SSH key expiry and last use !168

merged merged by cmc on 2026-10-14 08:08 UTC · krz/gitbay-ios:key-expiry into main

3 files changed, +117 −7

Layout: unified · split

gitbay/Account/AccountViewModel.swift +19 −1

	@@ -13,7 +13,24 @@ final class AccountViewModel {
13	let scope: String	13	let scope: String
14	/// A name for the key (v1.21.0); omitted when none is set.	14	/// A name for the key (v1.21.0); omitted when none is set.
15	let label: String?	15	let label: String?
		16	/// The token or key that added it, when one did rather than you.
		17	var createdBy: String? = nil
		18	/// When the key last signed in; absent when it never has.
		19	var lastUsedAt: Date? = nil
		20	/// When the key stops working; absent when it does not expire.
		21	var expiresAt: Date? = nil
16	var id: String { fingerprint }	22	var id: String { fingerprint }
		23
		24	enum CodingKeys: String, CodingKey {
		25	case fingerprint, algo, scope, label
		26	case createdBy = "created_by"
		27	case lastUsedAt = "last_used_at"
		28	case expiresAt = "expires_at"
		29	}
		30
		31	func isExpired(at now: Date) -> Bool {
		32	expiresAt.map { $0 <= now } ?? false
		33	}
17	/// What removal asks to be typed, as the web does: the first	34	/// What removal asks to be typed, as the web does: the first
18	/// eight characters of the fingerprint after `SHA256:`.	35	/// eight characters of the fingerprint after `SHA256:`.
19	var confirmation: String {	36	var confirmation: String {
	@@ -135,10 +152,11 @@ final class AccountViewModel {
135	/// `keys add [--scope full\|git] [--label <text>]` — the	152	/// `keys add [--scope full\|git] [--label <text>]` — the
136	/// authorized_keys line travels as raw stdin; a public key is not a	153	/// authorized_keys line travels as raw stdin; a public key is not a
137	/// secret. A blank label sends no flag.	154	/// secret. A blank label sends no flag.
138	func addSSHKey(_ publicKey: String, scope: String, label: String = "") async {	155	func addSSHKey(_ publicKey: String, scope: String, label: String = "", ttl: String? = nil) async {
139	var argv = ["keys", "add", "--scope", scope]	156	var argv = ["keys", "add", "--scope", scope]
140	let label = label.trimmingCharacters(in: .whitespaces)	157	let label = label.trimmingCharacters(in: .whitespaces)
141	if !label.isEmpty { argv.append(contentsOf: ["--label", label]) }	158	if !label.isEmpty { argv.append(contentsOf: ["--label", label]) }
		159	if let ttl { argv.append(contentsOf: ["--ttl", ttl]) }
142	await perform(argv, stdin: publicKey.trimmingCharacters(in: .whitespacesAndNewlines))	160	await perform(argv, stdin: publicKey.trimmingCharacters(in: .whitespacesAndNewlines))
143	}	161	}
144		162

