@flui-cloud/cli 0.0.1

package/lib/src/modules/access/controllers/ca.controller.js

@@ -0,0 +1,242 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CAController = void 0;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const admin_guard_1 = require("../../auth/guards/admin.guard");
+const admin_decorator_1 = require("../../auth/decorators/admin.decorator");
+const ca_manager_service_1 = require("../services/ca-manager.service");
+const certificate_signer_service_1 = require("../services/certificate-signer.service");
+const ca_public_key_dto_1 = require("../dto/ca-public-key.dto");
+const register_ca_dto_1 = require("../dto/register-ca.dto");
+let CAController = class CAController {
+    constructor(caManager, certificateSigner) {
+        this.caManager = caManager;
+        this.certificateSigner = certificateSigner;
+    }
+    async initializeCA() {
+        const ca = await this.caManager.initializeCA();
+        return {
+            publicKey: ca.publicKey,
+            fingerprint: ca.fingerprint,
+            type: ca.type,
+            createdAt: ca.createdAt,
+            expiresAt: ca.expiresAt,
+        };
+    }
+    async registerCA(dto) {
+        const ca = await this.caManager.registerExternalCA(dto.publicKey, {
+            name: dto.name,
+            replace: dto.replace,
+            metadata: dto.metadata,
+        });
+        return {
+            id: ca.id,
+            name: ca.name,
+            publicKey: ca.publicKey,
+            fingerprint: ca.fingerprint,
+            type: ca.type,
+            createdAt: ca.createdAt,
+            expiresAt: ca.expiresAt,
+            message: dto.replace
+                ? 'CA replaced successfully'
+                : 'CA registered successfully',
+        };
+    }
+    async getCAInfo() {
+        const ca = await this.caManager.getCAInfo();
+        return {
+            publicKey: ca.publicKey,
+            fingerprint: ca.fingerprint,
+            type: ca.type,
+            createdAt: ca.createdAt,
+            expiresAt: ca.expiresAt,
+        };
+    }
+    async getEnrollmentScript() {
+        const script = await this.caManager.getEnrollmentScript();
+        return { script };
+    }
+    async generateTestCertificate(ttl = 180) {
+        const ttlSeconds = ttl;
+        const cert = await this.certificateSigner.generateEphemeralCertificate('test', ttlSeconds);
+        const expiresAt = new Date(Date.now() + ttlSeconds * 1000);
+        return {
+            privateKey: cert.privateKey,
+            certificate: cert.certificate,
+            expiresAt: expiresAt.toISOString(),
+            principals: ['root', 'ubuntu', 'admin'],
+            instructions: `
+# How to use this certificate for SSH testing on Windows:
+
+# 1. Save the private key and certificate to files:
+echo "${cert.privateKey.replaceAll('n', '\n')}" > ephemeral_key
+echo "${cert.certificate.replaceAll('n', '\n')}" > ephemeral_key-cert.pub
+
+# 2. Set correct permissions (Git Bash):
+chmod 600 ephemeral_key
+chmod 644 ephemeral_key-cert.pub
+
+# 3. Connect to your server:
+ssh -i ephemeral_key root@YOUR_SERVER_IP
+
+# Certificate expires at: ${expiresAt.toISOString()}
+# Valid for principals: root, ubuntu, admin
+# TTL: ${ttlSeconds} seconds (${Math.floor(ttlSeconds / 60)} minutes)
+
+# Note: The certificate file MUST be named <keyfile>-cert.pub
+# SSH automatically looks for the certificate file when you specify the key.
+      `.trim(),
+        };
+    }
+};
+exports.CAController = CAController;
+__decorate([
+    (0, common_1.Post)('initialize'),
+    (0, common_1.UseGuards)(admin_guard_1.AdminGuard),
+    (0, admin_decorator_1.Admin)(),
+    (0, common_1.HttpCode)(common_1.HttpStatus.CREATED),
+    (0, swagger_1.ApiOperation)({ summary: 'Initialize CA keypair (admin only)' }),
+    (0, swagger_1.ApiResponse)({
+        status: 201,
+        description: 'CA initialized successfully',
+        type: ca_public_key_dto_1.CAPublicKeyDto,
+    }),
+    (0, swagger_1.ApiResponse)({
+        status: 409,
+        description: 'CA already exists',
+    }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], CAController.prototype, "initializeCA", null);
