Commit `fa307c5cb1`

fa307c5cb107019bcefc93f6d3c63fc7f684c03c

parent: 2e7fd48cb0

Verified · cmc

cmc <hello@cleberg.net> · 2026-10-14 07:34 UTC

SSH key expiry and last use

Each key says when it was last used, when it expires or that it has,
and the token or key that added it. Adding a key can set it to expire
in 30 days, 90 days or a year, through keys add --ttl.

Closes #32

Layout: unified · split

gitbay/Account/AccountViewModel.swift +19 −1

	@@ -13,7 +13,24 @@ final class AccountViewModel {
13	let scope: String	13	let scope: String
14	/// A name for the key (v1.21.0); omitted when none is set.	14	/// A name for the key (v1.21.0); omitted when none is set.
15	let label: String?	15	let label: String?
		16	/// The token or key that added it, when one did rather than you.
		17	var createdBy: String? = nil
		18	/// When the key last signed in; absent when it never has.
		19	var lastUsedAt: Date? = nil
		20	/// When the key stops working; absent when it does not expire.
		21	var expiresAt: Date? = nil
16	var id: String { fingerprint }	22	var id: String { fingerprint }
		23
		24	enum CodingKeys: String, CodingKey {
		25	case fingerprint, algo, scope, label
		26	case createdBy = "created_by"
		27	case lastUsedAt = "last_used_at"
		28	case expiresAt = "expires_at"
		29	}
		30
		31	func isExpired(at now: Date) -> Bool {
		32	expiresAt.map { $0 <= now } ?? false
		33	}
17	/// What removal asks to be typed, as the web does: the first	34	/// What removal asks to be typed, as the web does: the first
18	/// eight characters of the fingerprint after `SHA256:`.	35	/// eight characters of the fingerprint after `SHA256:`.
19	var confirmation: String {	36	var confirmation: String {
	@@ -135,10 +152,11 @@ final class AccountViewModel {
135	/// `keys add [--scope full\|git] [--label <text>]` — the	152	/// `keys add [--scope full\|git] [--label <text>]` — the
136	/// authorized_keys line travels as raw stdin; a public key is not a	153	/// authorized_keys line travels as raw stdin; a public key is not a
137	/// secret. A blank label sends no flag.	154	/// secret. A blank label sends no flag.
138	func addSSHKey(_ publicKey: String, scope: String, label: String = "") async {	155	func addSSHKey(_ publicKey: String, scope: String, label: String = "", ttl: String? = nil) async {
139	var argv = ["keys", "add", "--scope", scope]	156	var argv = ["keys", "add", "--scope", scope]
140	let label = label.trimmingCharacters(in: .whitespaces)	157	let label = label.trimmingCharacters(in: .whitespaces)
141	if !label.isEmpty { argv.append(contentsOf: ["--label", label]) }	158	if !label.isEmpty { argv.append(contentsOf: ["--label", label]) }
		159	if let ttl { argv.append(contentsOf: ["--ttl", ttl]) }
142	await perform(argv, stdin: publicKey.trimmingCharacters(in: .whitespacesAndNewlines))	160	await perform(argv, stdin: publicKey.trimmingCharacters(in: .whitespacesAndNewlines))
143	}	161	}
144		162

