@flui-cloud/cli 0.0.1

package/lib/src/modules/access/services/bearerToken.service.d.ts

@@ -0,0 +1,15 @@
+import { HttpService } from '@nestjs/axios';
+import { BearerTokenDto } from '../dto/bearer-token.dto';
+import { CreateBearerTokenDto } from '../dto/create-bearer-token.dto';
+import { CloudProvider } from '../../providers/enums/cloud-provider.enum';
+import { ProviderRefreshTokenDto } from '../dto/refresh-token.dto';
+export declare class BearerTokenService {
+    private readonly httpService;
+    constructor(httpService: HttpService);
+    generateToken(provider: CloudProvider, dto: CreateBearerTokenDto): Promise<BearerTokenDto>;
+    private generateContaboToken;
+    private generateHetznerToken;
+    refreshToken(provider: CloudProvider, dto: ProviderRefreshTokenDto): Promise<BearerTokenDto>;
+    private refreshContaboToken;
+    private refreshHetznerToken;
+}

package/lib/src/modules/access/services/bearerToken.service.js

@@ -0,0 +1,107 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BearerTokenService = void 0;
+const common_1 = require("@nestjs/common");
+const axios_1 = require("@nestjs/axios");
+const rxjs_1 = require("rxjs");
+const cloud_provider_enum_1 = require("../../providers/enums/cloud-provider.enum");
+let BearerTokenService = class BearerTokenService {
+    constructor(httpService) {
+        this.httpService = httpService;
+    }
+    async generateToken(provider, dto) {
+        try {
+            switch (provider) {
+                case cloud_provider_enum_1.CloudProvider.CONTABO:
+                    return this.generateContaboToken(dto);
+                case cloud_provider_enum_1.CloudProvider.HETZNER:
+                    return this.generateHetznerToken(dto);
+                default:
+                    throw new common_1.HttpException(`Provider ${provider} not supported`, common_1.HttpStatus.BAD_REQUEST);
+            }
+        }
+        catch (error) {
+            throw new common_1.HttpException(error.response?.data?.error || 'Authentication failed', error.response?.status || common_1.HttpStatus.UNAUTHORIZED);
+        }
+    }
+    async generateContaboToken(dto) {
+        const response = await (0, rxjs_1.lastValueFrom)(this.httpService.post('https://auth.contabo.com/auth/realms/contabo/protocol/openid-connect/token', new URLSearchParams({
+            grant_type: 'password',
+            client_id: dto.client_id,
+            username: dto.username,
+            password: dto.password,
+            client_secret: dto.client_secret,
+        }), {
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+            },
+        }));
+        return {
+            access_token: response.data.access_token,
+            token_type: 'Bearer',
+            expires_in: response.data.expires_in,
+            refresh_token: response.data.refresh_token,
+        };
+    }
+    async generateHetznerToken(dto) {
+        throw new common_1.NotImplementedException('Hetzner uses API keys and does not support OAuth token generation');
+    }
+    async refreshToken(provider, dto) {
+        try {
+            switch (provider) {
+                case cloud_provider_enum_1.CloudProvider.CONTABO:
+                    return this.refreshContaboToken(dto);
+                case cloud_provider_enum_1.CloudProvider.HETZNER:
+                    return this.refreshHetznerToken(dto);
+                default:
+                    throw new common_1.HttpException(`Provider ${provider} not supported`, common_1.HttpStatus.BAD_REQUEST);
+            }
+        }
+        catch (error) {
+            if (error.response?.status === 400 &&
+                (error.response?.data?.error === 'invalid_grant' ||
+                    error.response?.data?.error_description?.includes('expired'))) {
+                throw new common_1.HttpException('Refresh token has expired. Please log in again.', common_1.HttpStatus.UNAUTHORIZED);
+            }
+            throw new common_1.HttpException(error.response?.data?.error_description ||
+                error.response?.data?.error ||
+                'Token refresh failed', error.response?.status || common_1.HttpStatus.UNAUTHORIZED);
+        }
+    }
+    async refreshContaboToken(dto) {
+        const response = await (0, rxjs_1.lastValueFrom)(this.httpService.post('https://auth.contabo.com/auth/realms/contabo/protocol/openid-connect/token', new URLSearchParams({
+            grant_type: 'refresh_token',
+            client_id: dto.client_id,
+            client_secret: dto.client_secret,
+            refresh_token: dto.refresh_token,
+        }), {
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+            },
+        }));
+        return {
+            access_token: response.data.access_token,
+            token_type: 'Bearer',
+            expires_in: response.data.expires_in,
+            refresh_token: response.data.refresh_token,
+            scope: response.data.scope,
+        };
+    }
+    async refreshHetznerToken(dto) {
+        throw new common_1.NotImplementedException('Hetzner uses API keys and does not support OAuth token refresh');
+    }
+};
+exports.BearerTokenService = BearerTokenService;
+exports.BearerTokenService = BearerTokenService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [axios_1.HttpService])
+], BearerTokenService);