+__decorate([
+    (0, common_1.Post)('register'),
+    (0, common_1.HttpCode)(common_1.HttpStatus.CREATED),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Register external CA public key from CLI',
+        description: 'Registers an external CA public key (generated by CLI). Only stores the public key, no private key is transmitted or stored.',
+    }),
+    (0, swagger_1.ApiResponse)({
+        status: 201,
+        description: 'CA registered successfully',
+        type: register_ca_dto_1.RegisterCAResponseDto,
+    }),
+    (0, swagger_1.ApiResponse)({
+        status: 400,
+        description: 'Invalid public key format',
+    }),
+    (0, swagger_1.ApiResponse)({
+        status: 409,
+        description: 'CA already exists',
+    }),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [register_ca_dto_1.RegisterCADto]),
+    __metadata("design:returntype", Promise)
+], CAController.prototype, "registerCA", null);
+__decorate([
+    (0, common_1.Get)('info'),
+    (0, swagger_1.ApiOperation)({ summary: 'Get CA info (without private key)' }),
+    (0, swagger_1.ApiResponse)({
+        status: 200,
+        description: 'CA info retrieved',
+        type: ca_public_key_dto_1.CAPublicKeyDto,
+    }),
+    (0, swagger_1.ApiResponse)({
+        status: 404,
+        description: 'No active CA found',
+    }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], CAController.prototype, "getCAInfo", null);
+__decorate([
+    (0, common_1.Get)('enrollment-script'),
+    (0, swagger_1.ApiOperation)({ summary: 'Get server enrollment script' }),
+    (0, swagger_1.ApiResponse)({
+        status: 200,
+        description: 'Enrollment script generated successfully',
+        schema: {
+            type: 'object',
+            properties: {
+                script: {
+                    type: 'string',
+                    description: 'Bash script for server enrollment',
+                },
+            },
+        },
+    }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], CAController.prototype, "getEnrollmentScript", null);
+__decorate([
+    (0, common_1.Post)('test-certificate'),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Generate ephemeral certificate for testing (DEV ONLY)',
+        description: 'Generates an ephemeral certificate for manual SSH testing. Returns private key and certificate that can be used with ssh command line.',
+    }),
+    (0, swagger_1.ApiQuery)({
+        name: 'ttl',
+        required: false,
+        type: Number,
+        description: 'Certificate TTL in seconds (default: 180)',
+        example: 180,
+    }),
+    (0, swagger_1.ApiResponse)({
+        status: 200,
+        description: 'Certificate generated successfully',
+        schema: {
+            type: 'object',
+            properties: {
+                privateKey: {
+                    type: 'string',
+                    description: 'ED25519 private key (PEM format)',
+                },
+                certificate: {
+                    type: 'string',
+                    description: 'SSH certificate signed by CA',
+                },
+                expiresAt: {
+                    type: 'string',
+                    format: 'date-time',
+                    description: 'Certificate expiration time',
+                },
+                principals: {
+                    type: 'array',
+                    items: { type: 'string' },
+                    description: 'Valid principals (usernames)',
+                },
+                instructions: {
+                    type: 'string',
+                    description: 'Command line usage instructions',
+                },
+            },
+        },
+    }),
+    __param(0, (0, common_1.Query)('ttl')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], CAController.prototype, "generateTestCertificate", null);
+exports.CAController = CAController = __decorate([
+    (0, swagger_1.ApiTags)('CA Management'),
+    (0, swagger_1.ApiBearerAuth)(),
+    (0, common_1.Controller)('access/ca'),
+    __metadata("design:paramtypes", [ca_manager_service_1.CAManagerService,
+        certificate_signer_service_1.CertificateSignerService])
+], CAController);

