e870254
use crate::session::{RequestId, Session};
use actix_web::web;
use uuid::Uuid;
use crate::envelope::{Envelope, NoData};
use crate::server::AuthSvc;
use crate::server::errors::AuthError;
use crate::server::share::types::ListQuery;
use crate::server::ssh_key::types::{SshKeyAddRequest, SshKeySummary};
#[utoipa::path(
get,
path = "/api/v1/oauth/ssh-keys",
tag = "auth",
operation_id = "auth_ssh_key_list",
summary = "列示 SSH 公钥",
description = "按创建时间倒序返回当前账号的公钥，含已吊销与已过期的记录。分页参数由 `page` / `page_size` 控制。查询串不是合法分页参数时由 actix-web 直接返回 400。",
params(
("page" = Option<u64>, Query, description = "页码，从 1 开始；默认 1"),
("page_size" = Option<u64>, Query, description = "每页条数，默认 20，最多 100")
),
responses(
(
status = 200,
description = "公钥列表",
body = Envelope<Vec<SshKeySummary>>,
example = json!({"code":200,"message":"success","data":[{"id":"018f2b1c-4d5e-7f80-9a1b-2c3d4e5f6072","name":"thinkpad","description":"笔记本","algorithm":"ed25519","fingerprint":"SHA256:9pQ2mLk1v3sT6yZx8cV0bN4mR7wQ2eH5jK9aD1sF3gU","public_key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL9kQ2mXv7Tb1sYz8cV0bN4mR7wQ2eH5jK9aD1sF3gU thinkpad","created_at":"2026-01-02T03:04:05Z","expires_at":null,"last_used_at":null,"revoked_at":null}]})
),
(
status = 401,
description = "会话未绑定账号（`unauthenticated`）",
body = Envelope<NoData>,
example = json!({"code": "unauthenticated", "message": "authentication required"})
),
(
status = 500,
description = "服务端故障（`internal`、`database`、`session`、`serialization`）",
body = Envelope<NoData>,
example = json!({"code": "internal", "message": "internal server error"})
)
)
)]
pub async fn ssh_key_list(
svc: web::Data<AuthSvc>,
session: Session,
query: web::Query<ListQuery>,
request_id: RequestId,
) -> Result<Envelope<Vec<SshKeySummary>>, AuthError> {
let keys = svc
.list_ssh_keys(session, query.into_inner(), request_id.0)
.await?;
Ok(Envelope::ok(keys))
}
#[utoipa::path(
post,
path = "/api/v1/oauth/ssh-keys",
tag = "auth",
operation_id = "auth_ssh_key_add",
summary = "添加 SSH 公钥",
description = "名称 1~64 字符、备注最长 255 字符，公钥 32~8192 字节且必须是受支持的单行 OpenSSH 公钥，`expires_at` 必须晚于当前时间。重复公钥（指纹唯一）返回 `ssh_key_taken`。添加成功记 `PublicKeyAdded` 审计事件。",
request_body = SshKeyAddRequest,
responses(
(
status = 200,
description = "公钥已登记",
body = Envelope<SshKeySummary>,
example = json!({"code":200,"message":"success","data":{"id":"018f2b1c-4d5e-7f80-9a1b-2c3d4e5f6072","name":"thinkpad","description":"笔记本","algorithm":"ed25519","fingerprint":"SHA256:9pQ2mLk1v3sT6yZx8cV0bN4mR7wQ2eH5jK9aD1sF3gU","public_key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL9kQ2mXv7Tb1sYz8cV0bN4mR7wQ2eH5jK9aD1sF3gU thinkpad","created_at":"2026-01-02T03:04:05Z","expires_at":null,"last_used_at":null,"revoked_at":null}})
),
(
status = 400,
description = "名称、备注、公钥或过期时间不合法（`ssh_key_name_invalid`、`malformed_request`、`ssh_key_invalid`、`invalid_expiry`）",
body = Envelope<NoData>,
example = json!({"code": "ssh_key_invalid", "message": "public key is invalid"})
),
(
status = 401,
description = "会话未绑定账号，或账号已删除 / 不允许使用（`unauthenticated`）",
body = Envelope<NoData>,
example = json!({"code": "unauthenticated", "message": "authentication required"})
),
(
status = 409,
description = "同一把公钥已经登记过（`ssh_key_taken`）",
body = Envelope<NoData>,
example = json!({"code": "ssh_key_taken", "message": "public key is already registered"})
),
(
status = 500,
description = "服务端故障（`internal`、`database`、`session`、`serialization`）",
body = Envelope<NoData>,
example = json!({"code": "internal", "message": "internal server error"})
)
)
)]
pub async fn ssh_key_add(
svc: web::Data<AuthSvc>,
session: Session,
body: web::Json<SshKeyAddRequest>,
request_id: RequestId,
) -> Result<Envelope<SshKeySummary>, AuthError> {
let user_agent = session.user_agent()?;
let ip_addr = session.client_ip()?;
let response = svc
.add_ssh_key(
session,
body.into_inner(),
user_agent,
ip_addr,
request_id.0,
)
.await?;
Ok(Envelope::ok(response))
}
/// 只动自己名下的记录，已在吊销状态时重复调用照样返回成功；吊销与递增账号 `security_version`
#[utoipa::path(
delete,
path = "/api/v1/oauth/ssh-keys/{key_id}",
tag = "auth",
operation_id = "auth_ssh_key_delete",
summary = "吊销 SSH 公钥",
description = "把公钥标记为已吊销，记录保留不硬删；重复调用幂等。公钥不存在或不属于当前账号返回 `ssh_key_not_found`。吊销成功记 `PublicKeyRemoved` 审计事件，并递增 `security_version` 让该账号既有的访问令牌一并失效。`key_id` 不是合法 UUID 时由 actix-web 的路径提取器直接返回 400。",
params(
("key_id" = Uuid, Path, description = "公钥编号")
),
responses(
(
status = 200,
description = "已吊销；重复调用同样返回成功",
body = Envelope<NoData>,
example = json!({"code":200,"message":"success","data":null})
),
(
status = 401,
description = "会话未绑定账号（`unauthenticated`）",
body = Envelope<NoData>,
example = json!({"code": "unauthenticated", "message": "authentication required"})
),
(
status = 404,
description = "公钥不存在或不属于当前账号（`ssh_key_not_found`）",
body = Envelope<NoData>,
example = json!({"code": "ssh_key_not_found", "message": "ssh key does not exist"})
),
(
status = 500,
description = "服务端故障（`internal`、`database`、`session`、`serialization`）",
body = Envelope<NoData>,
example = json!({"code": "internal", "message": "internal server error"})
)
)
)]
pub async fn ssh_key_delete(
svc: web::Data<AuthSvc>,
session: Session,
key_id: web::Path<Uuid>,
request_id: RequestId,
) -> Result<Envelope<NoData>, AuthError> {
let user_agent = session.user_agent()?;
let ip_addr = session.client_ip()?;
svc.revoke_ssh_key(
session,
key_id.into_inner(),
user_agent,
ip_addr,
request_id.0,
)
.await?;
Ok(Envelope::empty())
}