network-infra-utility 0.2.0 → 0.5.0

data/service/ssh/ext/ssh_core/local_deps/jsx/src/src/jsx_to_term.erl

@@ -0,0 +1,389 @@
+%% The MIT License
+
+%% Copyright (c) 2010-2013 Alisdair Sullivan <alisdairsullivan@yahoo.ca>
+
+%% Permission is hereby granted, free of charge, to any person obtaining a copy
+%% of this software and associated documentation files (the "Software"), to deal
+%% in the Software without restriction, including without limitation the rights
+%% to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+%% copies of the Software, and to permit persons to whom the Software is
+%% furnished to do so, subject to the following conditions:
+
+%% The above copyright notice and this permission notice shall be included in
+%% all copies or substantial portions of the Software.
+
+%% THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+%% IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+%% FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+%% AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+%% LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+%% OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+%% THE SOFTWARE.
+
+
+-module(jsx_to_term).
+
+-export([to_term/2]).
+-export([init/1, handle_event/2]).
+-export([
+    start_term/1,
+    start_object/1,
+    start_array/1,
+    finish/1,
+    insert/2,
+    get_key/1,
+    get_value/1
+]).
+
+
+-record(config, {
+    labels = binary,
+    return_maps = false
+}).
+
+-type config() :: proplists:proplist().
+
+-spec to_term(Source::binary(), Config::jsx_config:options()) -> jsx:json_term() | {incomplete, jsx:decoder()}.
+
+to_term(Source, Config) when is_list(Config) ->
+    (jsx:decoder(?MODULE, [return_maps] ++ Config, jsx_config:extract_config(Config)))(Source).
+
+parse_config(Config) -> parse_config(Config, #config{}).
+
+parse_config([{labels, Val}|Rest], Config)
+        when Val == binary; Val == atom; Val == existing_atom; Val == attempt_atom ->
+    parse_config(Rest, Config#config{labels = Val});
+parse_config([labels|Rest], Config) ->
+    parse_config(Rest, Config#config{labels = binary});
+parse_config([{return_maps, Val}|Rest], Config)
+        when Val == true; Val == false ->
+    parse_config(Rest, Config#config{return_maps = Val});
+parse_config([return_maps|Rest], Config) ->
+    parse_config(Rest, Config#config{return_maps = true});
+parse_config([{K, _}|Rest] = Options, Config) ->
+    case lists:member(K, jsx_config:valid_flags()) of
+        true -> parse_config(Rest, Config)
+        ; false -> erlang:error(badarg, [Options, Config])
+    end;
+parse_config([K|Rest] = Options, Config) ->
+    case lists:member(K, jsx_config:valid_flags()) of
+        true -> parse_config(Rest, Config)
+        ; false -> erlang:error(badarg, [Options, Config])
+    end;
+parse_config([], Config) ->
+    Config.
+
+
+-type state() :: {list(), #config{}}.
+-spec init(Config::config()) -> state().
+
+init(Config) -> start_term(Config).
+
+-spec handle_event(Event::any(), State::state()) -> state().
+
+handle_event(end_json, State) -> get_value(State);
+
+handle_event(start_object, State) -> start_object(State);
+handle_event(end_object, State) -> finish(State);
+
+handle_event(start_array, State) -> start_array(State);
+handle_event(end_array, State) -> finish(State);
+
+handle_event({key, Key}, {_, Config} = State) -> insert(format_key(Key, Config), State);
+
+handle_event({_, Event}, State) -> insert(Event, State).
+
+
+format_key(Key, Config) ->
+    case Config#config.labels of
+        binary -> Key
+        ; atom -> binary_to_atom(Key, utf8)
+        ; existing_atom -> binary_to_existing_atom(Key, utf8)
+        ; attempt_atom ->
+            try binary_to_existing_atom(Key, utf8) of
+                Result -> Result
+            catch
+                error:badarg -> Key
+            end
+    end.
