
184	The gate reaches a guest over SSH. Anything else a guest serves needs a	216	The gate reaches a guest over SSH. Anything else a guest serves needs a
@@ -427,6 +459,17 @@ public key, never the private one. On your laptop:
427	tar xzf eitri-cli__$(uname -s \| tr A-Z a-z)_.tar.gz	459	tar xzf eitri-cli__$(uname -s \| tr A-Z a-z)_.tar.gz
428	sudo install -m 0755 eitri-cli_*/eitri /usr/local/bin/eitri	460	sudo install -m 0755 eitri-cli_*/eitri /usr/local/bin/eitri
429		461
		462	EITRI_URL=http://192.0.2.10:8080 eitri init
		463	```
		464
		465	`EITRI_URL` points the first run at your box; init writes it to
		466	`~/.eitri/config.json` along with your tenant and the gate address the server
		467	names on `/api/v1/me`, so later runs need neither variable. The three steps and
		468	what each confirms are described under "Set up your laptop" above.
		469
		470	By hand instead:
		471
		472	```sh
430	export EITRI_URL=http://192.0.2.10:8080	473	export EITRI_URL=http://192.0.2.10:8080
431	export EITRI_TOKEN=<pat> # mint one in the console → Settings	474	export EITRI_TOKEN=<pat> # mint one in the console → Settings
432		475
@@ -444,15 +487,15 @@ guest boots, then `ready`. Power reads `running`, an IP appears, you're on.
444	### SSH in	487	### SSH in
445		488
446	```sh	489	```sh
447	export EITRI_URL=http://192.0.2.10:8080 # set earlier, when you booted the VM
448	export EITRI_GATE=192.0.2.10:2222 # must match ssh_gate_domain
449
450	eitri ssh <vm-name>	490	eitri ssh <vm-name>
451	eitri ssh <vm-name> uptime	491	eitri ssh <vm-name> uptime
452	```	492	```
453		493
454	Unset, `EITRI_URL` and `EITRI_GATE` default to the hosted service at eitri.sh,	494	`eitri init` wrote the plane and the gate, so nothing needs exporting. Without
455	so self-hosting always sets them to your own box.	495	a config, `EITRI_URL` must name your box—unset it defaults to the hosted
		496	service at eitri.sh—and the gate comes from that server's `/api/v1/me`, which
		497	serves whatever `ssh_gate_domain` and `ssh_listen` say. `EITRI_GATE` overrides
		498	it either way, for a server behind a different address than it advertises.
456		499
457	`eitri ssh` is plain ssh in a trenchcoat: it signs a short-lived cert with	500	`eitri ssh` is plain ssh in a trenchcoat: it signs a short-lived cert with
458	your CA, pins eitri's host CA, and jumps the gate to `ubuntu@<tenant>.<vm-name>`	501	your CA, pins eitri's host CA, and jumps the gate to `ubuntu@<tenant>.<vm-name>`

internal/cli/config.go

@@ @@ -0,0 +1,106 @@ @@
+package cli
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+)
+// Config is the client's on-disk settings, written by `eitri init` and read by
+// every command underneath the environment. It holds the two facts a connect
+// name needs — which plane, which tenant — and the paths of the keys that sign
+// for it, so a laptop that has run init needs no EITRI_* variable at all: not
+// even a token, since minting a cert is local and the host-CA pin comes from a
+// public endpoint.
+//
+// It never holds a credential. A PAT is typed, used to ask the plane who you
+// are, and forgotten; nothing here is secret, and a leaked config leaks only
+// where you keep your keys.
+type Config struct {
+	URL    string `json:"url,omitempty"`
+	Gate   string `json:"gate,omitempty"`
+	Tenant string `json:"tenant,omitempty"`
+	CA     string `json:"ca,omitempty"`
+	Key    string `json:"key,omitempty"`
+}
+// The known-hosts pin file is deliberately absent: it is a cache eitri rewrites
+// on every connect, not a setting, and EITRI_KNOWN_HOSTS still moves it.
+// ConfigPath is where the client keeps its settings: EITRI_CONFIG, else
+// ~/.eitri/config.json — the same ~/.eitri a Mac agent keeps its state under.
+func ConfigPath() (string, error) {
+	if p := os.Getenv("EITRI_CONFIG"); p != "" {
+		return p, nil
+	}
+	home, err := os.UserHomeDir()
+	if err != nil {
+		return "", err
+	}
+	return filepath.Join(home, ".eitri", "config.json"), nil
+}
+// LoadConfig reads the config at path. A missing file is the zero Config and no
+// error — an unconfigured laptop is the normal case, and every field falls back.
+// A file that exists but does not parse is an error naming the path: treating it
+// as empty would hide a half-written config behind whatever default happened to
+// apply, and the user would be told nothing while talking to the wrong plane.
+func LoadConfig(path string) (Config, error) {
+	raw, err := os.ReadFile(path)
+	if errors.Is(err, os.ErrNotExist) {
+		return Config{}, nil
+	}
+	if err != nil {
+		return Config{}, err
+	}
+	var c Config
+	if err := json.Unmarshal(raw, &c); err != nil {
+		return Config{}, fmt.Errorf("%s: not readable as an eitri config (delete it and run 'eitri init'): %w", path, err)
+	}
+	return c, nil
+}
+// SaveConfig writes c to path through a temp file in the same directory and a
+// rename, so what is on disk is always a whole config: an interrupted write
+// leaves the previous file untouched rather than a truncated one for the next
+// run to trip over.
+func SaveConfig(path string, c Config) error {
+	dir := filepath.Dir(path)
+	if err := os.MkdirAll(dir, 0o700); err != nil {
+		return err
+	}
+	raw, err := json.MarshalIndent(c, "", "  ")
+	if err != nil {
+		return err
+	}
+	f, err := os.CreateTemp(dir, ".config-*.json")
+	if err != nil {
+		return err
+	}
+	tmp := f.Name()
+	defer os.Remove(tmp)
+	if err := f.Chmod(0o600); err != nil {
+		f.Close()
+		return err
+	}
+	if _, err := f.Write(append(raw, '\n')); err != nil {
+		f.Close()
+		return err
+	}
+	if err := f.Close(); err != nil {
+		return err
+	}
+	return os.Rename(tmp, path)
+}
+// ConfigFromDisk loads the config from its resolved path — the pairing FromEnv
+// uses, and the one `eitri init` reads to show what it would change.
+func ConfigFromDisk() (Config, error) {
+	path, err := ConfigPath()
+	if err != nil {
+		return Config{}, err
+	}
+	return LoadConfig(path)
+}

internal/cli/config_test.go

@@ @@ -0,0 +1,82 @@ @@
+package cli
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+// A laptop that has never run init has no config, and that is not a failure —
+// every field simply falls back.
+func TestLoadConfigMissingIsEmpty(t *testing.T) {
+	c, err := LoadConfig(filepath.Join(t.TempDir(), "nothing.json"))
+	if err != nil {
+		t.Fatalf("a missing config must not be an error: %v", err)
+	}
+	if c != (Config{}) {
+		t.Errorf("config = %+v, want zero", c)
+	}
+}
+// A file that exists but does not parse is named, not swallowed: this is the
+// half-written config an aborted init could leave, and the user must be told
+// rather than quietly served a default.
+func TestLoadConfigUnreadableIsNamed(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "config.json")
+	if err := os.WriteFile(path, []byte("{not json"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	_, err := LoadConfig(path)
+	if err == nil || !strings.Contains(err.Error(), path) {
+		t.Fatalf("want an error naming %s, got %v", path, err)
+	}
+}
+func TestSaveConfigRoundTrips(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "sub", "config.json")
+	want := Config{URL: "http://192.0.2.10:8080", Gate: "192.0.2.10:2222", Tenant: "acme", CA: "/keys/ca", Key: "/keys/user"}
+	if err := SaveConfig(path, want); err != nil {
+		t.Fatal(err)
+	}
+	got, err := LoadConfig(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got != want {
+		t.Errorf("round trip: got %+v want %+v", got, want)
+	}
+	fi, err := os.Stat(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if perm := fi.Mode().Perm(); perm != 0o600 {
+		t.Errorf("mode = %o, want 600", perm)
+	}
+	// The rename is the point: no temp file may be left behind to be found by
+	// a later glob or backup.
+	entries, err := os.ReadDir(filepath.Dir(path))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(entries) != 1 {
+		t.Errorf("directory holds %d files, want only the config", len(entries))
+	}
+}
+// EITRI_CONFIG moves the file; unset, it sits under ~/.eitri.
+func TestConfigPath(t *testing.T) {
+	t.Setenv("EITRI_CONFIG", "/tmp/elsewhere.json")
+	if p, err := ConfigPath(); err != nil || p != "/tmp/elsewhere.json" {
+		t.Errorf("EITRI_CONFIG: got %q, %v", p, err)
+	}
+	t.Setenv("EITRI_CONFIG", "")
+	t.Setenv("HOME", "/home/u")
+	p, err := ConfigPath()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if want := filepath.Join("/home/u", ".eitri", "config.json"); p != want {
+		t.Errorf("default path = %q, want %q", p, want)
+	}
+}