package/lib/src/modules/access/services/ca-manager.service.d.ts

@@ -0,0 +1,48 @@
+import { Repository } from 'typeorm';
+import { CAKeypairEntity } from '../entities/ca-keypair.entity';
+import { SSHKeyGeneratorService } from './ssh-key-generator.service';
+import { KeyStorageService } from './key-storage.service';
+export declare class CAManagerService {
+    private readonly caRepository;
+    private readonly keyGenerator;
+    private readonly keyStorage;
+    private readonly logger;
+    constructor(caRepository: Repository<CAKeypairEntity>, keyGenerator: SSHKeyGeneratorService, keyStorage: KeyStorageService);
+    initializeCA(): Promise<CAKeypairEntity>;
+    getActiveCA(): Promise<CAKeypairEntity | null>;
+    /**
+     * Resolves the CLI CA directory for the active profile.
+     * Priority: FLUI_PROFILE env var > ~/.flui/context file > 'default'
+     * Path: ~/.flui/profiles/<profile>/ca/
+     */
+    private getCliCaDir;
+    getCAPrivateKey(tenantId?: string): Promise<string>;
+    getCAPublicKey(tenantId?: string): Promise<string>;
+    getCAInfo(): Promise<CAKeypairEntity>;
+    getEnrollmentScript(tenantId?: string): Promise<string>;
+    /**
+     * Register an external CA public key (from CLI)
+     * @param publicKey - SSH CA public key in OpenSSH format
+     * @param options - Registration options (name, replace, metadata)
+     */
+    registerExternalCA(publicKey: string, options?: {
+        name?: string;
+        replace?: boolean;
+        metadata?: Record<string, any>;
+        privateKey?: string;
+    }): Promise<CAKeypairEntity>;
+    /**
+     * Backfill the encrypted private key on an existing CA row that was
+     * originally seeded with only the public half. Used by the bootstrap
+     * seeder so once SSH_CA_PRIVATE_KEY appears in the environment the DB
+     * row becomes self-sufficient and survives even when the env var is no
+     * longer mounted.
+     */
+    attachPrivateKey(caId: string, privateKey: string): Promise<void>;
+    /**
+     * Compute SHA256 fingerprint for a public key
+     * @param publicKey - OpenSSH format public key
+     * @param keyType - Key type (ed25519 or rsa)
+     */
+    private computeFingerprint;
+}