+
+
+%% internal state is a stack and a config object
+%%  `{Stack, Config}`
+%% the stack is a list of in progress objects/arrays
+%%  `[Current, Parent, Grandparent,...OriginalAncestor]`
+%% an object has the representation on the stack of
+%%  `{object, [
+%%    {NthKey, NthValue},
+%%    {NMinus1Key, NthMinus1Value},
+%%    ...,
+%%    {FirstKey, FirstValue}
+%%  ]}`
+%% or if returning maps
+%%  `{object, #{
+%%    FirstKey => FirstValue,
+%%    SecondKey => SecondValue,
+%%    ...,
+%%    NthKey => NthValue
+%%  }}`
+%% or if there's a key with a yet to be matched value
+%%  `{object, Key, ...}`
+%% an array looks like
+%%  `{array, [NthValue, NthMinus1Value,...FirstValue]}`
+
+start_term(Config) when is_list(Config) -> {[], parse_config(Config)}.
+
+%% allocate a new object on top of the stack
+start_object({Stack, Config=#config{return_maps=true}}) ->
+    {[{object, #{}}] ++ Stack, Config};
+start_object({Stack, Config}) ->
+    {[{object, []}] ++ Stack, Config}.
+
+
+%% allocate a new array on top of the stack
+start_array({Stack, Config}) -> {[{array, []}] ++ Stack, Config}.
+
+
+%% finish an object or array and insert it into the parent object if it exists or
+%% return it if it is the root object
+finish({[{object, Map}], Config=#config{return_maps=true}}) -> {Map, Config};
+finish({[{object, Map}|Rest], Config=#config{return_maps=true}}) -> insert(Map, {Rest, Config});
+finish({[{object, []}], Config}) -> {[{}], Config};
+finish({[{object, []}|Rest], Config}) -> insert([{}], {Rest, Config});
+finish({[{object, Pairs}], Config}) -> {lists:reverse(Pairs), Config};
+finish({[{object, Pairs}|Rest], Config}) -> insert(lists:reverse(Pairs), {Rest, Config});
+finish({[{array, Values}], Config}) -> {lists:reverse(Values), Config};
+finish({[{array, Values}|Rest], Config}) -> insert(lists:reverse(Values), {Rest, Config});
+finish(_) -> erlang:error(badarg).
+
+
+%% insert a value when there's no parent object or array
+insert(Value, {[], Config}) -> {Value, Config};
+%% insert a key or value into an object or array, autodetects the 'right' thing
+insert(Key, {[{object, Map}|Rest], Config=#config{return_maps=true}}) ->
+    {[{object, Key, Map}] ++ Rest, Config};
+insert(Key, {[{object, Pairs}|Rest], Config}) ->
+    {[{object, Key, Pairs}] ++ Rest, Config};
+insert(Value, {[{object, Key, Map}|Rest], Config=#config{return_maps=true}}) ->
+    {[{object, maps:put(Key, Value, Map)}] ++ Rest, Config};
+insert(Value, {[{object, Key, Pairs}|Rest], Config}) ->
+    {[{object, [{Key, Value}] ++ Pairs}] ++ Rest, Config};
+insert(Value, {[{array, Values}|Rest], Config}) ->
+    {[{array, [Value] ++ Values}] ++ Rest, Config};
+insert(_, _) -> erlang:error(badarg).
+
+get_key({[{object, Key, _}|_], _}) -> Key;
+get_key(_) -> erlang:error(badarg).
+
+
+get_value({Value, _Config}) -> Value;
+get_value(_) -> erlang:error(badarg).
+
+
+
+%% eunit tests
+
+-ifdef(TEST).
+-include_lib("eunit/include/eunit.hrl").
+
+
+config_test_() ->
+    [
+        {"empty config", ?_assertEqual(#config{}, parse_config([]))},
+        {"implicit binary labels", ?_assertEqual(#config{}, parse_config([labels]))},
+        {"binary labels", ?_assertEqual(#config{}, parse_config([{labels, binary}]))},
+        {"atom labels", ?_assertEqual(#config{labels=atom}, parse_config([{labels, atom}]))},
+        {"existing atom labels", ?_assertEqual(
+            #config{labels=existing_atom},
+            parse_config([{labels, existing_atom}])
+        )},
+        {"return_maps true", ?_assertEqual(
+            #config{return_maps=true},
+            parse_config([return_maps])
+        )},
+        {"invalid opt flag", ?_assertError(badarg, parse_config([error]))},
+        {"invalid opt tuple", ?_assertError(badarg, parse_config([{error, true}]))}
+    ].