internal/cli/env.go

Old		New
@@ -10,55 +10,59 @@ import (
10	"path/filepath"	10	"path/filepath"
11	)	11	)
12		12
13	// Hosted-service defaults: unset, the CLI targets the hosted service at	13	// Hosted-service defaults: unset and unconfigured, the CLI targets the hosted
14	// eitri.sh, so a fresh laptop needs no configuration to reach it. Self-hosters	14	// service at eitri.sh, so a fresh laptop needs no configuration to reach it.
15	// and tests point elsewhere by setting the matching environment variable.	15	// Self-hosters and tests point elsewhere by setting the matching environment
		16	// variable or by running `eitri init`.
		17	//
		18	// defaultGate is the weaker of the two. A plane names its own gate on /me, so
		19	// this address is only what a client assumes when nothing has told it better:
		20	// no EITRI_GATE, no config, and either no credential to ask with or a server
		21	// old enough to answer /me without ssh_gate.
16	const (	22	const (
17	defaultURL = "https://console.eitri.sh"	23	defaultURL = "https://console.eitri.sh"
18	defaultGate = "gate.eitri.sh:2222"	24	defaultGate = "gate.eitri.sh:2222"
19	)	25	)
20		26
21	// Env is the client configuration, resolved from EITRI_* variables.	27	// Env is the client configuration, resolved from EITRI_* variables over the
		28	// config file.
22	type Env struct {	29	type Env struct {
23	URL string // server base URL (EITRI_URL, else the hosted default)	30	URL string // server base URL (EITRI_URL, else config, else the hosted default)
24	Gate string // gate host[:port] (EITRI_GATE, else the hosted default)	31	Gate string // gate host[:port] (EITRI_GATE, else config, else the plane's own answer)
25	CA string // tenant user-CA private key path	32	CA string // tenant user-CA private key path
26	Tenant string	33	Tenant string
27	Key string // user SSH private key path	34	Key string // user SSH private key path
28	KnownHosts string // dedicated pin file — never the user's main known_hosts	35	KnownHosts string // dedicated pin file — never the user's main known_hosts
29	}	36	}
30		37
31	// URLFromEnv is the server base URL: EITRI_URL, or the hosted-service default.	38	// FromEnv resolves the client configuration: an EITRI_* variable when set, else
32	// It is the SINGLE source of that default — every consumer (ssh and ca alike)	39	// the value `eitri init` wrote to the config file, else a default. It is the
33	// resolves the URL through it, so the default string is written in exactly one	40	// SINGLE door onto both — every consumer (ssh, ca, init alike) resolves through
34	// place.	41	// it, so each precedence rule is written in exactly one place.
35	func URLFromEnv() string {	42	//
36	if u := os.Getenv("EITRI_URL"); u != "" {	43	// The environment sits above the file because it is the per-invocation
37	return u	44	// override; the file sits above the defaults because it is the user's own
38	}	45	// deliberate answer. Gate is the one field with a rung below the file: left
39	return defaultURL	46	// empty here, `eitri ssh` asks the plane for it (see resolvePlane) rather than
40	}	47	// assuming the hosted address.
41		48	//
42	// FromEnv resolves the client configuration. The CLI's defaults are the hosted	49	// Tenant is optional at this layer — `eitri ssh` derives it from the credential
43	// service at eitri.sh: EITRI_URL falls back to the hosted console and	50	// via /me when nothing pins it, so the user never has to type it; a pinned
44	// EITRI_GATE to the hosted gate, so nothing needs setting to reach it;	51	// tenant is the offline path and the way to disambiguate a user CA registered
45	// self-hosters and tests override via the environment. EITRI_TENANT is optional	52	// in more than one tenant. The path fields default under $HOME/.ssh.
46	// — `eitri ssh` derives the tenant from the credential (via /me) to build the
47	// namespaced connect name, so it is only needed offline or to disambiguate a
48	// user CA registered in more than one tenant. The path fields default under
49	// $HOME/.ssh.
50	func FromEnv() (Env, error) {	53	func FromEnv() (Env, error) {
		54	cfg, err := ConfigFromDisk()
		55	if err != nil {
		56	return Env{}, err
		57	}
51	e := Env{	58	e := Env{
52	URL: URLFromEnv(),	59	URL: firstNonEmpty(os.Getenv("EITRI_URL"), cfg.URL, defaultURL),
53	Gate: os.Getenv("EITRI_GATE"),	60	Gate: firstNonEmpty(os.Getenv("EITRI_GATE"), cfg.Gate),
54	CA: os.Getenv("EITRI_CA"),	61	CA: firstNonEmpty(os.Getenv("EITRI_CA"), cfg.CA),
55	Tenant: os.Getenv("EITRI_TENANT"),	62	Tenant: firstNonEmpty(os.Getenv("EITRI_TENANT"), cfg.Tenant),
56	Key: os.Getenv("EITRI_KEY"),	63	Key: firstNonEmpty(os.Getenv("EITRI_KEY"), cfg.Key),
57	KnownHosts: os.Getenv("EITRI_KNOWN_HOSTS"),	64	KnownHosts: os.Getenv("EITRI_KNOWN_HOSTS"),
58	}	65	}
59	if e.Gate == "" {
60	e.Gate = defaultGate
61	}
62	home, err := os.UserHomeDir()	66	home, err := os.UserHomeDir()
63	if err != nil {	67	if err != nil {
64	return Env{}, err	68	return Env{}, err
@@ -73,3 +77,14 @@ func FromEnv() (Env, error) {
73	def(&e.KnownHosts, "eitri_known_hosts")	77	def(&e.KnownHosts, "eitri_known_hosts")
74	return e, nil	78	return e, nil
75	}	79	}
		80
		81	// firstNonEmpty returns the first set value — the shape every precedence chain
		82	// in this package takes.
		83	func firstNonEmpty(vals ...string) string {
		84	for _, v := range vals {
		85	if v != "" {
		86	return v
		87	}
		88	}
		89	return ""
		90	}

internal/cli/env_test.go

Old		New
@@ -1,17 +1,36 @@
1	package cli	1	package cli
2		2
3	import (	3	import (
		4	"os"
4	"path/filepath"	5	"path/filepath"
		6	"strings"
5	"testing"	7	"testing"
6	)	8	)
7		9
		10	// cleanEnv isolates a test from the developer's own laptop: every EITRI_*
		11	// variable unset, and the config file pointed at an empty temp dir so FromEnv
		12	// cannot read a real ~/.eitri/config.json. It returns the config path, for the
		13	// tests that want to put a file there.
		14	func cleanEnv(t *testing.T) string {
		15	t.Helper()
		16	dir := t.TempDir()
		17	for _, v := range []string{
		18	"EITRI_URL", "EITRI_GATE", "EITRI_TENANT", "EITRI_CA", "EITRI_KEY",
		19	"EITRI_KNOWN_HOSTS", "EITRI_TOKEN",
		20	} {
		21	t.Setenv(v, "")
		22	}
		23	cfg := filepath.Join(dir, "config.json")
		24	t.Setenv("EITRI_CONFIG", cfg)
		25	t.Setenv("HOME", dir)
		26	return cfg
		27	}
		28
8	func TestFromEnvDefaults(t *testing.T) {	29	func TestFromEnvDefaults(t *testing.T) {
		30	cleanEnv(t)
9	t.Setenv("EITRI_URL", "http://192.0.2.10:8080")	31	t.Setenv("EITRI_URL", "http://192.0.2.10:8080")
10	t.Setenv("EITRI_GATE", "192.0.2.10:2222")	32	t.Setenv("EITRI_GATE", "192.0.2.10:2222")
11	t.Setenv("EITRI_TENANT", "acme")	33	t.Setenv("EITRI_TENANT", "acme")
12	for _, v := range []string{"EITRI_CA", "EITRI_KEY", "EITRI_KNOWN_HOSTS"} {
13	t.Setenv(v, "")
14	}
15	t.Setenv("HOME", "/home/u")	34	t.Setenv("HOME", "/home/u")
16		35
17	e, err := FromEnv()	36	e, err := FromEnv()
@@ -35,30 +54,91 @@ func TestFromEnvDefaults(t *testing.T) {
35	func TestFromEnvHostedDefaults(t *testing.T) {	54	func TestFromEnvHostedDefaults(t *testing.T) {
36	// A clean environment targets the hosted service at eitri.sh — no	55	// A clean environment targets the hosted service at eitri.sh — no
37	// configuration needed to reach it (TestFromEnvDefaults proves the env	56	// configuration needed to reach it (TestFromEnvDefaults proves the env
38	// still overrides these).	57	// still overrides these). The gate is the exception: left empty here so
39	for _, v := range []string{"EITRI_URL", "EITRI_GATE", "EITRI_TENANT", "EITRI_CA", "EITRI_KEY", "EITRI_KNOWN_HOSTS"} {	58	// `eitri ssh` can ask the plane to name it rather than assuming.
40	t.Setenv(v, "")	59	cleanEnv(t)
41	}
42	e, err := FromEnv()	60	e, err := FromEnv()
43	if err != nil {	61	if err != nil {
44	t.Fatalf("clean env must succeed: %v", err)	62	t.Fatalf("clean env must succeed: %v", err)
45	}	63	}
46	if e.URL != "https://console.eitri.sh" \|\| e.Gate != "gate.eitri.sh:2222" {	64	if e.URL != "https://console.eitri.sh" {
47	t.Errorf("hosted defaults: URL=%q Gate=%q", e.URL, e.Gate)	65	t.Errorf("hosted default URL = %q", e.URL)
		66	}
		67	if e.Gate != "" {
		68	t.Errorf("gate = %q, want empty so the plane can name it", e.Gate)
48	}	69	}
49	}	70	}
50		71
51	func TestFromEnvTenantOptional(t *testing.T) {	72	func TestFromEnvTenantOptional(t *testing.T) {
52	// EITRI_TENANT is optional: `eitri ssh` derives the tenant from the	73	// The tenant is optional: `eitri ssh` derives it from the credential when
53	// credential when it is unset, so an unset tenant is not a FromEnv error.	74	// nothing pins it, so an unset tenant is not a FromEnv error.
		75	cleanEnv(t)
54	t.Setenv("EITRI_URL", "http://192.0.2.10:8080")	76	t.Setenv("EITRI_URL", "http://192.0.2.10:8080")
55	t.Setenv("EITRI_GATE", "192.0.2.10:2222")
56	t.Setenv("EITRI_TENANT", "")
57	e, err := FromEnv()	77	e, err := FromEnv()
58	if err != nil {	78	if err != nil {
59	t.Fatalf("unset EITRI_TENANT must be accepted: %v", err)	79	t.Fatalf("unset tenant must be accepted: %v", err)
60	}	80	}
61	if e.Tenant != "" {	81	if e.Tenant != "" {
62	t.Errorf("tenant = %q, want empty", e.Tenant)	82	t.Errorf("tenant = %q, want empty", e.Tenant)
63	}	83	}
64	}	84	}
		85
		86	// TestFromEnvPrecedence is the whole layering in one test: an EITRI_* variable
		87	// beats the config file, the config file beats the hosted default, and a field
		88	// nobody set falls through to the default. This is what makes `eitri init`
		89	// worth running — after it, a laptop with an empty environment still reaches
		90	// its own plane as its own tenant.
		91	func TestFromEnvPrecedence(t *testing.T) {
		92	cfg := cleanEnv(t)
		93	if err := SaveConfig(cfg, Config{
		94	URL: "http://192.0.2.10:8080",
		95	Gate: "192.0.2.10:2222",
		96	Tenant: "acme",
		97	CA: "/keys/ca",
		98	Key: "/keys/user",
		99	}); err != nil {
		100	t.Fatal(err)
		101	}
		102
		103	// File alone: every field comes from it.
		104	e, err := FromEnv()
		105	if err != nil {
		106	t.Fatal(err)
		107	}
		108	if e.URL != "http://192.0.2.10:8080" \|\| e.Gate != "192.0.2.10:2222" \|\|
		109	e.Tenant != "acme" \|\| e.CA != "/keys/ca" \|\| e.Key != "/keys/user" {
		110	t.Errorf("from config: %+v", e)
		111	}
		112
		113	// The environment overrides it, field by field.
		114	t.Setenv("EITRI_URL", "http://other:8080")
		115	t.Setenv("EITRI_GATE", "other:2222")
		116	t.Setenv("EITRI_TENANT", "beta")
		117	e, err = FromEnv()
		118	if err != nil {
		119	t.Fatal(err)
		120	}
		121	if e.URL != "http://other:8080" \|\| e.Gate != "other:2222" \|\| e.Tenant != "beta" {
		122	t.Errorf("env must override the file: %+v", e)
		123	}
		124	if e.CA != "/keys/ca" {
		125	t.Errorf("an unset variable must leave the file's value: ca = %q", e.CA)
		126	}
		127	}
		128
		129	// A config that exists but does not parse — the half-written file an aborted
		130	// run could leave — is an error naming the path, never a silent fallback to
		131	// the hosted defaults while the user believes they are on their own plane.
		132	func TestFromEnvRefusesUnreadableConfig(t *testing.T) {
		133	cfg := cleanEnv(t)
		134	if err := os.WriteFile(cfg, []byte(`{"url": "http://192.0`), 0o600); err != nil {
		135	t.Fatal(err)
		136	}
		137	_, err := FromEnv()
		138	if err == nil {
		139	t.Fatal("a corrupt config must not resolve to the hosted defaults")
		140	}
		141	if got := err.Error(); !strings.Contains(got, cfg) \|\| !strings.Contains(got, "eitri init") {
		142	t.Errorf("error must name the file and the remedy: %v", err)
		143	}
		144	}

