Skip to content

rename enable-ssh to allow-ssh and use SSH Certs instead of keys - #460

Draft
patelspratik wants to merge 11 commits into
mainfrom
cafornodes
Draft

rename enable-ssh to allow-ssh and use SSH Certs instead of keys#460
patelspratik wants to merge 11 commits into
mainfrom
cafornodes

Conversation

@patelspratik

@patelspratik patelspratik commented Aug 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

@patelspratik
patelspratik force-pushed the cafornodes branch 2 times, most recently from 35f8f10 to a1ba25c Compare August 27, 2026 15:38
@patelspratik patelspratik changed the title Cafornodes rename enable-ssh to allow-ssh and use SSH Certs instead of keys Aug 27, 2026
@patelspratik
patelspratik force-pushed the cafornodes branch 3 times, most recently from dc366d0 to c609cbf Compare August 27, 2026 20:00
@patelspratik
Credential chain: API key org resolution and ephemeral register login
4b49e49 
Rebased onto pr1-register-resiliency (post ssh-certs uptake).

- BREV_ACCESS_KEY renamed to BREV_API_KEY (never released); all
  access-key identifiers and messages renamed to API key
- Env-key orgs resolve in real time from the backend: the key is bound
  to exactly one org server-side, so no persisted org is consulted and
  staleness is impossible. Established logins keep persisted org
  behavior (APIKeyOrgID / active-org cache)
- Single-org invariant hoisted to auth.SingleOrgForAPIKey, shared by
  register and the general resolution path
- GetActiveOrganizationOrNil branches on credential source; env path
  returns the full org (name included) without a second GetOrganization
  round-trip
- Register with no env key and no persisted credential now prompts the
  device-flow login (externalNodeAuth fallback) instead of erroring;
  tokens stay in memory, the login email is cached for pre-fill
- Register tests moved/renamed to the APIKey convention
@patelspratik
Document why token login clears BREV_API_KEY
65f40d0
@patelspratik
Clean up declined-login error noise
c3da984 
A declined login prompt used to spray stack-traced WARN/ERROR retry
chatter through resty and print a multi-frame trace at exit.

- auth: return DeclineToLoginError unwrapped from PromptForLogin,
  GetFreshAccessTokenOrLogin, and LoginAuth.GetAccessToken so the
  sentinel travels without trace wrapping
- store: pass the sentinel through AuthHTTPStore/OnBeforeRequest
  unwrapped; quiet resty logger suppresses retry chatter for the
  decline message while logging everything else
- cmderrors: friendly message + directive for declined login; no
  Sentry report, no stack trace
- errors: export DeclineToLoginMessage const used by the log filter
@patelspratik
cleanup
ef39e70
@patelspratik
Add isAuthenticated to register; skip GetCurrentUser for API keys
e5dda02 
The GetCurrentUser probe existed to catch stale JWTs before local side
effects. With an API key present that probe is redundant — the key is
validated for real by the first API call it authenticates
(ResolveOrgForAPIKey) — so skip it and let the org resolution surface
any auth failure with a key-specific message.
@patelspratik
Exit silently on declined login; align test with renamed message
1f9539c 
A declined login prompt is not an error: the user deliberately said no,
and the prompt itself is all the context they need. Handle it before
any Sentry breadcrumb or switch processing — no breadcrumb, no message,
no directive. Remove the now-redundant DeclineToLoginError case from
the display switch.

Also update TestGetAPIKeyOrgID_MissingPersistedOrgReturnsError to match
the renamed MissingAPIKeyOrgIDMessage wording.
@patelspratik
cleaning
4aa0a83
@patelspratik
Redact credential-shaped flag values in analytics
7663c02 
The analytics flag serialization sent every explicitly-set flag's value
to PostHog, including the hidden global --api-key flag — disclosing the
full credential on both success and failure capture paths.

Fix generically:
- redactFlagValue: values matching a Brev API key (bak- prefix) or a
  JWT shape (three dot-separated segments) are replaced with
  "[redacted]"; benign values pass through
- MarkFlagSensitive: pflag annotation for flags that must always be
  redacted regardless of value shape
- applied to the global --api-key flag and login's --token/--api-key
  flags; redaction is centralized in one visitor shared by both
  capture paths

Flag names are still reported, so usage analytics survive.
@patelspratik
cleanup
5b11691
@patelspratik
Fix factory-installed logger discarding all resty output
46c6a9b 
The factory wired quietRestyLogger over discardLogger, so while the
filter itself correctly forwarded non-decline messages, its sink
swallowed everything: real HTTP errors, unexpected auth failures, and
all debug output were silently dropped. The declined-login test masked
this by replacing the sink after construction.

Replace discardLogger with stderrLogger (mirrors resty's default:
stderr, date+micro, WARN/ERROR RESTY prefixes) and test the full
factory chain without sink replacement: declined login stays quiet,
unrelated auth errors still reach stderr with their message.
@patelspratik
Rename enable-ssh to allow-ssh with cert-authority support
df9e8fe 
Rename enable-ssh to allow-ssh. The command now writes a
cert-authority,principals="brev:v1:vm:<nodeID>:login:<user>" <CA key>
line to authorized_keys using the certificate_authority from the node.

Add disallow-ssh command that removes the cert-authority line.

Register sends sshprovider=certauth label in AddNode. Deregister
removes the cert-authority line instead of per-user keys.

CLI go.mod uses a local replace for the proto module until the BSR
publishes the certificate_authority field.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@patelspratik