gitbay/Views/Account/AccountView.swift +42 −6

                 scopes: ["full", "git"],
                 working: model.working,
                 errorMessage: model.actionError
-            ) { text, scope, label in
+            ) { text, scope, label, ttl in
                 Task {
-                    await model.addSSHKey(text, scope: scope ?? "full", label: label)
+                    await model.addSSHKey(text, scope: scope ?? "full", label: label, ttl: ttl)
                     if model.actionError == nil { addingSSH = false }
                 }
             }
                 scopes: nil,
                 working: model.working,
                 errorMessage: model.actionError
-            ) { text, _, _ in
+            ) { text, _, _, _ in
                 Task {
                     await model.addPGPKey(text)
                     if model.actionError == nil { addingPGP = false }
                     HStack(spacing: 6) {
                         Text(key.algo)
                         GBChip(key.scope, .secondary)
+                        if let by = key.createdBy {
+                            Text("added by \(by)")
+                        }
                     }
                     .font(.gbSans(.caption2))
                     .foregroundStyle(.secondary)
+                    keyDates(key)
                 }
                 .swipeActions {
                     Button("Remove", role: .destructive) {
         }
     }
+    /// When the key was last used and when it stops working, as the CLI's
+    /// key list says it.
+    private func keyDates(_ key: AccountViewModel.SSHKey) -> some View {
+        HStack(spacing: 4) {
+            if let used = key.lastUsedAt {
+                Text("used \(used.formatted(.relative(presentation: .named)))")
+            } else {
+                Text("never used")
+            }
+            if let expires = key.expiresAt {
+                Text("·")
+                if key.isExpired(at: .now) {
+                    Text("expired \(expires.formatted(date: .abbreviated, time: .omitted))")
+                        .foregroundStyle(Color.gbBad)
+                } else {
+                    Text("expires \(expires.formatted(date: .abbreviated, time: .omitted))")
+                }
+            }
+        }
+        .font(.gbSans(.caption2))
+        .foregroundStyle(.secondary)
+    }
     private func pgpSection(_ keys: [AccountViewModel.PGPKey]) -> some View {
         Section {
             ForEach(keys) { key in
     let scopes: [String]?
     let working: Bool
     let errorMessage: String?
-    /// Text, scope (nil without scopes), label (empty without scopes).
+    /// Text, scope (nil without scopes), label (empty without scopes),
-    let onSubmit: (String, String?, String) -> Void
+    /// and the key's lifetime (nil when it does not expire, or without scopes).
+    let onSubmit: (String, String?, String, String?) -> Void
     @Environment(\.dismiss) private var dismiss
     @State private var text = ""
     @State private var scope = "full"
     @State private var label = ""
+    @State private var ttl: String?
     var body: some View {
         NavigationStack {
                             .autocorrectionDisabled()
                             .textInputAutocapitalization(.never)
                             .accessibilityIdentifier("key-paste-label")
+                        Picker("Expires", selection: $ttl) {
+                            Text("Never").tag(String?.none)
+                            Text("In 30 days").tag(String?.some("30d"))
+                            Text("In 90 days").tag(String?.some("90d"))
+                            Text("In a year").tag(String?.some("365d"))
+                        }
+                        .accessibilityIdentifier("key-paste-ttl")
                     }
                 }
                 if let errorMessage {
                         ProgressView()
                     } else {
                         Button("Add") {
-                            onSubmit(text, scopes != nil ? scope : nil, scopes != nil ? label : "")
+                            onSubmit(text, scopes != nil ? scope : nil, scopes != nil ? label : "", scopes != nil ? ttl : nil)
                         }
                         .disabled(text.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty)
                         .accessibilityIdentifier("key-paste-submit")

gitbayTests/KeyExpiryTests.swift added +56

@@ -0,0 +1,56 @@
	1	import Foundation
	2	import Testing
	3	@testable import gitbay
	4
	5	private func makeClient() throws -> (GitbayClient, StubProtocol.Box) {
	6	let box = StubProtocol.box()
	7	let client = GitbayClient(
	8	instance: try GitbayInstance(url: "https://gitbay.org"),
	9	token: "test-token",
	10	session: box.session()
	11	)
	12	return (client, box)
	13	}
	14
	15	private func posted(_ stub: StubProtocol.Box) throws -> [[String]] {
	16	try stub.seen.filter { $0.method == "POST" }.map { seen in
	17	let body = try #require(try JSONSerialization.jsonObject(with: seen.body) as? [String: Any])
	18	return try #require(body["argv"] as? [String])
	19	}
	20	}
	21
	22	struct KeyExpiryTests {
	23
	24	@Test func keysCarryLastUseExpiryAndWhoCreatedThem() throws {
	25	let json = """
	26	[{"fingerprint":"SHA256:a","algo":"ssh-ed25519","scope":"full","label":"laptop",\
	27	"last_used_at":"2026-10-14T07:32:16.789Z"},\
	28	{"fingerprint":"SHA256:b","algo":"ssh-ed25519","scope":"git","label":"ci",\
	29	"created_by":"phone","expires_at":"2026-01-01T00:00:00Z"},\
	30	{"fingerprint":"SHA256:c","algo":"ssh-ed25519","scope":"full","label":""}]
	31	"""
	32	let keys = try GitbayClient.decoder().decode([AccountViewModel.SSHKey].self, from: Data(json.utf8))
	33	let now = try Date("2026-10-15T00:00:00Z", strategy: .iso8601)
	34
	35	#expect(keys[0].lastUsedAt != nil)
	36	#expect(keys[0].expiresAt == nil)
	37	#expect(!keys[0].isExpired(at: now))
	38	#expect(keys[1].createdBy == "phone")
	39	#expect(keys[1].isExpired(at: now))
	40	#expect(keys[2].lastUsedAt == nil)
	41	}
	42	}
	43
	44	@MainActor
	45	struct KeyTTLTests {
	46
	47	@Test func anExpiringKeyIsAddedWithItsTTL() async throws {
	48	let (client, stub) = try makeClient()
	49	stub.enqueue(.init(status: 200, json: #"{"protocol_version":1,"data":{},"exit_code":0}"#, match: "cmd"))
	50	let model = AccountViewModel(client: client)
	51
	52	await model.addSSHKey("ssh-ed25519 AAAA phone", scope: "full", label: "phone", ttl: "90d")
	53
	54	#expect(try posted(stub) == [["keys", "add", "--scope", "full", "--label", "phone", "--ttl", "90d"]])
	55	}
	56	}

Commit fa307c5cb1

Commit `fa307c5cb1`