internal/cli/init.go

@@ @@ -0,0 +1,361 @@ @@
+package cli
+import (
+	"bufio"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"golang.org/x/crypto/ssh"
+	"golang.org/x/term"
+	"github.com/a73x/eitri/internal/server/api/client"
+)
+// prompter is init's dialogue with the user, over injected streams so the whole
+// flow is drivable by a test. Every question defaults to the answer that
+// touches nothing.
+type prompter struct {
+	buf *bufio.Reader
+	raw io.Reader // the unbuffered source, for the terminal check in secret
+	out io.Writer
+}
+func newPrompter(in io.Reader, out io.Writer) *prompter {
+	return &prompter{buf: bufio.NewReader(in), raw: in, out: out}
+}
+func (p *prompter) sayf(format string, a ...any) {
+	fmt.Fprintf(p.out, format+"\n", a...)
+}
+// confirm asks a yes/no question, defaulting to no: a step acts only on an
+// explicit yes, so an empty line, an unrecognized answer, and EOF (a closed or
+// piped stdin) all decline. Nothing in init happens by running out of input.
+func (p *prompter) confirm(format string, a ...any) bool {
+	fmt.Fprintf(p.out, "  "+format+" [y/N] ", a...)
+	line, err := p.buf.ReadString('\n')
+	if err != nil && line == "" {
+		fmt.Fprintln(p.out)
+		return false
+	}
+	switch strings.ToLower(strings.TrimSpace(line)) {
+	case "y", "yes":
+		return true
+	default:
+		return false
+	}
+}
+// ask reads one line of free text, returning def for an empty answer.
+func (p *prompter) ask(question, def string) string {
+	if def != "" {
+		fmt.Fprintf(p.out, "  %s [%s] ", question, def)
+	} else {
+		fmt.Fprintf(p.out, "  %s ", question)
+	}
+	line, _ := p.buf.ReadString('\n')
+	return firstNonEmpty(strings.TrimSpace(line), def)
+}
+// secret reads a value that must not be echoed or logged. A real terminal has
+// its echo turned off for the duration; anything else — a pipe, the tests —
+// reads a plain line, there being no terminal to turn echo off on. The fd is
+// only read directly while the buffer is empty, so nothing already read ahead
+// can be lost.
+func (p *prompter) secret(question string) (string, error) {
+	fmt.Fprintf(p.out, "  %s ", question)
+	if f, ok := p.raw.(*os.File); ok && p.buf.Buffered() == 0 && term.IsTerminal(int(f.Fd())) {
+		b, err := term.ReadPassword(int(f.Fd()))
+		fmt.Fprintln(p.out)
+		return string(b), err
+	}
+	line, err := p.buf.ReadString('\n')
+	if err != nil && line == "" {
+		return "", err
+	}
+	return strings.TrimSpace(line), nil
+}
+// RunInit walks a laptop from nothing to a first shell in one command: prove a
+// token, settle the tenant's SSH CA, and write the config every other command
+// reads. Afterwards `eitri ssh <vm>` needs no environment at all — the config
+// carries the plane and the tenant, the cert is signed locally, and the host-CA
+// pin comes from a public endpoint.
+//
+// Every step prints what it would do and acts only on a yes, and every step
+// reports "already done" when it already is: a second init against a settled
+// laptop changes nothing. The steps that can go wrong quietly are the ones it
+// is most careful about — a CA the tenant has not registered signs certs that
+// are perfectly formed and refused by every guest, so init says so rather than
+// generating a second key on top.
+func RunInit(ctx context.Context, e Env, cfgPath, token string, in io.Reader, out io.Writer) error {
+	p := newPrompter(in, out)
+	cur, err := LoadConfig(cfgPath)
+	if err != nil {
+		return err
+	}
+	// initIdentity's only network call is the deliberately context-free
+	// client.Me, so there is no ctx for it to forward.
+	me, token, err := initIdentity(p, e, token) //nolint:contextcheck
+	if err != nil {
+		return err
+	}
+	caPath, err := initCA(ctx, p, e, token, me)
+	if err != nil {
+		return err
+	}
+	next := Config{
+		URL:    e.URL,
+		Gate:   firstNonEmpty(me.SSHGate, e.Gate, defaultGate),
+		Tenant: me.Tenant,
+		CA:     caPath,
+		Key:    e.Key,
+	}
+	if err := initConfig(p, cfgPath, cur, next); err != nil {
+		return err
+	}
+	p.sayf("\nDone. `eitri ssh <vm>` from here — no environment needed.")
+	return nil
+}
+// initIdentity proves the credential and learns what comes with it: the tenant
+// it acts for, and the gate this plane's clients dial. The token is used and
+// forgotten — never written to the config, never printed back.
+func initIdentity(p *prompter, e Env, token string) (client.Me, string, error) {
+	p.sayf("Step 1/3: prove your identity against %s", e.URL)
+	source := "--token"
+	if token == "" {
+		token, source = os.Getenv("EITRI_TOKEN"), "EITRI_TOKEN"
+	}
+	if token == "" {
+		p.sayf("  A personal access token, minted in the console under Settings →")
+		p.sayf("  Personal access tokens. It is used once, to ask the plane who you")
+		p.sayf("  are, and is not stored.")
+		var err error
+		if token, err = p.secret("token:"); err != nil {
+			return client.Me{}, "", err
+		}
+		source = "the prompt"
+		if token == "" {
+			return client.Me{}, "", errors.New("no token — init needs one to learn your tenant")
+		}
+	} else {
+		p.sayf("  Using the token from %s to call GET %s/api/v1/me.", source, e.URL)
+		if !p.confirm("Ask the plane who this token is?") {
+			return client.Me{}, "", errors.New("declined — init has nothing to go on without an identity")
+		}
+	}
+	// client.Me is deliberately context-free: its own do-timeout bounds this one
+	// synchronous probe (see the method's doc), so there is no ctx to thread.
+	me, err := (&client.Client{BaseURL: e.URL, Token: token}).Me()
+	if err != nil {
+		return client.Me{}, "", fmt.Errorf("the token from %s did not authenticate against %s — a token belongs to the plane that minted it, so check this is the right one for this server: %w", source, e.URL, err)
+	}
+	if me.Tenant == "" {
+		return client.Me{}, "", errors.New("that token resolves to no tenant")
+	}
+	p.sayf("  %s, tenant %s.", firstNonEmpty(me.Email, "signed in"), me.Tenant)
+	if me.SSHGate != "" {
+		p.sayf("  This plane's SSH gate is %s.", me.SSHGate)
+	} else {
+		// Either a server too old to send ssh_gate, or one whose gate binds a
+		// wildcard with no ssh_gate_domain to name it — in which case the
+		// hosted address below is certainly wrong, so name the remedy here
+		// rather than let it be confirmed as a plausible-looking default.
+		p.sayf("  This plane names no SSH gate, so %s is assumed. If that is wrong,", firstNonEmpty(e.Gate, defaultGate))
+		p.sayf("  set ssh_gate_domain on the server, or EITRI_GATE here.")
+	}
+	return me, token, nil
+}
+// initCA settles the tenant's SSH CA and returns the signing key `eitri ssh`
+// should use. A guest trusts the CA set baked into it at create and nothing
+// rewrites that set afterwards, so this is the step that decides whether the
+// VMs made after it can ever be entered.
+func initCA(ctx context.Context, p *prompter, e Env, token string, me client.Me) (string, error) {
+	p.sayf("\nStep 2/3: the SSH CA for tenant %s", me.Tenant)
+	c := &client.Client{BaseURL: e.URL, Token: token}
+	registered, err := c.ListUserCAs(ctx, "")
+	if err != nil {
+		return "", fmt.Errorf("listing the CAs registered for %s: %w", me.Tenant, err)
+	}
+	byFP := make(map[string]client.UserCA, len(registered))
+	for _, ca := range registered {
+		byFP[ca.Fingerprint] = ca
+	}
+	if len(registered) > 0 {
+		p.sayf("  %s has %d registered:", me.Tenant, len(registered))
+		for _, ca := range registered {
+			p.sayf("    %s  %s", ca.Fingerprint, firstNonEmpty(ca.Label, "(no label)"))
+		}
+	} else {
+		p.sayf("  %s has none registered. Until it does, a VM created for it would", me.Tenant)
+		p.sayf("  trust no certificate at all — which is why create refuses one.")
+	}
+	pub, caPath, err := localCA(p, e.CA)
+	if err != nil {
+		return "", err
+	}
+	if pub == nil {
+		p.sayf("  Skipped — no signing key settled. `eitri ssh` cannot mint a cert until there is one.")
+		return e.CA, nil
+	}
+	fp := ssh.FingerprintSHA256(pub)
+	if ca, ok := byFP[fp]; ok {
+		p.sayf("  Already done: %s is registered as %s.", fp, firstNonEmpty(ca.Label, "(no label)"))
+		return caPath, nil
+	}
+	if len(registered) > 0 {
+		// The trap this step exists for. The certs this key signs are perfectly
+		// formed; every guest refuses them, and ssh reports only a denied public
+		// key, which reads like a broken account rather than an unregistered CA.
+		p.sayf("  The key at %s is %s — not one of the above.", caPath, fp)
+		p.sayf("  Certs it signs would be refused by every guest of this tenant.")
+	}
+	if !p.confirm("Register this key's public half with %s?", me.Tenant) {
+		p.sayf("  Skipped — nothing registered.")
+		return caPath, nil
+	}
+	c.UserCALabel = p.ask("label for it:", keyID())
+	if err := c.UploadUserCA(ctx, "", string(ssh.MarshalAuthorizedKey(pub))); err != nil {
+		return "", err
+	}
+	p.sayf("  Registered %s as %q. eitri holds the public half only.", fp, c.UserCALabel)
+	return caPath, nil
+}
+// localCA settles WHICH key on this machine signs for the tenant, in the order
+// that touches least: the one already at the configured path, then one the user
+// names, and only then a new one. Generating is last because a CA is an
+// identity — making a second where one exists is exactly how a laptop ends up
+// signing with a key the tenant has never heard of. A nil key means the user
+// declined every offer.
+func localCA(p *prompter, path string) (ssh.PublicKey, string, error) {
+	pub, keyPath, err := caPublicKey(path)
+	if err == nil {
+		return pub, keyPath, nil
+	}
+	if !errors.Is(err, os.ErrNotExist) {
+		return nil, "", err
+	}
+	p.sayf("  There is no signing key at %s.", path)
+	if p.confirm("Do you already have a CA key, elsewhere on this machine?") {
+		named := p.ask("path to it (the private key, or its .pub):", "")
+		if named == "" {
+			return nil, "", errors.New("no path given")
+		}
+		pub, keyPath, err := caPublicKey(expandHome(named))
+		if err != nil {
+			return nil, "", err
+		}
+		return pub, keyPath, nil
+	}
+	p.sayf("  A new ed25519 CA would be written, and nothing else touched:")
+	p.sayf("    %s      private, mode 0600 — eitri never sees this half", path)
+	p.sayf("    %s.pub  public, mode 0644 — this is the half that gets registered", path)
+	if !p.confirm("Generate it?") {
+		return nil, path, nil
+	}
+	pub, err = newEd25519Key(path)
+	if err != nil {
+		return nil, "", err
+	}
+	p.sayf("  Wrote %s and %s.pub.", path, path)
+	return pub, path, nil
+}
+// caPublicKey reads the public half of a CA at path, which a user may name
+// either way round: the signing key (whose public half is derived, exactly as
+// minting does) or the .pub beside it, which is what `eitri ca upload` takes.
+// It returns the signing key's path alongside, since that is what the config
+// records — `eitri ssh` signs with it, not with the .pub.
+func caPublicKey(path string) (ssh.PublicKey, string, error) {
+	if strings.HasSuffix(path, ".pub") {
+		raw, err := os.ReadFile(path)
+		if err != nil {
+			return nil, "", err
+		}
+		pub, _, _, _, perr := ssh.ParseAuthorizedKey(raw)
+		if perr != nil {
+			return nil, "", fmt.Errorf("%s: not an SSH public key: %w", path, perr)
+		}
+		return pub, strings.TrimSuffix(path, ".pub"), nil
+	}
+	pub, err := userPublicKey(path)
+	if err != nil {
+		return nil, "", err
+	}
+	return pub, path, nil
+}
+// initConfig writes the settings every other command reads. It shows the file's
+// current values beside the ones this run would leave, writes only on a yes,
+// and says "already done" when the two are the same.
+func initConfig(p *prompter, path string, cur, next Config) error {
+	p.sayf("\nStep 3/3: write %s", path)
+	for _, l := range configLines(cur, next) {
+		p.sayf("%s", l)
+	}
+	if cur == next {
+		p.sayf("  Already done: the file says exactly this.")
+		return nil
+	}
+	if cur.URL != "" && cur.URL != next.URL {
+		p.sayf("  This moves the laptop to a different plane: %s → %s.", cur.URL, next.URL)
+		p.sayf("  The tenant and CA above belong to the new one.")
+	}
+	if !p.confirm("Write it?") {
+		p.sayf("  Skipped — the file is unchanged.")
+		return nil
+	}
+	if err := SaveConfig(path, next); err != nil {
+		return err
+	}
+	p.sayf("  Written.")
+	return nil
+}
+// configLines renders next field by field, naming the value it replaces so the
+// user confirms a diff rather than a wall of settings.
+func configLines(cur, next Config) []string {
+	fields := []struct{ name, was, now string }{
+		{"url", cur.URL, next.URL},
+		{"gate", cur.Gate, next.Gate},
+		{"tenant", cur.Tenant, next.Tenant},
+		{"ca", cur.CA, next.CA},
+		{"key", cur.Key, next.Key},
+	}
+	lines := make([]string, 0, len(fields))
+	for _, f := range fields {
+		line := fmt.Sprintf("    %-7s %s", f.name, f.now)
+		if f.was != "" && f.was != f.now {
+			line += fmt.Sprintf("  (was %s)", f.was)
+		}
+		lines = append(lines, line)
+	}
+	return lines
+}
+// expandHome resolves a leading ~ in a path the user typed, which no shell
+// expanded because it came in on a prompt rather than a command line.
+func expandHome(path string) string {
+	if path != "~" && !strings.HasPrefix(path, "~"+string(filepath.Separator)) {
+		return path
+	}
+	home, err := os.UserHomeDir()
+	if err != nil {
+		return path
+	}
+	return filepath.Join(home, strings.TrimPrefix(path, "~"))
+}