package/lib/src/modules/access/dto/api-token.dto.d.ts

@@ -0,0 +1,11 @@
+import { CredentialType } from '../../management/entities/credentials.entity';
+export declare class ApiTokenDto {
+    id: string;
+    provider: string;
+    credential_type: CredentialType;
+    label: string;
+    notes?: string;
+    expires_at?: Date | null;
+    created_at: Date;
+    last_used_at?: Date | null;
+}

package/lib/src/modules/access/dto/api-token.dto.js

@@ -0,0 +1,74 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApiTokenDto = void 0;
+const swagger_1 = require("@nestjs/swagger");
+const credentials_entity_1 = require("../../management/entities/credentials.entity");
+class ApiTokenDto {
+}
+exports.ApiTokenDto = ApiTokenDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Unique token ID',
+        example: '6f103ec7-8b23-4c97-b0e8-9d9e5dba8382',
+    }),
+    __metadata("design:type", String)
+], ApiTokenDto.prototype, "id", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Cloud provider',
+        example: 'hetzner',
+    }),
+    __metadata("design:type", String)
+], ApiTokenDto.prototype, "provider", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Credential type',
+        enum: credentials_entity_1.CredentialType,
+        example: credentials_entity_1.CredentialType.API_KEY,
+    }),
+    __metadata("design:type", String)
+], ApiTokenDto.prototype, "credential_type", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Label for this credential',
+        example: 'Production Hetzner Account',
+    }),
+    __metadata("design:type", String)
+], ApiTokenDto.prototype, "label", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        description: 'Notes about this credential',
+        example: 'Used for infrastructure in EU region',
+    }),
+    __metadata("design:type", String)
+], ApiTokenDto.prototype, "notes", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        description: 'Expiry date of the key, if set by the user at registration time',
+        example: '2027-03-14T00:00:00.000Z',
+    }),
+    __metadata("design:type", Date)
+], ApiTokenDto.prototype, "expires_at", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Creation date',
+        example: '2023-03-10T14:30:00Z',
+    }),
+    __metadata("design:type", Date)
+], ApiTokenDto.prototype, "created_at", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        description: 'Last time the credential was used',
+        example: '2023-03-15T09:45:22Z',
+    }),
+    __metadata("design:type", Date)
+], ApiTokenDto.prototype, "last_used_at", void 0);

package/lib/src/modules/access/dto/bearer-token.dto.d.ts

@@ -0,0 +1,7 @@
+export declare class BearerTokenDto {
+    access_token: string;
+    token_type: string;
+    expires_in?: number;
+    refresh_token?: string;
+    scope?: string;
+}

package/lib/src/modules/access/dto/bearer-token.dto.js

@@ -0,0 +1,36 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BearerTokenDto = void 0;
+const swagger_1 = require("@nestjs/swagger");
+class BearerTokenDto {
+}
+exports.BearerTokenDto = BearerTokenDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({ description: 'Access token for API authentication' }),
+    __metadata("design:type", String)
+], BearerTokenDto.prototype, "access_token", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ description: 'Type of token (usually Bearer)' }),
+    __metadata("design:type", String)
+], BearerTokenDto.prototype, "token_type", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ description: 'Token expiration in seconds', required: false }),
+    __metadata("design:type", Number)
+], BearerTokenDto.prototype, "expires_in", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ description: 'Refresh token (if available)', required: false }),
+    __metadata("design:type", String)
+], BearerTokenDto.prototype, "refresh_token", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ description: 'Scope of the token', required: false }),
+    __metadata("design:type", String)
+], BearerTokenDto.prototype, "scope", void 0);

