Implement ssh_keys model and attach to users #4

New Issue

2025-09-23T14:35:16Z

boris commented

2025-09-23 14:35:16 +00:00

As an end user, I want to register my SSH public keys so that I can request access to servers using those keys.

Acceptance Criteria (G/W/T)

Given a valid JWT, when I POST /api/v1/keys with name, public_key (ed25519 or ecdsa-p256), optional expires_at, then the key is stored and returned with id, algo, is_active=true.
Given I have keys, when I GET /api/v1/keys, then I see only my keys.
Given an invalid key format/algorithm, when I attempt to add it, then I get 422 with a clear error.
Given a key I own, when I DELETE /api/v1/keys/{id} or PATCH to deactivate, then the key is no longer active and won’t be deployed by agents.

Notes / Non-functional

Enforce allowed algos (default: ssh-ed25519, ecdsa-sha2-nistp256).
Store original key string; parse/validate on write.
Add index (user_id, is_active) for quick lookups.

As an end user, I want to register my SSH public keys so that I can request access to servers using those keys. Acceptance Criteria (G/W/T) - [x] Given a valid JWT, when I POST /api/v1/keys with name, public_key (ed25519 or ecdsa-p256), optional expires_at, then the key is stored and returned with id, algo, is_active=true. - [x] Given I have keys, when I GET /api/v1/keys, then I see only my keys. - [x] Given an invalid key format/algorithm, when I attempt to add it, then I get 422 with a clear error. - [x] Given a key I own, when I DELETE /api/v1/keys/{id} or PATCH to deactivate, then the key is no longer active and won’t be deployed by agents. Notes / Non-functional - [x] Enforce allowed algos (default: ssh-ed25519, ecdsa-sha2-nistp256). - [x] Store original key string; parse/validate on write. - [x] Add index (user_id, is_active) for quick lookups.

boris added this to the Minimum Viable Product milestone 2025-09-23 14:35:16 +00:00

boris added the Kind/Feature

Priority

Critical

1

labels 2025-09-23 14:35:16 +00:00

boris self-assigned this 2025-09-23 14:35:16 +00:00

boris added this to the Keywarden project 2025-09-23 14:35:16 +00:00

boris added the

Status

Blocked

1

label 2025-09-23 14:35:26 +00:00

boris commented

2026-01-27 09:31:45 +00:00

Pivoted to SSH CA and Certificates.

New Flow:

Authenticated user adds public key from device to profile
User gains access to target server on Keywarden
User object now has object permissions to view target server object
Signed SSH certificate derived from pubkey grants access to server

Pivoted to SSH CA and Certificates. New Flow: - Authenticated user adds public key from device to profile - User gains access to target server on Keywarden - User object now has object permissions to view target server object - Signed SSH certificate derived from pubkey grants access to server

boris commented

2026-01-27 09:34:24 +00:00

Implemented in keywarden/dev. Closing for now, will merge to main later.

boris closed this issue

2026-01-27 09:34:24 +00:00

boris moved this to Done in Keywarden on 2026-02-16 14:30:03 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: boris/keywarden#4