internal/cli/init_test.go

@@ @@ -0,0 +1,398 @@ @@
+package cli
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"golang.org/x/crypto/ssh"
+)
+// fakePlane stands in for the control plane across init's three calls: who am
+// I, which CAs does my tenant have, and register this one. A registration is
+// visible to the next list, exactly as the real server behaves — which is what
+// makes the second-run assertions mean anything. It records every upload, so a
+// test can assert on the step that changed something AND on the step that
+// deliberately did not.
+type fakePlane struct {
+	url      string
+	me       map[string]any
+	cas      []map[string]string
+	uploaded []map[string]string
+	status   int // non-zero: every request fails with this status
+}
+func newFakePlane(t *testing.T, me map[string]any, cas ...map[string]string) *fakePlane {
+	t.Helper()
+	f := &fakePlane{me: me, cas: cas}
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if f.status != 0 {
+			http.Error(w, "computer says no", f.status)
+			return
+		}
+		switch {
+		case r.URL.Path == "/api/v1/me":
+			json.NewEncoder(w).Encode(f.me)
+		case r.URL.Path == "/api/v1/user-cas" && r.Method == http.MethodGet:
+			if f.cas == nil {
+				f.cas = []map[string]string{}
+			}
+			json.NewEncoder(w).Encode(f.cas)
+		case r.URL.Path == "/api/v1/user-cas" && r.Method == http.MethodPost:
+			var body map[string]string
+			if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+				t.Errorf("upload body: %v", err)
+			}
+			f.uploaded = append(f.uploaded, body)
+			pub, _, _, _, err := ssh.ParseAuthorizedKey([]byte(body["public_key"]))
+			if err != nil {
+				t.Errorf("uploaded a key the server cannot parse: %v", err)
+				http.Error(w, "invalid public_key", http.StatusBadRequest)
+				return
+			}
+			fp := ssh.FingerprintSHA256(pub)
+			f.cas = append(f.cas, map[string]string{"fingerprint": fp, "label": body["label"], "pubkey": body["public_key"]})
+			w.WriteHeader(http.StatusCreated)
+			json.NewEncoder(w).Encode(map[string]string{"fingerprint": fp})
+		default:
+			t.Errorf("unexpected request %s %s", r.Method, r.URL.Path)
+			http.Error(w, "not found", http.StatusNotFound)
+		}
+	}))
+	t.Cleanup(srv.Close)
+	f.url = srv.URL
+	return f
+}
+func meBody(tenant, gate string) map[string]any {
+	return map[string]any{"tenant": tenant, "email": tenant + "@example.test", "ssh_gate": gate}
+}
+// initEnv is a laptop with nothing on it: an empty home, no EITRI_* variables,
+// and paths that exist only inside the test.
+func initEnv(t *testing.T, plane *fakePlane) (Env, string) {
+	t.Helper()
+	cfg := cleanEnv(t)
+	home := filepath.Dir(cfg)
+	return Env{
+		URL:        plane.url,
+		CA:         filepath.Join(home, ".ssh", "eitri_user_ca"),
+		Key:        filepath.Join(home, ".ssh", "id_ed25519"),
+		KnownHosts: filepath.Join(home, ".ssh", "eitri_known_hosts"),
+	}, cfg
+}
+// runInitWith drives one init to completion over canned answers, returning the
+// transcript the user would have seen.
+func runInitWith(t *testing.T, e Env, cfg, answers string) (string, error) {
+	t.Helper()
+	var out strings.Builder
+	err := RunInit(context.Background(), e, cfg, "tok", strings.NewReader(answers), &out)
+	return out.String(), err
+}
+// The empty-laptop path: a tenant with no CA and no key on disk is offered a
+// generated one, registers it, and gets a config that makes every later command
+// need no environment.
+func TestInitFirstRunGeneratesAndRegisters(t *testing.T) {
+	plane := newFakePlane(t, meBody("acme", "gate.acme.test:2222"))
+	e, cfg := initEnv(t, plane)
+	// identity, no existing key elsewhere, generate, register, default label, write.
+	out, err := runInitWith(t, e, cfg, "y\nn\ny\ny\n\ny\n")
+	if err != nil {
+		t.Fatalf("%v\n%s", err, out)
+	}
+	if len(plane.uploaded) != 1 {
+		t.Fatalf("uploads = %d, want 1\n%s", len(plane.uploaded), out)
+	}
+	// eitri gets the public half and nothing else.
+	if !strings.HasPrefix(plane.uploaded[0]["public_key"], "ssh-ed25519 ") {
+		t.Errorf("uploaded %q, want an ed25519 public key line", plane.uploaded[0]["public_key"])
+	}
+	if strings.Contains(plane.uploaded[0]["public_key"], "PRIVATE") {
+		t.Fatal("a private key left the machine")
+	}
+	priv, err := os.Stat(e.CA)
+	if err != nil {
+		t.Fatalf("CA private key: %v", err)
+	}
+	if perm := priv.Mode().Perm(); perm != 0o600 {
+		t.Errorf("CA key mode = %o, want 600", perm)
+	}
+	if _, err := os.Stat(e.CA + ".pub"); err != nil {
+		t.Errorf("CA public key: %v", err)
+	}
+	got, err := LoadConfig(cfg)
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := Config{URL: plane.url, Gate: "gate.acme.test:2222", Tenant: "acme", CA: e.CA, Key: e.Key}
+	if got != want {
+		t.Errorf("config:\n got %+v\nwant %+v", got, want)
+	}
+	// The gate written is the one the PLANE named, not the hosted default.
+	if strings.Contains(out, defaultGate) {
+		t.Errorf("a plane that names its gate must not be second-guessed:\n%s", out)
+	}
+}
+// Running init again against a settled laptop reports every step as already
+// done and changes nothing — no second CA, no rewritten config.
+func TestInitSecondRunChangesNothing(t *testing.T) {
+	plane := newFakePlane(t, meBody("acme", "gate.acme.test:2222"))
+	e, cfg := initEnv(t, plane)
+	if _, err := runInitWith(t, e, cfg, "y\nn\ny\ny\n\ny\n"); err != nil {
+		t.Fatal(err)
+	}
+	before, err := os.ReadFile(cfg)
+	if err != nil {
+		t.Fatal(err)
+	}
+	// Only the identity step asks anything the second time; every later "y"
+	// here is spare, and if one is consumed the assertions below catch it.
+	out, err := runInitWith(t, e, cfg, "y\ny\ny\ny\ny\n")
+	if err != nil {
+		t.Fatalf("%v\n%s", err, out)
+	}
+	if len(plane.uploaded) != 1 {
+		t.Errorf("uploads = %d, want the first run's 1\n%s", len(plane.uploaded), out)
+	}
+	after, err := os.ReadFile(cfg)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(after) != string(before) {
+		t.Errorf("config rewritten:\n before %s\n after  %s", before, after)
+	}
+	if n := strings.Count(out, "Already done"); n != 2 {
+		t.Errorf("want the CA and config steps both reporting already done, got %d:\n%s", n, out)
+	}
+}
+// A key already on the laptop is offered for registration; init never generates
+// a second one on top of it.
+func TestInitPrefersAnExistingLocalKey(t *testing.T) {
+	plane := newFakePlane(t, meBody("acme", "gate.acme.test:2222"))
+	e, cfg := initEnv(t, plane)
+	pub, err := newEd25519Key(e.CA)
+	if err != nil {
+		t.Fatal(err)
+	}
+	out, err := runInitWith(t, e, cfg, "y\ny\nlaptop\ny\n") // identity, register, label, write
+	if err != nil {
+		t.Fatalf("%v\n%s", err, out)
+	}
+	if strings.Contains(out, "Generate it?") {
+		t.Errorf("a key already exists — init must not offer to generate:\n%s", out)
+	}
+	if len(plane.uploaded) != 1 {
+		t.Fatalf("uploads = %d, want 1\n%s", len(plane.uploaded), out)
+	}
+	if got, want := plane.uploaded[0]["public_key"], string(ssh.MarshalAuthorizedKey(pub)); got != want {