package/lib/src/modules/access/dto/ca-public-key.dto.d.ts

@@ -0,0 +1,7 @@
+export declare class CAPublicKeyDto {
+    publicKey: string;
+    fingerprint: string;
+    type: string;
+    createdAt: Date;
+    expiresAt?: Date;
+}

package/lib/src/modules/access/dto/ca-public-key.dto.js

@@ -0,0 +1,52 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CAPublicKeyDto = void 0;
+const swagger_1 = require("@nestjs/swagger");
+class CAPublicKeyDto {
+}
+exports.CAPublicKeyDto = CAPublicKeyDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        example: 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC...',
+        description: 'CA public key in OpenSSH format',
+    }),
+    __metadata("design:type", String)
+], CAPublicKeyDto.prototype, "publicKey", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        example: 'SHA256:abc123def456...',
+        description: 'SHA256 fingerprint of the CA public key',
+    }),
+    __metadata("design:type", String)
+], CAPublicKeyDto.prototype, "fingerprint", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        example: 'ed25519',
+        description: 'Key type',
+    }),
+    __metadata("design:type", String)
+], CAPublicKeyDto.prototype, "type", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        example: '2025-01-20T10:00:00Z',
+        description: 'CA creation timestamp',
+    }),
+    __metadata("design:type", Date)
+], CAPublicKeyDto.prototype, "createdAt", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        example: '2025-04-20T10:00:00Z',
+        description: 'CA expiration timestamp',
+        required: false,
+    }),
+    __metadata("design:type", Date)
+], CAPublicKeyDto.prototype, "expiresAt", void 0);

package/lib/src/modules/access/dto/create-api-token.dto.d.ts

@@ -0,0 +1,7 @@
+export declare class CreateApiTokenDto {
+    provider: string;
+    token: string;
+    label: string;
+    notes?: string;
+    expiresAt?: Date;
+}

package/lib/src/modules/access/dto/create-api-token.dto.js

@@ -0,0 +1,64 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CreateApiTokenDto = void 0;
+const swagger_1 = require("@nestjs/swagger");
+const class_validator_1 = require("class-validator");
+const class_transformer_1 = require("class-transformer");
+class CreateApiTokenDto {
+}
+exports.CreateApiTokenDto = CreateApiTokenDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'API provider name',
+        example: 'Hetzner',
+    }),
+    (0, class_validator_1.IsNotEmpty)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], CreateApiTokenDto.prototype, "provider", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'API token from the provider',
+        example: 'hcloud_1a2b3c4d5e6f7g8h9i0j',
+    }),
+    (0, class_validator_1.IsNotEmpty)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], CreateApiTokenDto.prototype, "token", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Label for this API token',
+        example: 'Production Hetzner Account',
+    }),
+    (0, class_validator_1.IsNotEmpty)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], CreateApiTokenDto.prototype, "label", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        description: 'Notes about this API token',
+        example: 'Used for infrastructure in EU region',
+    }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], CreateApiTokenDto.prototype, "notes", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        description: 'Optional expiry date of the key, if set by the user',
+        example: '2027-03-14T00:00:00.000Z',
+    }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsDate)(),
+    (0, class_transformer_1.Type)(() => Date),
+    __metadata("design:type", Date)
+], CreateApiTokenDto.prototype, "expiresAt", void 0);

package/lib/src/modules/access/dto/create-bearer-token.dto.d.ts

@@ -0,0 +1,9 @@
+import { CloudProvider } from '../../providers/enums/cloud-provider.enum';
+export declare class CreateBearerTokenDto {
+    provider: CloudProvider;
+    client_id: string;
+    client_secret: string;
+    username: string;
+    password: string;
+    save_credentials: boolean;
+}