gitbay/Views/Account/AccountView.swift +42 −6

                 scopes: ["full", "git"],
                 working: model.working,
                 errorMessage: model.actionError
-            ) { text, scope, label in
+            ) { text, scope, label, ttl in
                 Task {
-                    await model.addSSHKey(text, scope: scope ?? "full", label: label)
+                    await model.addSSHKey(text, scope: scope ?? "full", label: label, ttl: ttl)
                     if model.actionError == nil { addingSSH = false }
                 }
             }
                 scopes: nil,
                 working: model.working,
                 errorMessage: model.actionError
-            ) { text, _, _ in
+            ) { text, _, _, _ in
                 Task {
                     await model.addPGPKey(text)
                     if model.actionError == nil { addingPGP = false }
                     HStack(spacing: 6) {
                         Text(key.algo)
                         GBChip(key.scope, .secondary)
+                        if let by = key.createdBy {
+                            Text("added by \(by)")
+                        }
                     }
                     .font(.gbSans(.caption2))
                     .foregroundStyle(.secondary)
+                    keyDates(key)
                 }
                 .swipeActions {
                     Button("Remove", role: .destructive) {
         }
     }
+    /// When the key was last used and when it stops working, as the CLI's
+    /// key list says it.
+    private func keyDates(_ key: AccountViewModel.SSHKey) -> some View {
+        HStack(spacing: 4) {
+            if let used = key.lastUsedAt {
+                Text("used \(used.formatted(.relative(presentation: .named)))")
+            } else {
+                Text("never used")
+            }
+            if let expires = key.expiresAt {
+                Text("·")
+                if key.isExpired(at: .now) {
+                    Text("expired \(expires.formatted(date: .abbreviated, time: .omitted))")
+                        .foregroundStyle(Color.gbBad)
+                } else {
+                    Text("expires \(expires.formatted(date: .abbreviated, time: .omitted))")
+                }
+            }
+        }
+        .font(.gbSans(.caption2))
+        .foregroundStyle(.secondary)
+    }
     private func pgpSection(_ keys: [AccountViewModel.PGPKey]) -> some View {
         Section {
             ForEach(keys) { key in
     let scopes: [String]?
     let working: Bool
     let errorMessage: String?
-    /// Text, scope (nil without scopes), label (empty without scopes).
+    /// Text, scope (nil without scopes), label (empty without scopes),
-    let onSubmit: (String, String?, String) -> Void
+    /// and the key's lifetime (nil when it does not expire, or without scopes).
+    let onSubmit: (String, String?, String, String?) -> Void
     @Environment(\.dismiss) private var dismiss
     @State private var text = ""
     @State private var scope = "full"
     @State private var label = ""
+    @State private var ttl: String?
     var body: some View {
         NavigationStack {
                             .autocorrectionDisabled()
                             .textInputAutocapitalization(.never)
                             .accessibilityIdentifier("key-paste-label")
+                        Picker("Expires", selection: $ttl) {
+                            Text("Never").tag(String?.none)
+                            Text("In 30 days").tag(String?.some("30d"))
+                            Text("In 90 days").tag(String?.some("90d"))
+                            Text("In a year").tag(String?.some("365d"))
+                        }
+                        .accessibilityIdentifier("key-paste-ttl")
                     }
                 }
                 if let errorMessage {
                         ProgressView()
                     } else {
                         Button("Add") {
-                            onSubmit(text, scopes != nil ? scope : nil, scopes != nil ? label : "")
+                            onSubmit(text, scopes != nil ? scope : nil, scopes != nil ? label : "", scopes != nil ? ttl : nil)
                         }
                         .disabled(text.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty)
                         .accessibilityIdentifier("key-paste-submit")

gitbayTests/KeyExpiryTests.swift added +56

@@ -0,0 +1,56 @@
	1	import Foundation
	2	import Testing
	3	@testable import gitbay
	4
	5	private func makeClient() throws -> (GitbayClient, StubProtocol.Box) {
	6	let box = StubProtocol.box()
	7	let client = GitbayClient(
	8	instance: try GitbayInstance(url: "https://gitbay.org"),
	9	token: "test-token",
	10	session: box.session()
	11	)
	12	return (client, box)
	13	}
	14
	15	private func posted(_ stub: StubProtocol.Box) throws -> [[String]] {
	16	try stub.seen.filter { $0.method == "POST" }.map { seen in
	17	let body = try #require(try JSONSerialization.jsonObject(with: seen.body) as? [String: Any])
	18	return try #require(body["argv"] as? [String])
	19	}
	20	}
	21
	22	struct KeyExpiryTests {
	23
	24	@Test func keysCarryLastUseExpiryAndWhoCreatedThem() throws {
	25	let json = """
	26	[{"fingerprint":"SHA256:a","algo":"ssh-ed25519","scope":"full","label":"laptop",\
	27	"last_used_at":"2026-10-14T07:32:16.789Z"},\
	28	{"fingerprint":"SHA256:b","algo":"ssh-ed25519","scope":"git","label":"ci",\
	29	"created_by":"phone","expires_at":"2026-01-01T00:00:00Z"},\
	30	{"fingerprint":"SHA256:c","algo":"ssh-ed25519","scope":"full","label":""}]
	31	"""
	32	let keys = try GitbayClient.decoder().decode([AccountViewModel.SSHKey].self, from: Data(json.utf8))
	33	let now = try Date("2026-10-15T00:00:00Z", strategy: .iso8601)
	34
	35	#expect(keys[0].lastUsedAt != nil)
	36	#expect(keys[0].expiresAt == nil)
	37	#expect(!keys[0].isExpired(at: now))
	38	#expect(keys[1].createdBy == "phone")
	39	#expect(keys[1].isExpired(at: now))
	40	#expect(keys[2].lastUsedAt == nil)
	41	}
	42	}
	43
	44	@MainActor
	45	struct KeyTTLTests {
	46
	47	@Test func anExpiringKeyIsAddedWithItsTTL() async throws {
	48	let (client, stub) = try makeClient()
	49	stub.enqueue(.init(status: 200, json: #"{"protocol_version":1,"data":{},"exit_code":0}"#, match: "cmd"))
	50	let model = AccountViewModel(client: client)
	51
	52	await model.addSSHKey("ssh-ed25519 AAAA phone", scope: "full", label: "phone", ttl: "90d")
	53
	54	#expect(try posted(stub) == [["keys", "add", "--scope", "full", "--label", "phone", "--ttl", "90d"]])
	55	}
	56	}