+		t.Errorf("uploaded the wrong key:\n got %q\nwant %q", got, want)
+	}
+	if plane.uploaded[0]["label"] != "laptop" {
+		t.Errorf("label = %q, want laptop", plane.uploaded[0]["label"])
+	}
+}
+// The trap: the tenant has CAs registered, and the key on this laptop is not
+// one of them. Every cert it signs is well-formed and refused by every guest,
+// and ssh reports only a denied public key — so init says it plainly rather
+// than leaving the user to read that as a broken account.
+func TestInitNamesAKeyNoGuestWillTrust(t *testing.T) {
+	other, _, _, _, err := ssh.ParseAuthorizedKey([]byte(testUserCALine))
+	if err != nil {
+		t.Fatal(err)
+	}
+	plane := newFakePlane(t, meBody("acme", "gate.acme.test:2222"), map[string]string{
+		"fingerprint": ssh.FingerprintSHA256(other), "label": "the other laptop", "pubkey": testUserCALine,
+	})
+	e, cfg := initEnv(t, plane)
+	if _, err := newEd25519Key(e.CA); err != nil {
+		t.Fatal(err)
+	}
+	// Decline the offer to register: the warning must stand on its own, and
+	// nothing may be uploaded behind a "no".
+	out, err := runInitWith(t, e, cfg, "y\nn\ny\n")
+	if err != nil {
+		t.Fatalf("%v\n%s", err, out)
+	}
+	if !strings.Contains(out, "not one of the above") || !strings.Contains(out, "refused by every guest") {
+		t.Errorf("the mismatch must be named plainly:\n%s", out)
+	}
+	if !strings.Contains(out, ssh.FingerprintSHA256(other)) {
+		t.Errorf("the registered CA's fingerprint must be shown:\n%s", out)
+	}
+	if len(plane.uploaded) != 0 {
+		t.Errorf("declined, yet %d uploads happened", len(plane.uploaded))
+	}
+}
+// A key that IS one of the tenant's registered CAs is recognized: nothing is
+// uploaded, and the step says so.
+func TestInitRecognizesTheRegisteredKey(t *testing.T) {
+	plane := newFakePlane(t, meBody("acme", "gate.acme.test:2222"))
+	e, cfg := initEnv(t, plane)
+	pub, err := newEd25519Key(e.CA)
+	if err != nil {
+		t.Fatal(err)
+	}
+	plane.cas = []map[string]string{{
+		"fingerprint": ssh.FingerprintSHA256(pub), "label": "this laptop",
+		"pubkey": string(ssh.MarshalAuthorizedKey(pub)),
+	}}
+	out, err := runInitWith(t, e, cfg, "y\ny\n") // identity, write config
+	if err != nil {
+		t.Fatalf("%v\n%s", err, out)
+	}
+	if len(plane.uploaded) != 0 {
+		t.Errorf("an already-registered key must not be uploaded again")
+	}
+	if !strings.Contains(out, "Already done") || !strings.Contains(out, "this laptop") {
+		t.Errorf("want the registration recognized by label:\n%s", out)
+	}
+}
+// Declining every step leaves the laptop exactly as it was found. Nothing in
+// init happens by default, including by running out of input.
+func TestInitDeclinedStepsTouchNothing(t *testing.T) {
+	plane := newFakePlane(t, meBody("acme", "gate.acme.test:2222"))
+	e, cfg := initEnv(t, plane)
+	out, err := runInitWith(t, e, cfg, "y\nn\nn\nn\n") // identity, no key elsewhere, no generate, no write
+	if err != nil {
+		t.Fatalf("%v\n%s", err, out)
+	}
+	if _, err := os.Stat(e.CA); !os.IsNotExist(err) {
+		t.Errorf("a CA was written despite the decline: %v", err)
+	}
+	if _, err := os.Stat(cfg); !os.IsNotExist(err) {
+		t.Errorf("a config was written despite the decline: %v", err)
+	}
+	if len(plane.uploaded) != 0 {
+		t.Errorf("%d uploads despite the decline", len(plane.uploaded))
+	}
+}
+// An init run against a config that names a different plane says so before it
+// overwrites, since the tenant and CA that follow belong to the new one.
+func TestInitNamesAPlaneChange(t *testing.T) {
+	plane := newFakePlane(t, meBody("acme", "gate.acme.test:2222"))
+	e, cfg := initEnv(t, plane)
+	if err := SaveConfig(cfg, Config{URL: "http://192.0.2.10:8080", Gate: "192.0.2.10:2222", Tenant: "old"}); err != nil {
+		t.Fatal(err)
+	}
+	out, err := runInitWith(t, e, cfg, "y\nn\ny\ny\n\ny\n")
+	if err != nil {
+		t.Fatalf("%v\n%s", err, out)
+	}
+	if !strings.Contains(out, "different plane") || !strings.Contains(out, "http://192.0.2.10:8080") {
+		t.Errorf("the plane change must be called out:\n%s", out)
+	}
+	if !strings.Contains(out, "(was old)") {
+		t.Errorf("the tenant it replaces must be shown:\n%s", out)
+	}
+}
+// A token minted by another plane fails here, and the message says that rather
+// than leaving a bare 401 to be read as a bad password.
+func TestInitBadTokenBlamesThePlane(t *testing.T) {
+	plane := newFakePlane(t, meBody("acme", "gate.acme.test:2222"))
+	plane.status = http.StatusUnauthorized
+	e, cfg := initEnv(t, plane)
+	out, err := runInitWith(t, e, cfg, "y\n")
+	if err == nil {
+		t.Fatalf("want an error:\n%s", out)
+	}
+	if !strings.Contains(err.Error(), plane.url) || !strings.Contains(err.Error(), "belongs to the plane that minted it") {
+		t.Errorf("error must name the plane: %v", err)
+	}
+	if _, statErr := os.Stat(cfg); !os.IsNotExist(statErr) {
+		t.Error("a failed identity step must write no config")
+	}
+}
+// A plane that names no gate — an older server — falls back to the hosted
+// address rather than writing an empty gate no ssh can dial.
+func TestInitFallsBackWhenThePlaneNamesNoGate(t *testing.T) {
+	plane := newFakePlane(t, map[string]any{"tenant": "acme", "email": "me@acme.test"})
+	e, cfg := initEnv(t, plane)
+	out, err := runInitWith(t, e, cfg, "y\nn\ny\ny\n\ny\n")
+	if err != nil {
+		t.Fatalf("%v\n%s", err, out)
+	}
+	got, err := LoadConfig(cfg)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.Gate != defaultGate {
+		t.Errorf("gate = %q, want the hosted fallback %q", got.Gate, defaultGate)
+	}
+}
+// A user may name their CA either way round — `eitri ca upload` takes the .pub,
+// so that is what fingers reach for — and either way the config records the
+// signing key, which is the half `eitri ssh` needs.
+func TestCAPublicKeyAcceptsEitherHalf(t *testing.T) {
+	dir := t.TempDir()
+	keyPath := filepath.Join(dir, "ca")
+	want, err := newEd25519Key(keyPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, named := range []string{keyPath, keyPath + ".pub"} {
+		pub, resolved, err := caPublicKey(named)
+		if err != nil {
+			t.Fatalf("%s: %v", named, err)
+		}
+		if ssh.FingerprintSHA256(pub) != ssh.FingerprintSHA256(want) {
+			t.Errorf("%s: wrong key", named)
+		}
+		if resolved != keyPath {
+			t.Errorf("%s: path = %q, want the signing key %q", named, resolved, keyPath)
+		}
+	}
+	if _, _, err := caPublicKey(filepath.Join(dir, "absent")); !os.IsNotExist(err) {
+		t.Errorf("a missing key must report as missing, got %v", err)
+	}
+}
+// newEd25519Key never overwrites: an existing CA is an identity, and a silent
+// replacement would strand every guest that trusts the old one.
+func TestNewEd25519KeyRefusesToOverwrite(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "ca")
+	if _, err := newEd25519Key(path); err != nil {
+		t.Fatal(err)
+	}
+	before, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := newEd25519Key(path); !os.IsExist(err) {
+		t.Fatalf("want an exists error, got %v", err)
+	}
+	after, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(after) != string(before) {
+		t.Error("the existing key was replaced")
+	}
+}