package/lib/src/modules/access/dto/create-bearer-token.dto.js

@@ -0,0 +1,58 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CreateBearerTokenDto = void 0;
+const class_validator_1 = require("class-validator");
+const swagger_1 = require("@nestjs/swagger");
+const cloud_provider_enum_1 = require("../../providers/enums/cloud-provider.enum");
+class CreateBearerTokenDto {
+}
+exports.CreateBearerTokenDto = CreateBearerTokenDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Provider type',
+        enum: cloud_provider_enum_1.CloudProvider,
+        example: cloud_provider_enum_1.CloudProvider.CONTABO,
+    }),
+    (0, class_validator_1.IsNotEmpty)(),
+    (0, class_validator_1.IsEnum)(cloud_provider_enum_1.CloudProvider),
+    __metadata("design:type", String)
+], CreateBearerTokenDto.prototype, "provider", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ description: 'Client ID for provider authentication' }),
+    (0, class_validator_1.IsNotEmpty)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], CreateBearerTokenDto.prototype, "client_id", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ description: 'Client secret for provider authentication' }),
+    (0, class_validator_1.IsNotEmpty)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], CreateBearerTokenDto.prototype, "client_secret", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ description: 'Username for provider authentication' }),
+    (0, class_validator_1.IsNotEmpty)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], CreateBearerTokenDto.prototype, "username", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ description: 'Password for provider authentication' }),
+    (0, class_validator_1.IsNotEmpty)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], CreateBearerTokenDto.prototype, "password", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ description: 'Save credentials and auto refresh token' }),
+    (0, class_validator_1.IsNotEmpty)(),
+    (0, class_validator_1.IsBoolean)(),
+    __metadata("design:type", Boolean)
+], CreateBearerTokenDto.prototype, "save_credentials", void 0);

package/lib/src/modules/access/dto/create-ssh-key.dto.d.ts

@@ -0,0 +1,7 @@
+import { CloudProvider } from '../../providers/enums/cloud-provider.enum';
+export declare class CreateSSHKeyDto {
+    name: string;
+    userName: string;
+    tags?: Record<string, string | string[]>;
+    providers?: CloudProvider[];
+}

package/lib/src/modules/access/dto/create-ssh-key.dto.js

@@ -0,0 +1,61 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CreateSSHKeyDto = void 0;
+const swagger_1 = require("@nestjs/swagger");
+const class_validator_1 = require("class-validator");
+const cloud_provider_enum_1 = require("../../providers/enums/cloud-provider.enum");
+class CreateSSHKeyDto {
+}
+exports.CreateSSHKeyDto = CreateSSHKeyDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Name of the SSH key',
+        example: 'my-deployment-key',
+    }),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], CreateSSHKeyDto.prototype, "name", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'User name for the SSH key',
+        example: 'john.doe',
+    }),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], CreateSSHKeyDto.prototype, "userName", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        description: 'Key-value pairs for tagging. Values can be strings or arrays',
+        example: {
+            'cluster-id': ['k3s-prod-eu-001', 'k3s-prod-eu-002'],
+            'cluster-node-id': 'node-master-01',
+            environment: 'production',
+        },
+    }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsObject)(),
+    __metadata("design:type", Object)
+], CreateSSHKeyDto.prototype, "tags", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        description: 'Cloud providers to sync the SSH key to. Defaults to all configured providers.',
+        enum: cloud_provider_enum_1.CloudProvider,
+        isArray: true,
+        example: [cloud_provider_enum_1.CloudProvider.SCALEWAY],
+    }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsArray)(),
+    (0, class_validator_1.IsEnum)(cloud_provider_enum_1.CloudProvider, { each: true }),
+    __metadata("design:type", Array)
+], CreateSSHKeyDto.prototype, "providers", void 0);

package/lib/src/modules/access/dto/refresh-token.dto.d.ts

@@ -0,0 +1,7 @@
+import { CloudProvider } from '../../providers/enums/cloud-provider.enum';
+export declare class ProviderRefreshTokenDto {
+    provider: CloudProvider;
+    refresh_token: string;
+    client_id: string;
+    client_secret: string;
+}