+
+
+format_key_test_() ->
+    [
+        {"binary key", ?_assertEqual(<<"key">>, format_key(<<"key">>, #config{labels=binary}))},
+        {"atom key", ?_assertEqual(key, format_key(<<"key">>, #config{labels=atom}))},
+        {"existing atom key", ?_assertEqual(
+            key,
+            format_key(<<"key">>, #config{labels=existing_atom})
+        )},
+        {"nonexisting atom key", ?_assertError(
+            badarg,
+            format_key(<<"nonexistentatom">>, #config{labels=existing_atom})
+        )},
+        {"sloppy existing atom key", ?_assertEqual(
+            key,
+            format_key(<<"key">>, #config{labels=attempt_atom})
+        )},
+        {"nonexisting atom key", ?_assertEqual(
+            <<"nonexistentatom">>,
+            format_key(<<"nonexistentatom">>, #config{labels=attempt_atom})
+        )}
+    ].
+
+
+rep_manipulation_test_() ->
+    [
+        {"allocate a new context with option", ?_assertEqual(
+            {[], #config{labels=atom}},
+            start_term([{labels, atom}])
+        )},
+        {"allocate a new object on an empty stack", ?_assertEqual(
+            {[{object, []}], #config{}},
+            start_object({[], #config{}})
+        )},
+        {"allocate a new object on a stack", ?_assertEqual(
+            {[{object, []}, {object, []}], #config{}},
+            start_object({[{object, []}], #config{}})
+        )},
+        {"allocate a new array on an empty stack", ?_assertEqual(
+            {[{array, []}], #config{}},
+            start_array({[], #config{}})
+        )},
+        {"allocate a new array on a stack", ?_assertEqual(
+            {[{array, []}, {object, []}], #config{}},
+            start_array({[{object, []}], #config{}})
+        )},
+        {"insert a key into an object", ?_assertEqual(
+            {[{object, key, []}, junk], #config{}},
+            insert(key, {[{object, []}, junk], #config{}})
+        )},
+        {"get current key", ?_assertEqual(
+            key,
+            get_key({[{object, key, []}], #config{}})
+        )},
+        {"try to get non-key from object", ?_assertError(
+            badarg,
+            get_key({[{object, []}], #config{}})
+        )},
+        {"try to get key from array", ?_assertError(
+            badarg,
+            get_key({[{array, []}], #config{}})
+        )},
+        {"insert a value into an object", ?_assertEqual(
+            {[{object, [{key, value}]}, junk], #config{}},
+            insert(value, {[{object, key, []}, junk], #config{}})
+        )},
+        {"insert a value into an array", ?_assertEqual(
+            {[{array, [value]}, junk], #config{}},
+            insert(value, {[{array, []}, junk], #config{}})
+        )},
+        {"finish an object with no ancestor", ?_assertEqual(
+            {[{a, b}, {x, y}], #config{}},
+            finish({[{object, [{x, y}, {a, b}]}], #config{}})
+        )},
+        {"finish an empty object", ?_assertEqual(
+            {[{}], #config{}},
+            finish({[{object, []}], #config{}})
+        )},
+        {"finish an object with an ancestor", ?_assertEqual(
+            {[{object, [{key, [{a, b}, {x, y}]}, {foo, bar}]}], #config{}},
+            finish({[{object, [{x, y}, {a, b}]}, {object, key, [{foo, bar}]}], #config{}})
+        )},
+        {"finish an array with no ancestor", ?_assertEqual(
+            {[a, b, c], #config{}},
+            finish({[{array, [c, b, a]}], #config{}})
+        )},
+        {"finish an array with an ancestor", ?_assertEqual(
+            {[{array, [[a, b, c], d, e, f]}], #config{}},
+            finish({[{array, [c, b, a]}, {array, [d, e, f]}], #config{}})
+        )}
+    ].
