Commit `cab50f5004`

cab50f5004df82a3ff699f71bb31f049f8deca75

parent: e2a32d5f8d

Verified · cmc

cmc <hello@cleberg.net> · 2026-09-28 07:24 UTC

store: ssh_keys.expires_at; expired keys are not live

Ref #277

Layout: unified · split

internal/store/keyexpiry_test.go added +48

@@ -0,0 +1,48 @@
	1	package store
	2
	3	import (
	4	"testing"
	5	"time"
	6	)
	7
	8	func TestKeyExpiry(t *testing.T) {
	9	s, uid, _ := revokeFixture(t)
	10	past, future := time.Now().Add(-time.Minute), time.Now().Add(time.Hour)
	11	for fp, exp := range map[string]*time.Time{"SHA256:old": &past, "SHA256:new": &future, "SHA256:ever": nil} {
	12	if err := s.AddSSHKeyFrom(uid, fp, "ssh-ed25519", []byte(fp), "full", "", KeyOrigin{ExpiresAt: exp}); err != nil {
	13	t.Fatal(err)
	14	}
	15	}
	16	now := time.Now()
	17	ids := map[string]int64{}
	18	for _, fp := range []string{"SHA256:old", "SHA256:new", "SHA256:ever"} {
	19	k, err := s.SSHKeyByFingerprint(fp)
	20	if err != nil {
	21	t.Fatal(err)
	22	}
	23	ids[fp] = k.ID
	24	byID, err := s.SSHKeyByID(k.ID)
	25	if err != nil \|\| (byID.ExpiresAt == nil) != (k.ExpiresAt == nil) {
	26	t.Fatalf("%s by id: %+v %v", fp, byID, err)
	27	}
	28	if got, want := k.Expired(now), fp == "SHA256:old"; got != want {
	29	t.Errorf("%s Expired = %v, want %v", fp, got, want)
	30	}
	31	}
	32	live, err := s.LiveSSHKeys([]int64{ids["SHA256:old"], ids["SHA256:new"], ids["SHA256:ever"]})
	33	if err != nil {
	34	t.Fatal(err)
	35	}
	36	if live[ids["SHA256:old"]] \|\| !live[ids["SHA256:new"]] \|\| !live[ids["SHA256:ever"]] {
	37	t.Fatalf("live = %v", live)
	38	}
	39	keys, err := s.ListSSHKeys(uid)
	40	if err != nil \|\| len(keys) != 3 {
	41	t.Fatalf("list: %+v %v", keys, err)
	42	}
	43	for _, k := range keys {
	44	if k.Fingerprint == "SHA256:ever" && k.ExpiresAt != nil {
	45	t.Fatalf("list: %s should have nil ExpiresAt: %+v", k.Fingerprint, k)
	46	}
	47	}
	48	}

internal/store/migrations/0061_ssh_key_expiry.down.sql added +1

	@@ -0,0 +1 @@
		1	ALTER TABLE ssh_keys DROP COLUMN expires_at;

internal/store/migrations/0061_ssh_key_expiry.up.sql added +2

@@ -0,0 +1,2 @@
	1	-- When the key stops authenticating; NULL for never.
	2	ALTER TABLE ssh_keys ADD COLUMN expires_at TEXT;

internal/store/revoke.go +8 −6

 import (
 	"slices"
 	"strings"
+	"time"
 )
 // Revoked names SSH keys that stopped being valid: by id, or every key
 	}
 }
-// LiveSSHKeys reports which of ids still name a registered key on an
+// LiveSSHKeys reports which of ids still name a registered, unexpired
-// account that is not disabled.
+// key on an account that is not disabled.
 func (s *Store) LiveSSHKeys(ids []int64) (map[int64]bool, error) {
 	live := map[int64]bool{}
 	if len(ids) == 0 {
 		return live, nil
 	}
-	args := make([]any, len(ids))
+	args := []any{fmtTime(time.Now())}
-	for i, id := range ids {
+	for _, id := range ids {
-		args[i] = id
+		args = append(args, id)
 	}
 	rows, err := s.DB.Query(`SELECT k.id FROM ssh_keys k JOIN users u ON u.id = k.user_id
-		WHERE u.disabled = 0 AND k.id IN (?`+strings.Repeat(", ?", len(ids)-1)+`)`, args...)
+		WHERE u.disabled = 0 AND (k.expires_at IS NULL OR k.expires_at > ?)
+		AND k.id IN (?`+strings.Repeat(", ?", len(ids)-1)+`)`, args...)
 	if err != nil {
 		return nil, err
 	}