internal/cli/main.go

Old		New
@@ -14,28 +14,37 @@ import (
14		14
15	// Usage is the top-level help text, printed by cmd/eitri on ErrUsage.	15	// Usage is the top-level help text, printed by cmd/eitri on ErrUsage.
16	const Usage = `usage:	16	const Usage = `usage:
		17	eitri init [--token <pat>]
17	eitri ssh <vm> [ssh args / remote command...]	18	eitri ssh <vm> [ssh args / remote command...]
18	eitri ca upload [<tenant>] <ca-public-key-file>	19	eitri ca upload [<tenant>] <ca-public-key-file>
19	eitri --version	20	eitri --version
20		21
21	env: all optional — EITRI_URL and EITRI_GATE default to the hosted service at	22	init is the guided first run: it proves a token, settles your tenant's SSH CA,
22	eitri.sh (self-hosters and tests override). ca needs EITRI_TOKEN (a PAT);	23	and writes ~/.eitri/config.json, confirming every step before it acts.
23	its tenant is optional (argument, else EITRI_TENANT, else the token's own).	24
24	EITRI_TENANT disambiguates a user CA registered in more than one tenant.	25	env: all optional — each EITRI_* variable overrides the config file, which
25	EITRI_CA, EITRI_KEY, EITRI_KNOWN_HOSTS default under ~/.ssh.`	26	overrides the hosted defaults at eitri.sh. init and ca need EITRI_TOKEN (a
		27	PAT) unless one is given another way; ca's tenant is optional (argument,
		28	else EITRI_TENANT, else the token's own). EITRI_TENANT disambiguates a user
		29	CA registered in more than one tenant, and EITRI_GATE pins the gate the
		30	plane would otherwise name itself. EITRI_CA, EITRI_KEY, EITRI_KNOWN_HOSTS
		31	default under ~/.ssh; EITRI_CONFIG moves the config file.`
26		32
27	// ErrUsage marks a bad invocation: the caller prints Usage and exits 2 rather	33	// ErrUsage marks a bad invocation: the caller prints Usage and exits 2 rather
28	// than treating it as a runtime failure.	34	// than treating it as a runtime failure.
29	var ErrUsage = errors.New("bad usage")	35	var ErrUsage = errors.New("bad usage")
30		36
31	// Main dispatches the eitri command line (everything after the binary name,	37	// Main dispatches the eitri command line (everything after the binary name,
32	// --version excluded — that stays in cmd/eitri). stdout carries command	38	// --version excluded — that stays in cmd/eitri). stdout carries command output;
33	// output; prompts and confirmations go to stderr inside the subcommands.	39	// prompts and confirmations go to stderr inside the subcommands, except init,
		40	// whose whole output IS the dialogue and so belongs on stdout.
34	func Main(args []string, stdout io.Writer) error {	41	func Main(args []string, stdout io.Writer) error {
35	if len(args) < 1 {	42	if len(args) < 1 {
36	return ErrUsage	43	return ErrUsage
37	}	44	}
38	switch args[0] {	45	switch args[0] {
		46	case "init":
		47	return runInit(args[1:], stdout)
39	case "ssh":	48	case "ssh":
40	return runSSH(args[1:], stdout)	49	return runSSH(args[1:], stdout)
41	case "ca":	50	case "ca":
@@ -45,6 +54,38 @@ func Main(args []string, stdout io.Writer) error {
45	}	54	}
46	}	55	}
47		56
		57	const initUsage = "usage: eitri init [--token <pat>]"
		58
		59	// runInit parses init's one flag. A token on the command line is visible in the
		60	// shell's history and in ps, so it is offered rather than required: with no
		61	// --token, init takes EITRI_TOKEN, and with neither it asks, unechoed.
		62	func runInit(args []string, stdout io.Writer) error {
		63	token := ""
		64	for len(args) > 0 {
		65	switch args[0] {
		66	case "-h", "--help":
		67	fmt.Fprintln(stdout, initUsage)
		68	return nil
		69	case "--token":
		70	if len(args) < 2 {
		71	return errors.New(initUsage)
		72	}
		73	token, args = args[1], args[2:]
		74	default:
		75	return errors.New(initUsage)
		76	}
		77	}
		78	env, err := FromEnv()
		79	if err != nil {
		80	return err
		81	}
		82	cfgPath, err := ConfigPath()
		83	if err != nil {
		84	return err
		85	}
		86	return RunInit(context.Background(), env, cfgPath, token, os.Stdin, stdout)
		87	}
		88
48	func runSSH(args []string, stdout io.Writer) error {	89	func runSSH(args []string, stdout io.Writer) error {
49	if len(args) >= 1 && (args[0] == "-h" \|\| args[0] == "--help") {	90	if len(args) >= 1 && (args[0] == "-h" \|\| args[0] == "--help") {
50	fmt.Fprintln(stdout, "usage: eitri ssh <vm> [ssh args / remote command...]")	91	fmt.Fprintln(stdout, "usage: eitri ssh <vm> [ssh args / remote command...]")
@@ -79,7 +120,11 @@ func runCA(args []string, stdout io.Writer) error {
79	if token == "" {	120	if token == "" {
80	return fmt.Errorf("set EITRI_TOKEN (a personal access token)")	121	return fmt.Errorf("set EITRI_TOKEN (a personal access token)")
81	}	122	}
82	out, err := UploadUserCA(context.Background(), URLFromEnv(), token, tenant, pub)	123	env, err := FromEnv()
		124	if err != nil {
		125	return err
		126	}
		127	out, err := UploadUserCA(context.Background(), env.URL, token, tenant, pub)
83	if err != nil {	128	if err != nil {
84	return err	129	return err
85	}	130	}