+
+
+rep_manipulation_with_maps_test_() ->
+    [
+        {"allocate a new object on an empty stack", ?_assertEqual(
+            {[{object, #{}}], #config{return_maps=true}},
+            start_object({[], #config{return_maps=true}})
+        )},
+        {"allocate a new object on a stack", ?_assertEqual(
+            {[{object, #{}}, {object, #{}}], #config{return_maps=true}},
+            start_object({[{object, #{}}], #config{return_maps=true}})
+        )},
+        {"insert a key into an object", ?_assertEqual(
+            {[{object, key, #{}}, junk], #config{return_maps=true}},
+            insert(key, {[{object, #{}}, junk], #config{return_maps=true}})
+        )},
+        {"get current key", ?_assertEqual(
+            key,
+            get_key({[{object, key, #{}}], #config{return_maps=true}})
+        )},
+        {"try to get non-key from object", ?_assertError(
+            badarg,
+            get_key({[{object, #{}}], #config{return_maps=true}})
+        )},
+        {"insert a value into an object", ?_assertEqual(
+            {[{object, #{key => value}}, junk], #config{return_maps=true}},
+            insert(value, {[{object, key, #{}}, junk], #config{return_maps=true}})
+        )},
+        {"finish an object with no ancestor", ?_assertEqual(
+            {#{a => b, x => y}, #config{return_maps=true}},
+            finish({[{object, #{x => y, a => b}}], #config{return_maps=true}})
+        )},
+        {"finish an empty object", ?_assertEqual(
+            {#{}, #config{return_maps=true}},
+            finish({[{object, #{}}], #config{return_maps=true}})
+        )},
+        {"finish an object with an ancestor", ?_assertEqual(
+            {
+                [{object, #{key => #{a => b, x => y}, foo => bar}}],
+                #config{return_maps=true}
+            },
+            finish({
+                [{object, #{x => y, a => b}}, {object, key, #{foo => bar}}],
+                #config{return_maps=true}
+            })
+        )}
+    ].
+
+
+return_maps_test_() ->
+    [
+        {"an empty map", ?_assertEqual(
+            #{},
+            jsx:decode(<<"{}">>, [])
+        )},
+        {"an empty map", ?_assertEqual(
+            #{},
+            jsx:decode(<<"{}">>, [])
+        )},
+        {"an empty map", ?_assertEqual(
+            [{}],
+            jsx:decode(<<"{}">>, [{return_maps, false}])
+        )},
+        {"a small map", ?_assertEqual(
+            #{<<"awesome">> => true, <<"library">> => <<"jsx">>},
+            jsx:decode(<<"{\"library\": \"jsx\", \"awesome\": true}">>, [])
+        )},
+        {"a recursive map", ?_assertEqual(
+            #{<<"key">> => #{<<"key">> => true}},
+            jsx:decode(<<"{\"key\": {\"key\": true}}">>, [])
+        )},
+        {"a map inside a list", ?_assertEqual(
+            [#{}],
+            jsx:decode(<<"[{}]">>, [])
+        )}
+    ].
+
+
+handle_event_test_() ->
+    Data = jsx:test_cases(),
+    [
+        {
+            Title, ?_assertEqual(
+                Term,
+                lists:foldl(fun handle_event/2, init([]), Events ++ [end_json])
+            )
+        } || {Title, _, Term, Events} <- Data
+    ].
+
+
+-endif.

data/service/ssh/ext/ssh_core/local_deps/jsx/src/src/jsx_verify.erl

@@ -0,0 +1,121 @@
+%% The MIT License
+
+%% Copyright (c) 2010-2013 alisdair sullivan <alisdairsullivan@yahoo.ca>
+
+%% Permission is hereby granted, free of charge, to any person obtaining a copy
+%% of this software and associated documentation files (the "Software"), to deal
+%% in the Software without restriction, including without limitation the rights
+%% to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+%% copies of the Software, and to permit persons to whom the Software is
+%% furnished to do so, subject to the following conditions:
+
+%% The above copyright notice and this permission notice shall be included in
+%% all copies or substantial portions of the Software.
+
+%% THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+%% IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+%% FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+%% AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+%% LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+%% OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+%% THE SOFTWARE.
+
+
+-module(jsx_verify).