internal/store/users.go +34 −13

 	"errors"
 	"fmt"
 	"strings"
+	"time"
 )
 type User struct {
 	Scope       string
 	Label       string // "" when the key was added with no name
 	CreatedAt   string
-	LastUsedAt  string // "" when the key has never authenticated
+	LastUsedAt  string     // "" when the key has never authenticated
-	CreatedBy   string // name of the API token that added the key; "" for none. ListSSHKeys only.
+	CreatedBy   string     // name of the API token that added the key; "" for none. ListSSHKeys only.
+	ExpiresAt   *time.Time // nil when the key never expires
+}
+// Expired reports whether the key has lapsed at now.
+func (k SSHKey) Expired(now time.Time) bool {
+	return k.ExpiresAt != nil && !k.ExpiresAt.After(now)
 }
 // ErrDuplicateKey carries the exact user-facing message from the spec. It
 // KeyOrigin is how a key came to be.
 type KeyOrigin struct {
-	CreatedByToken int64 // the API token that added it; 0 for none
+	CreatedByToken int64      // the API token that added it; 0 for none
+	ExpiresAt      *time.Time // when it stops authenticating; nil for never
 }
 // AddSSHKey registers a key and bumps the key epoch in one transaction.
 		return err
 	}
 	defer tx.Rollback()
+	var exp any
+	if o.ExpiresAt != nil {
+		exp = fmtTime(*o.ExpiresAt)
+	}
 	if _, err := tx.Exec(
-		"INSERT INTO ssh_keys (user_id, fingerprint, algo, blob, scope, label, created_by_token) VALUES (?, ?, ?, ?, ?, ?, ?)",
+		"INSERT INTO ssh_keys (user_id, fingerprint, algo, blob, scope, label, created_by_token, expires_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)",
-		userID, fingerprint, algo, blob, scope, label, nullID(o.CreatedByToken)); err != nil {
+		userID, fingerprint, algo, blob, scope, label, nullID(o.CreatedByToken), exp); err != nil {
 		if isUniqueErr(err) {
 			return ErrDuplicateKey
 		}
 func (s *Store) SSHKeyByFingerprint(fingerprint string) (SSHKey, error) {
 	var k SSHKey
+	var exp sql.NullString
 	err := s.DB.QueryRow(
-		"SELECT id, user_id, fingerprint, algo, blob, scope, label FROM ssh_keys WHERE fingerprint = ?",
+		"SELECT id, user_id, fingerprint, algo, blob, scope, label, expires_at FROM ssh_keys WHERE fingerprint = ?",
-		fingerprint).Scan(&k.ID, &k.UserID, &k.Fingerprint, &k.Algo, &k.Blob, &k.Scope, &k.Label)
+		fingerprint).Scan(&k.ID, &k.UserID, &k.Fingerprint, &k.Algo, &k.Blob, &k.Scope, &k.Label, &exp)
 	if errors.Is(err, sql.ErrNoRows) {
 		return k, ErrNotFound
 	}
+	k.ExpiresAt = parseTime(exp)
 	return k, err
 }
 func (s *Store) ListSSHKeys(userID int64) ([]SSHKey, error) {
 	rows, err := s.DB.Query(
 		`SELECT k.id, k.user_id, k.fingerprint, k.algo, k.blob, k.scope, k.label, k.created_at,
-		        COALESCE(k.last_used_at, ''), COALESCE(t.name, '')
+		        COALESCE(k.last_used_at, ''), COALESCE(t.name, ''), k.expires_at
 		 FROM ssh_keys k LEFT JOIN api_tokens t ON t.id = k.created_by_token
 		 WHERE k.user_id = ? ORDER BY k.id`,
 		userID)
 	var keys []SSHKey
 	for rows.Next() {
 		var k SSHKey
-		if err := rows.Scan(&k.ID, &k.UserID, &k.Fingerprint, &k.Algo, &k.Blob, &k.Scope, &k.Label, &k.CreatedAt, &k.LastUsedAt, &k.CreatedBy); err != nil {
+		var exp sql.NullString
+		if err := rows.Scan(&k.ID, &k.UserID, &k.Fingerprint, &k.Algo, &k.Blob, &k.Scope, &k.Label, &k.CreatedAt, &k.LastUsedAt, &k.CreatedBy, &exp); err != nil {
 			return nil, err
 		}
+		k.ExpiresAt = parseTime(exp)
 		keys = append(keys, k)
 	}
 	return keys, rows.Err()
 func (s *Store) SSHKeyByID(id int64) (SSHKey, error) {
 	var k SSHKey
+	var exp sql.NullString
 	err := s.DB.QueryRow(
-		"SELECT id, user_id, fingerprint, algo, blob, scope, label FROM ssh_keys WHERE id = ?",
+		"SELECT id, user_id, fingerprint, algo, blob, scope, label, expires_at FROM ssh_keys WHERE id = ?",
-		id).Scan(&k.ID, &k.UserID, &k.Fingerprint, &k.Algo, &k.Blob, &k.Scope, &k.Label)
+		id).Scan(&k.ID, &k.UserID, &k.Fingerprint, &k.Algo, &k.Blob, &k.Scope, &k.Label, &exp)
 	if errors.Is(err, sql.ErrNoRows) {
 		return k, ErrNotFound
 	}
+	k.ExpiresAt = parseTime(exp)
 	return k, err
 }
 // ListDeployKeys returns the deploy keys bound to a repository.
 func (s *Store) ListDeployKeys(repoID int64) ([]SSHKey, error) {
 	rows, err := s.DB.Query(
-		"SELECT id, user_id, fingerprint, algo, blob, scope, label FROM ssh_keys WHERE scope LIKE 'deploy:' || ? || ':%' ORDER BY id",
+		`SELECT id, user_id, fingerprint, algo, blob, scope, label, COALESCE(last_used_at, ''), expires_at
+		 FROM ssh_keys WHERE scope LIKE 'deploy:' || ? || ':%' ORDER BY id`,
 		repoID)
 	if err != nil {
 		return nil, err
 	var keys []SSHKey
 	for rows.Next() {
 		var k SSHKey
-		if err := rows.Scan(&k.ID, &k.UserID, &k.Fingerprint, &k.Algo, &k.Blob, &k.Scope, &k.Label); err != nil {
+		var exp sql.NullString
+		if err := rows.Scan(&k.ID, &k.UserID, &k.Fingerprint, &k.Algo, &k.Blob, &k.Scope, &k.Label, &k.LastUsedAt, &exp); err != nil {
 			return nil, err
 		}
+		k.ExpiresAt = parseTime(exp)
 		keys = append(keys, k)
 	}
 	return keys, rows.Err()

Commit cab50f5004

Commit `cab50f5004`