internal/cli/mint.go

Old		New
@@ -16,47 +16,63 @@ import (
16	)	16	)
17		17
18	// EnsureKeypair generates an ed25519 keypair at keyPath (+ .pub) if absent.	18	// EnsureKeypair generates an ed25519 keypair at keyPath (+ .pub) if absent.
19	// An existing key is never touched. The private key is created O_EXCL so a	19	// An existing key is never touched, including one that appears between the
20	// concurrent first run cannot interleave two generations; the .pub (a	20	// stat and the create — newEd25519Key's O_EXCL makes that race a no-op rather
21	// convenience copy — minting and ssh derive the public key from the private	21	// than an overwrite.
22	// key) is written after, by whichever call won the create.
23	func EnsureKeypair(keyPath string) error {	22	func EnsureKeypair(keyPath string) error {
24	if _, err := os.Stat(keyPath); err == nil {	23	if _, err := os.Stat(keyPath); err == nil {
25	return nil	24	return nil
26	} else if !os.IsNotExist(err) {	25	} else if !os.IsNotExist(err) {
27	return err	26	return err
28	}	27	}
29	pub, priv, err := ed25519.GenerateKey(rand.Reader)	28	_, err := newEd25519Key(keyPath)
		29	if errors.Is(err, os.ErrExist) {
		30	return nil // another eitri run won the race; its pair is authoritative
		31	}
30	if err != nil {	32	if err != nil {
31	return err	33	return err
32	}	34	}
33	block, err := ssh.MarshalPrivateKey(priv, "")	35	fmt.Fprintf(os.Stderr, "eitri: generated SSH key at %s\n", keyPath)
		36	return nil
		37	}
		38
		39	// newEd25519Key writes a fresh ed25519 keypair at path (0600) and path+".pub"
		40	// (0644), returning the public half. The private key is created O_EXCL — an
		41	// existing file is never overwritten and a concurrent run cannot interleave two
		42	// generations, so a caller that sees os.ErrExist knows a key it did not make is
		43	// already there. Both the user key and, via `eitri init`, the tenant's CA are
		44	// born here.
		45	func newEd25519Key(path string) (ssh.PublicKey, error) {
		46	pub, priv, err := ed25519.GenerateKey(rand.Reader)
34	if err != nil {	47	if err != nil {
35	return err	48	return nil, err
36	}	49	}
37	if err := os.MkdirAll(filepath.Dir(keyPath), 0o700); err != nil {	50	block, err := ssh.MarshalPrivateKey(priv, "")
38	return err	51	if err != nil {
		52	return nil, err
39	}	53	}
40	f, err := os.OpenFile(keyPath, os.O_WRONLY\|os.O_CREATE\|os.O_EXCL, 0o600)	54	if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
41	if errors.Is(err, os.ErrExist) {	55	return nil, err
42	return nil // another eitri run won the race; its pair is authoritative
43	}	56	}
		57	f, err := os.OpenFile(path, os.O_WRONLY\|os.O_CREATE\|os.O_EXCL, 0o600)
44	if err != nil {	58	if err != nil {
45	return err	59	return nil, err
46	}	60	}
47	if _, err := f.Write(pem.EncodeToMemory(block)); err != nil {	61	if _, err := f.Write(pem.EncodeToMemory(block)); err != nil {
48	f.Close()	62	f.Close()
49	return err	63	return nil, err
50	}	64	}
51	if err := f.Close(); err != nil {	65	if err := f.Close(); err != nil {
52	return err	66	return nil, err
53	}	67	}
54	sshPub, err := ssh.NewPublicKey(pub)	68	sshPub, err := ssh.NewPublicKey(pub)
55	if err != nil {	69	if err != nil {
56	return err	70	return nil, err
57	}	71	}
58	fmt.Fprintf(os.Stderr, "eitri: generated SSH key at %s\n", keyPath)	72	// The .pub is a convenience copy — minting and ssh derive the public key
59	return os.WriteFile(keyPath+".pub", ssh.MarshalAuthorizedKey(sshPub), 0o644)	73	// from the private one — so it is written after whichever call won the
		74	// create.
		75	return sshPub, os.WriteFile(path+".pub", ssh.MarshalAuthorizedKey(sshPub), 0o644)
60	}	76	}
61		77
62	// MintCert self-signs a short-lived user certificate for keyPath's public key	78	// MintCert self-signs a short-lived user certificate for keyPath's public key
@@ -69,7 +85,7 @@ func MintCert(caPath, keyPath, keyID string) error {
69	raw, err := os.ReadFile(caPath)	85	raw, err := os.ReadFile(caPath)
70	if err != nil {	86	if err != nil {
71	if os.IsNotExist(err) {	87	if os.IsNotExist(err) {
72	return fmt.Errorf("no user CA at %s — generate one (ssh-keygen -t ed25519 -f %s) and register it with 'eitri ca upload'", caPath, caPath)	88	return fmt.Errorf("no user CA at %s — run 'eitri init', which offers to make one and register it", caPath)
73	}	89	}
74	return err	90	return err
75	}	91	}

internal/cli/mint_test.go

Old		New
@@ -112,7 +112,7 @@ func TestMintCertMissingCA(t *testing.T) {
112	t.Fatal(err)	112	t.Fatal(err)
113	}	113	}
114	err := MintCert(filepath.Join(t.TempDir(), "nope"), key, "x")	114	err := MintCert(filepath.Join(t.TempDir(), "nope"), key, "x")
115	if err == nil \|\| !strings.Contains(err.Error(), "eitri ca upload") {	115	if err == nil \|\| !strings.Contains(err.Error(), "eitri init") {
116	t.Fatalf("want actionable no-CA error, got %v", err)	116	t.Fatalf("want actionable no-CA error, got %v", err)
117	}	117	}
118	}	118	}

internal/cli/sshcmd.go

Old		New
@@ -48,31 +48,48 @@ func SSHArgv(e Env, vm string, extra []string) []string {
48	return append(argv, extra...)	48	return append(argv, extra...)
49	}	49	}
50		50
51	// resolveTenant returns the tenant for the VM's gate connect name. EITRI_TENANT	51	// resolvePlane fills the two things a session needs that nothing on this
52	// pins it — offline, and the escape hatch when a user CA lives in more than one	52	// machine has to carry: the tenant the connect name is namespaced under, and
53	// tenant — and otherwise the CLI derives it from the credential via /me. The	53	// the gate it is dialed through. Either can be pinned — EITRI_TENANT /
54	// connect name must be the namespaced <tenant>.<vm> (the VM host cert's one	54	// EITRI_GATE, or the config file `eitri init` wrote — and whatever is still
55	// principal, see SSHArgv), so the tenant is always needed; deriving it means the	55	// missing comes from the credential's /me, which answers both. A connect name
56	// user never has to know or type it. Deriving needs EITRI_TOKEN; with neither	56	// is half identity and half plane, so one probe settles it, and the plane names
57	// the tenant nor a token, the connect name cannot be built.	57	// its own gate rather than the client assuming one.
58	func resolveTenant(e Env) (string, error) {	58	//
59	if e.Tenant != "" {	59	// The hosted gate address survives only as the last rung, for a server old
60	return e.Tenant, nil	60	// enough to answer /me without ssh_gate, or for a pinned tenant with no
		61	// credential to ask with. The connect name must be the namespaced <tenant>.<vm>
		62	// (the VM host cert's one principal, see SSHArgv), so the tenant is always
		63	// needed; deriving it is what means the user never has to know or type it, and
		64	// with neither a tenant nor a token the name cannot be built at all.
		65	func resolvePlane(e Env) (Env, error) {
		66	if e.Tenant != "" && e.Gate != "" {
		67	return e, nil
61	}	68	}
62	token := os.Getenv("EITRI_TOKEN")	69	token := os.Getenv("EITRI_TOKEN")
63	if token == "" {	70	if token == "" {
64	return "", fmt.Errorf("set EITRI_TOKEN (a personal access token) or EITRI_TENANT — the connect name needs your tenant")	71	if e.Tenant == "" {
		72	return e, fmt.Errorf("run 'eitri init', or set EITRI_TOKEN (a personal access token) or EITRI_TENANT — the connect name needs your tenant")
		73	}
		74	e.Gate = defaultGate
		75	return e, nil
65	}	76	}
66	// client.Me is deliberately context-free — its own do-timeout bounds this	77	// client.Me is deliberately context-free — its own do-timeout bounds this
67	// one synchronous probe (see the method's doc), so there is no ctx to thread.	78	// one synchronous probe (see the method's doc), so there is no ctx to thread.
68	me, err := (&client.Client{BaseURL: e.URL, Token: token}).Me()	79	me, err := (&client.Client{BaseURL: e.URL, Token: token}).Me()
69	if err != nil {	80	if err != nil {
70	return "", fmt.Errorf("resolving your tenant from the token: %w", err)	81	return e, fmt.Errorf("resolving your tenant and gate from the token: %w", err)
71	}	82	}
72	if me.Tenant == "" {	83	if e.Tenant == "" {
73	return "", fmt.Errorf("your token resolves to no tenant")	84	if me.Tenant == "" {
		85	return e, fmt.Errorf("your token resolves to no tenant")
		86	}
		87	e.Tenant = me.Tenant
74	}	88	}
75	return me.Tenant, nil	89	if e.Gate == "" {
		90	e.Gate = firstNonEmpty(me.SSHGate, defaultGate)
		91	}
		92	return e, nil
76	}	93	}
77		94
78	// shq single-quotes s for POSIX shell word-splitting (ProxyCommand runs via	95	// shq single-quotes s for POSIX shell word-splitting (ProxyCommand runs via
@@ -95,13 +112,12 @@ func keyID() string {
95	// process with the system ssh. Exec (not a child process) so the TTY, signals,	112	// process with the system ssh. Exec (not a child process) so the TTY, signals,
96	// and exit code belong to ssh itself.	113	// and exit code belong to ssh itself.
97	func RunSSH(ctx context.Context, e Env, vm string, extra []string) error {	114	func RunSSH(ctx context.Context, e Env, vm string, extra []string) error {
98	// resolveTenant's only network call is the deliberately context-free	115	// resolvePlane's only network call is the deliberately context-free
99	// client.Me, so there is no ctx for it to forward.	116	// client.Me, so there is no ctx for it to forward.
100	tenant, err := resolveTenant(e) //nolint:contextcheck	117	e, err := resolvePlane(e) //nolint:contextcheck
101	if err != nil {	118	if err != nil {
102	return err	119	return err
103	}	120	}
104	e.Tenant = tenant
105	if err := EnsureKeypair(e.Key); err != nil {	121	if err := EnsureKeypair(e.Key); err != nil {
106	return err	122	return err
107	}	123	}