+
+-export([is_json/2, is_term/2]).
+-export([init/1, handle_event/2]).
+
+-type config() :: proplists:proplist().
+
+-spec is_json(Source::binary(), Config::jsx_config:options()) -> true | false | {incomplete, jsx:decoder()}.
+
+is_json(Source, Config) when is_list(Config) ->
+    try (jsx:decoder(?MODULE, Config, jsx_config:extract_config(Config)))(Source)
+    catch error:badarg -> false
+    end.
+
+
+-spec is_term(Source::jsx:json_term() | end_stream | end_json,
+              Config::jsx_config:options()) -> true | false | {incomplete, jsx:encoder()}.
+
+is_term(Source, Config) when is_list(Config) ->
+    try (jsx:encoder(?MODULE, Config, jsx_config:extract_config(Config)))(Source)
+    catch error:badarg -> false
+    end.
+
+
+parse_config(Config) -> parse_config(Config, []).
+
+%% ignore deprecated flags
+parse_config([no_repeated_keys|Rest], Config) ->
+    parse_config(Rest, Config);
+parse_config([{repeated_keys, Val}|Rest], Config) when Val == true; Val == false ->
+    parse_config(Rest, Config);
+parse_config([repeated_keys|Rest], Config) ->
+    parse_config(Rest, Config);
+parse_config([{K, _}|Rest] = Options, Config) ->
+    case lists:member(K, jsx_config:valid_flags()) of
+        true -> parse_config(Rest, Config);
+        false -> erlang:error(badarg, [Options, Config])
+    end;
+parse_config([K|Rest] = Options, Config) ->
+    case lists:member(K, jsx_config:valid_flags()) of
+        true -> parse_config(Rest, Config);
+        false -> erlang:error(badarg, [Options, Config])
+    end;
+parse_config([], Config) ->
+    Config.
+
+
+%% we don't actually need any state for this
+-type state() :: [].
+-spec init(Config::config()) -> state().
+
+init(Config) -> parse_config(Config).
+
+
+-spec handle_event(Event::any(), State::state()) -> state().
+
+handle_event(end_json, _) -> true;
+
+handle_event(_, State) -> State.
+
+
+
+%% eunit tests
+-ifdef(TEST).
+-include_lib("eunit/include/eunit.hrl").
+
+
+config_test_() ->
+    [
+        {"empty config", ?_assertEqual([], parse_config([]))},
+        {"no repeat keys", ?_assertEqual([], parse_config([no_repeated_keys]))},
+        {"bare repeated keys", ?_assertEqual([], parse_config([repeated_keys]))},
+        {"repeated keys true", ?_assertEqual(
+            [],
+            parse_config([{repeated_keys, true}])
+        )},
+        {"repeated keys false", ?_assertEqual(
+            [],
+            parse_config([{repeated_keys, false}])
+        )},
+        {"invalid opt flag", ?_assertError(badarg, parse_config([error]))},
+        {"invalid opt tuple", ?_assertError(badarg, parse_config([{error, true}]))}
+    ].
+
+
+handle_event_test_() ->
+    Data = jsx:test_cases() ++ jsx:special_test_cases(),
+    [
+        {
+            Title, ?_assertEqual(
+                true,
+                lists:foldl(fun handle_event/2, [], Events ++ [end_json])
+            )
+        } || {Title, _, _, Events} <- Data
+    ].
+
+
+-endif.

data/service/ssh/ext/ssh_core/rebar.config

@@ -0,0 +1,24 @@
+%% Erlang/OTP 26+ required (ssh, public_key, crypto, kernel, stdlib)
+{erl_opts, [
+    debug_info,
+    {src_dirs, ["src", "local_deps/jsx/src/src"]},
+    {platform_define, "win32", win32}
+]}.
+
+{deps, []}.
+
+{shell, [
+    {apps, [ssh_core]}
+]}.
+
+{relx, [
+    {release, {ssh_core, "1.0.0"}, [ssh_core, runtime_tools, sasl]},
+    {mode, dev},
+    {include_erts, true},
+    {include_src, false},
+    {overlay, [
+        {mkdir, "{{output_dir}}/logs"},
+        {copy, "config/vm.args", "{{output_dir}}/releases/1.0.0/vm.args"},
+        {copy, "config/sys.config", "{{output_dir}}/releases/1.0.0/sys.config"}
+    ]}
+]}.

data/service/ssh/ext/ssh_core/rebar.lock

@@ -0,0 +1 @@
+[].

data/service/ssh/ext/ssh_core/src/ssh_auth_engine.erl

@@ -0,0 +1,156 @@
+-module(ssh_auth_engine).
+-behaviour(ssh_client_key_api).
+
+%% Authentication engine — implements OTP ssh's key_cb behaviour.
+%%
+%% Key design (LLD §6.4, E1/E2/E7 fixes):
+%%   - OTP ssh has no ssh:auth_user/3 — auth is in ssh:connect options
+%%   - key_cb callbacks handle host key verification (via known_hosts_proxy)
+%%   - key_cb callbacks handle user private key loading
+%%   - known_hosts persistence is delegated to client via IPC
+%%   - Auth chain (multi-method fallback) creates multiple ssh:connect attempts
+%%
+%% OTP ssh 6.0.3 (OTP 29) key_cb calling convention:
+%%   call_KeyCb(F, Args, Opts) ->
+%%     apply(KeyCb, F, Args ++ [[{key_cb_private,KeyCbOpts}|UserOpts]])
+%%
+%%   is_host_key new style (4-arg + opts => 5-arg total):
+%%     is_host_key(Public, [PeerName, IP], Port, Alg, Opts)
+%%   is_host_key old style (3-arg + opts => 4-arg total):
+%%     is_host_key(Public, PeerName, Alg, Opts)
+%%   add_host_key new style (3-arg + opts => 4-arg total):
+%%     add_host_key([PeerName, IP], Port, Public, Opts)
+%%   add_host_key old style (2-arg + opts => 3-arg total):
+%%     add_host_key(PeerName, Public, Opts)
+
+-export([
+    %% ssh_client_key_api callbacks
+    add_host_key/4,
+    add_host_key/3,
+    is_host_key/5,
+    is_host_key/4,
+    user_key/2,
+    %% High-level auth
+    authenticate_chain/2
+]).
+
+-include("ssh_ipc.hrl").
+
+%% ---------- ssh_client_key_api: Host key callbacks (OTP 6.0 — new style) ----------
+
+%% @doc New style is_host_key (5-arg: Public, [PeerName, IP], Port, Alg, Opts).
+%% Called by OTP 6.x first; if undef, OTP falls back to 4-arg old style.
+-spec is_host_key(public_key:public_key(), [string()], inet:port_number(),
+                   atom(), term()) -> boolean().
+is_host_key(Key, [PeerName | _], Port, _Algorithm, _Opts) ->
+    case ssh_known_hosts_proxy:verify(PeerName, Port, Key) of
+        accepted -> true;
+        accepted_once -> true;
+        rejected -> false
+    end.
+
+%% @doc New style add_host_key (4-arg: [PeerName, IP], Port, Public, Opts).
+-spec add_host_key([string()], inet:port_number(), public_key:public_key(), term()) ->
+    ok | {error, term()}.
+add_host_key([PeerName | _], Port, PublicKey, _Opts) ->
+    case ssh_known_hosts_proxy:verify(PeerName, Port, PublicKey) of
+        accepted -> ok;
+        accepted_once -> ok;
+        rejected -> {error, host_key_rejected}
+    end.
+
+%% ---------- ssh_client_key_api: Host key callbacks (legacy old style) ----------
+
+%% @doc Old style is_host_key (4-arg: Public, PeerName, Alg, Opts).
+%% Called by older OTP when 5-arg version is undef.
+-spec is_host_key(public_key:public_key(), string(), atom(), term()) -> boolean().
+is_host_key(Key, PeerName, _Algorithm, _Opts) ->
+    case ssh_known_hosts_proxy:verify(PeerName, 22, Key) of
+        accepted -> true;
+        accepted_once -> true;
+        rejected -> false
+    end.
+
+%% @doc Old style add_host_key (3-arg: PeerName, Public, Opts).