internal/cli/sshcmd_test.go

Old		New
@@ -43,10 +43,10 @@ func TestSSHArgvAlwaysNamespaced(t *testing.T) {
43	}	43	}
44	}	44	}
45		45
46	// resolveTenant derives the tenant from the credential (via /me) when	46	// resolvePlane derives the tenant from the credential (via /me) when nothing
47	// EITRI_TENANT is unset, so the namespaced connect name can be built without the	47	// pins it, so the namespaced connect name can be built without the user knowing
48	// user knowing their tenant.	48	// their tenant.
49	func TestResolveTenantFromMe(t *testing.T) {	49	func TestResolvePlaneTenantFromMe(t *testing.T) {
50	var gotAuth string	50	var gotAuth string
51	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {	51	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
52	gotAuth = r.Header.Get("Authorization")	52	gotAuth = r.Header.Get("Authorization")
@@ -61,40 +61,105 @@ func TestResolveTenantFromMe(t *testing.T) {
61	e := testEnv()	61	e := testEnv()
62	e.URL = srv.URL	62	e.URL = srv.URL
63	e.Tenant = ""	63	e.Tenant = ""
64	got, err := resolveTenant(e)	64	got, err := resolvePlane(e)
65	if err != nil {	65	if err != nil {
66	t.Fatal(err)	66	t.Fatal(err)
67	}	67	}
68	if got != "acme" {	68	if got.Tenant != "acme" {
69	t.Errorf("tenant = %q, want acme", got)	69	t.Errorf("tenant = %q, want acme", got.Tenant)
70	}	70	}
71	if gotAuth != "Bearer tok123" {	71	if gotAuth != "Bearer tok123" {
72	t.Errorf("auth = %q, want Bearer tok123", gotAuth)	72	t.Errorf("auth = %q, want Bearer tok123", gotAuth)
73	}	73	}
74	}	74	}
75		75
76	// EITRI_TENANT pins the tenant with no HTTP call — offline and the multi-tenant	76	// TestResolvePlaneGateOrder pins the gate's whole precedence chain in one place.
77	// escape hatch.	77	// A pinned gate (EITRI_GATE, or the config file — both reach here as a non-empty
78	func TestResolveTenantEnvShortCircuits(t *testing.T) {	78	// Env.Gate) outranks even a plane that names a different one; unpinned, the
		79	// plane's own answer is taken; and the hardcoded hosted address survives only as
		80	// the rung below that, for a server too old to send ssh_gate.
		81	func TestResolvePlaneGateOrder(t *testing.T) {
		82	t.Setenv("EITRI_TOKEN", "tok")
		83	for _, tc := range []struct {
		84	name string
		85	pinned string // Env.Gate as the env or the config file left it
		86	meBody string
		87	want string
		88	}{
		89	{
		90	name: "a pinned gate outranks the plane's own answer",
		91	pinned: "gate.mine:2222",
		92	meBody: `{"tenant":"acme","ssh_gate":"gate.acme.example:2222"}`,
		93	want: "gate.mine:2222",
		94	},
		95	{
		96	name: "unpinned, the plane names its own gate",
		97	meBody: `{"tenant":"acme","ssh_gate":"gate.acme.example:2222"}`,
		98	want: "gate.acme.example:2222",
		99	},
		100	{
		101	name: "a server too old to say falls back to the hosted address",
		102	meBody: `{"tenant":"acme"}`,
		103	want: defaultGate,
		104	},
		105	} {
		106	t.Run(tc.name, func(t *testing.T) {
		107	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		108	w.Write([]byte(tc.meBody))
		109	}))
		110	defer srv.Close()
		111
		112	e := testEnv()
		113	e.URL, e.Gate, e.Tenant = srv.URL, tc.pinned, ""
		114	got, err := resolvePlane(e)
		115	if err != nil {
		116	t.Fatal(err)
		117	}
		118	if got.Gate != tc.want {
		119	t.Errorf("gate = %q, want %q", got.Gate, tc.want)
		120	}
		121	if got.Tenant != "acme" {
		122	t.Errorf("tenant = %q, want acme", got.Tenant)
		123	}
		124	})
		125	}
		126	}
		127
		128	// Both values pinned is the offline path: nothing to ask, so nothing is asked.
		129	func TestResolvePlaneFullyPinnedShortCircuits(t *testing.T) {
79	srv := httptest.NewServer(http.HandlerFunc(func(http.ResponseWriter, *http.Request) {	130	srv := httptest.NewServer(http.HandlerFunc(func(http.ResponseWriter, *http.Request) {
80	t.Error("EITRI_TENANT must short-circuit — no /me call")	131	t.Error("a pinned tenant and gate must short-circuit — no /me call")
81	}))	132	}))
82	defer srv.Close()	133	defer srv.Close()
83		134
84	e := testEnv()	135	e := testEnv()
85	e.URL = srv.URL	136	e.URL, e.Tenant = srv.URL, "team"
86	e.Tenant = "team"	137	got, err := resolvePlane(e)
87	got, err := resolveTenant(e)	138	if err != nil {
		139	t.Fatal(err)
		140	}
		141	if got.Tenant != "team" \|\| got.Gate != "gate.example:2222" {
		142	t.Errorf("resolved = %+v", got)
		143	}
		144	}
		145
		146	// A pinned tenant with no credential still needs a gate, and there is nobody to
		147	// ask: the hosted address is the assumption, and it is made without a call.
		148	func TestResolvePlaneNoTokenPinnedTenant(t *testing.T) {
		149	t.Setenv("EITRI_TOKEN", "")
		150	e := testEnv()
		151	e.Gate, e.Tenant = "", "team"
		152	got, err := resolvePlane(e)
88	if err != nil {	153	if err != nil {
89	t.Fatal(err)	154	t.Fatal(err)
90	}	155	}
91	if got != "team" {	156	if got.Gate != defaultGate {
92	t.Errorf("tenant = %q, want team", got)	157	t.Errorf("gate = %q, want %q", got.Gate, defaultGate)
93	}	158	}
94	}	159	}
95		160
96	// A credential that resolves to no tenant, or a failing /me, is a clear error.	161	// A credential that resolves to no tenant, or a failing /me, is a clear error.
97	func TestResolveTenantMeFailures(t *testing.T) {	162	func TestResolvePlaneMeFailures(t *testing.T) {
98	t.Setenv("EITRI_TOKEN", "tok")	163	t.Setenv("EITRI_TOKEN", "tok")
99		164
100	// Empty tenant in the /me response.	165	// Empty tenant in the /me response.
@@ -104,7 +169,7 @@ func TestResolveTenantMeFailures(t *testing.T) {
104	defer empty.Close()	169	defer empty.Close()
105	e := testEnv()	170	e := testEnv()
106	e.URL, e.Tenant = empty.URL, ""	171	e.URL, e.Tenant = empty.URL, ""
107	if _, err := resolveTenant(e); err == nil \|\| !strings.Contains(err.Error(), "no tenant") {	172	if _, err := resolvePlane(e); err == nil \|\| !strings.Contains(err.Error(), "no tenant") {
108	t.Errorf("empty tenant: got %v", err)	173	t.Errorf("empty tenant: got %v", err)
109	}	174	}
110		175
@@ -114,20 +179,21 @@ func TestResolveTenantMeFailures(t *testing.T) {
114	}))	179	}))
115	defer boom.Close()	180	defer boom.Close()
116	e.URL = boom.URL	181	e.URL = boom.URL
117	if _, err := resolveTenant(e); err == nil \|\| !strings.Contains(err.Error(), "resolving your tenant") {	182	if _, err := resolvePlane(e); err == nil \|\| !strings.Contains(err.Error(), "resolving your tenant") {
118	t.Errorf("me error: got %v", err)	183	t.Errorf("me error: got %v", err)
119	}	184	}
120	}	185	}
121		186
122	// With neither EITRI_TENANT nor EITRI_TOKEN the connect name cannot be built;	187	// With no tenant and no credential the connect name cannot be built; the error
123	// the error names both remedies before any network call.	188	// names every remedy before any network call.
124	func TestResolveTenantNoTokenNoTenant(t *testing.T) {	189	func TestResolvePlaneNoTokenNoTenant(t *testing.T) {
125	t.Setenv("EITRI_TOKEN", "")	190	t.Setenv("EITRI_TOKEN", "")
126	e := testEnv()	191	e := testEnv()
127	e.Tenant = ""	192	e.Tenant = ""
128	_, err := resolveTenant(e)	193	_, err := resolvePlane(e)
129	if err == nil \|\| !strings.Contains(err.Error(), "EITRI_TOKEN") \|\| !strings.Contains(err.Error(), "EITRI_TENANT") {	194	if err == nil \|\| !strings.Contains(err.Error(), "eitri init") \|\|
130	t.Errorf("want error naming EITRI_TOKEN and EITRI_TENANT, got %v", err)	195	!strings.Contains(err.Error(), "EITRI_TOKEN") \|\| !strings.Contains(err.Error(), "EITRI_TENANT") {
		196	t.Errorf("want error naming init, EITRI_TOKEN and EITRI_TENANT, got %v", err)
131	}	197	}
132	}	198	}
133		199