+-spec add_host_key(string(), public_key:public_key(), term()) ->
+    ok | {error, term()}.
+add_host_key(PeerName, PublicKey, _Opts) ->
+    case ssh_known_hosts_proxy:verify(PeerName, 22, PublicKey) of
+        accepted -> ok;
+        accepted_once -> ok;
+        rejected -> {error, host_key_rejected}
+    end.
+
+%% ---------- ssh_client_key_api: User key callback ----------
+
+%% @doc Called by OTP ssh to retrieve the user's private key for publickey auth.
+-spec user_key(atom(), term()) -> {ok, term()} | {error, term()}.
+user_key(Algorithm, Opts) ->
+    %% Algorithm: 'ssh-rsa' | 'ssh-ed25519' | 'ecdsa-sha2-nistp256' ...
+    %% Opts is a proplist; auth info stored under 'key_cb_private'
+    KeyCbOpts = proplists:get_value(key_cb_private, Opts, []),
+    AuthMap = case KeyCbOpts of
+        M when is_map(M) -> M;
+        _ -> #{}
+    end,
+    KeyPath = maps:get(<<"key_path">>, AuthMap, undefined),
+    Passphrase = maps:get(<<"passphrase">>, AuthMap, undefined),
+    case KeyPath of
+        undefined -> {error, no_key_path};
+        _ -> read_private_key(binary_to_list(KeyPath), Algorithm, Passphrase)
+    end.
+
+%% ---------- Authentication chain ----------
+
+%% @doc Multi-method authentication fallback chain.
+%% OTP ssh integrates auth into ssh:connect, so each method requires a separate
+%% ssh:connect attempt. V1.0 supports: publickey -> password fallback.
+%%
+%% Returns {ok, SshRef} | {error, Reason}
+-spec authenticate_chain(map(), [atom()]) -> {ok, reference()} | {error, term()}.
+authenticate_chain(_ConnectCtx, []) ->
+    {error, all_auth_methods_failed};
+authenticate_chain(ConnectCtx, [Method | Rest]) ->
+    Opts = build_opts_for_method(ConnectCtx, Method),
+    Host = binary_to_list(maps:get(host, ConnectCtx)),
+    Port = maps:get(port, ConnectCtx, 22),
+    case ssh:connect(Host, Port, Opts, ?CONNECT_TIMEOUT_MS) of
+        {ok, Ref} -> {ok, Ref};
+        {error, _} -> authenticate_chain(ConnectCtx, Rest)
+    end.
+
+%% ---------- Internal ----------
+
+%% @doc Read a private key file (OpenSSH, PKCS8, SEC1).
+read_private_key(Path, _Algorithm, Passphrase) ->
+    PwdOpt = case Passphrase of
+        undefined -> [];
+        Pwd -> [{passphrase, binary_to_list(Pwd)}]
+    end,
+    case public_key:read_keyfile(Path, PwdOpt) of
+        {ok, [Key | _]} -> {ok, Key};
+        {ok, Key} -> {ok, Key};
+        {error, Reason} -> {error, Reason}
+    end.
+
+%% @doc Build ssh:connect options for a specific auth method.
+build_opts_for_method(ConnectCtx, publickey) ->
+    AuthMap = maps:get(auth, ConnectCtx, #{}),
+    [
+        {user, binary_to_list(maps:get(user, ConnectCtx))},
+        {key_cb, {?MODULE, AuthMap}}
+    ];
+build_opts_for_method(ConnectCtx, password) ->
+    AuthMap = maps:get(auth, ConnectCtx, #{}),
+    [
+        {user, binary_to_list(maps:get(user, ConnectCtx))},
+        {password, binary_to_list(maps:get(<<"password">>, AuthMap))}
+    ];
+build_opts_for_method(ConnectCtx, keyboard_interactive) ->
+    AuthMap = maps:get(auth, ConnectCtx, #{}),
+    [
+        {user, binary_to_list(maps:get(user, ConnectCtx))},
+        {keyboard_interactive, fun(_Prompts, _Ssh) ->
+            {ok, [binary_to_list(maps:get(<<"password">>, AuthMap))]}
+        end}
+    ].