package/lib/src/modules/access/services/ca-manager.service.js

@@ -0,0 +1,293 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var CAManagerService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CAManagerService = void 0;
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("@nestjs/typeorm");
+const typeorm_2 = require("typeorm");
+const ca_keypair_entity_1 = require("../entities/ca-keypair.entity");
+const ssh_key_generator_service_1 = require("./ssh-key-generator.service");
+const key_storage_service_1 = require("./key-storage.service");
+const crypto = __importStar(require("node:crypto"));
+const node_fs_1 = require("node:fs");
+const path = __importStar(require("node:path"));
+const os = __importStar(require("node:os"));
+let CAManagerService = CAManagerService_1 = class CAManagerService {
+    constructor(caRepository, keyGenerator, keyStorage) {
+        this.caRepository = caRepository;
+        this.keyGenerator = keyGenerator;
+        this.keyStorage = keyStorage;
+        this.logger = new common_1.Logger(CAManagerService_1.name);
+    }
+    async initializeCA() {
+        throw new common_1.ConflictException('API CA initialization is disabled. SSH CA is managed by the CLI (~/.flui/ca/) ' +
+            'and shared with the API via environment variable or file. ' +
+            'Use "flui env:create" to set up the SSH CA.');
+    }
+    async getActiveCA() {
+        return await this.caRepository.findOne({
+            where: { isActive: true },
+            order: { createdAt: 'DESC' },
+        });
+    }
+    /**
+     * Resolves the CLI CA directory for the active profile.
+     * Priority: FLUI_PROFILE env var > ~/.flui/context file > 'default'
+     * Path: ~/.flui/profiles/<profile>/ca/
+     */
+    getCliCaDir() {
+        const baseDir = path.join(os.homedir(), '.flui');
+        const profilesDir = path.join(baseDir, 'profiles');
+        let profile = process.env.FLUI_PROFILE;
+        if (!profile) {
+            const contextFile = path.join(baseDir, 'context');
+            try {
+                profile = (0, node_fs_1.readFileSync)(contextFile, 'utf-8').trim() || 'default';
+            }
+            catch {
+                profile = 'default';
+            }
+        }
+        return path.join(profilesDir, profile, 'ca');
+    }
+    async getCAPrivateKey(tenantId) {
+        // 1. Kubernetes Secret (env var) — production K8s deployment
+        const envCaKey = process.env.SSH_CA_PRIVATE_KEY;
+        if (envCaKey) {
+            this.logger.debug('Using CLI CA private key from environment');
+            // SSH private keys MUST end with a newline
+            return envCaKey.replaceAll(String.raw `\r\n`, '\n').trimEnd() + '\n';
+        }
+        // 2. CLI CA file — local development (profile-aware: ~/.flui/profiles/<profile>/ca/ca_key)
+        const caKeyPath = path.join(this.getCliCaDir(), 'ca_key');
+        try {
+            const fileKey = await node_fs_1.promises.readFile(caKeyPath, 'utf-8');
+            this.logger.debug(`Using CLI CA private key from ${caKeyPath}`);
+            // SSH private keys MUST end with a newline — normalize but preserve it
+            return fileKey.replaceAll(String.raw `\r\n`, '\n').trimEnd() + '\n';
+        }
+        catch {
+            // File not found, continue to database fallback
+        }
+        // 3. Database CA — legacy fallback
+        const ca = await this.getActiveCA();
+        if (!ca) {
+            throw new common_1.NotFoundException(`No active CA found. Set SSH_CA_PRIVATE_KEY env var, place key in ${caKeyPath}, or initialize CA.`);
+        }
+        if (!ca.encryptedPrivateKey) {
+            throw new common_1.NotFoundException('CA private key not available.');
+        }
+        return this.keyStorage.decryptKeyFromString(ca.encryptedPrivateKey);
+    }
+    async getCAPublicKey(tenantId) {
+        // 1. Env var — production K8s deployment
+        const envCaPubKey = process.env.SSH_CA_PUBLIC_KEY;
+        if (envCaPubKey)
+            return envCaPubKey;
+        // 2. CLI CA file — local development (profile-aware: ~/.flui/profiles/<profile>/ca/ca_key.pub)
+        const caPubKeyPath = path.join(this.getCliCaDir(), 'ca_key.pub');
+        try {
+            const filePubKey = await node_fs_1.promises.readFile(caPubKeyPath, 'utf-8');
+            this.logger.debug(`Using CLI CA public key from ${caPubKeyPath}`);
+            return filePubKey.trim();
+        }
+        catch {
+            // File not found, continue to database fallback
+        }
+        // 3. Database — legacy fallback
+        const ca = await this.getActiveCA();
+        if (!ca) {
+            throw new common_1.NotFoundException('No active CA found.');
+        }
+        return ca.publicKey;
+    }
+    async getCAInfo() {
+        const ca = await this.getActiveCA();
+        if (!ca) {
+            throw new common_1.NotFoundException('No active CA found. Initialize CA first.');
+        }
+        return ca;
+    }
+    async getEnrollmentScript(tenantId) {
+        // Use default CA for now (no tenantId passed)
+        const caPublicKey = await this.getCAPublicKey(tenantId);
+        return `#!/bin/bash
+set -e
+
+echo "=== Flui.cloud SSH CA Enrollment ==="
+
+# Backup existing sshd_config
+cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak.$(date +%s)
+
+# Install CA public key
+echo "${caPublicKey}" > /etc/ssh/trusted_user_ca_keys
+chmod 644 /etc/ssh/trusted_user_ca_keys
+
+echo "✓ CA public key installed"
+
+# Configure sshd to trust CA
+if ! grep -q "^TrustedUserCAKeys" /etc/ssh/sshd_config; then
+  echo "TrustedUserCAKeys /etc/ssh/trusted_user_ca_keys" >> /etc/ssh/sshd_config
+  echo "✓ TrustedUserCAKeys configured"
+else
+  echo "⊙ TrustedUserCAKeys already configured"
+fi
+
+# Disable password authentication (security hardening)
+sed -i 's/^#\\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
+echo "✓ Password authentication disabled"
+
+# Reload SSH daemon
+if systemctl reload sshd 2>/dev/null; then
+  echo "✓ SSH daemon reloaded (sshd)"
+elif systemctl reload ssh 2>/dev/null; then
+  echo "✓ SSH daemon reloaded (ssh)"
+else
+  echo "⚠ Could not reload SSH daemon. Manual restart may be required."
+  exit 1
+fi
+
+echo "=== Enrollment completed successfully ==="
+`;
+    }
+    /**
+     * Register an external CA public key (from CLI)
+     * @param publicKey - SSH CA public key in OpenSSH format
+     * @param options - Registration options (name, replace, metadata)
+     */
+    async registerExternalCA(publicKey, options = {}) {
+        this.logger.log('Registering external CA public key...');
+        // Validate public key format
+        const trimmedKey = publicKey.trim();
+        if (!trimmedKey.startsWith('ssh-ed25519 ') &&
+            !trimmedKey.startsWith('ssh-rsa ')) {
+            throw new common_1.BadRequestException('Invalid public key format. Must start with ssh-ed25519 or ssh-rsa');
+        }
+        // Extract key type
+        const keyType = trimmedKey.startsWith('ssh-ed25519') ? 'ed25519' : 'rsa';
+        // Compute fingerprint
+        const fingerprint = this.computeFingerprint(trimmedKey, keyType);
+        // Check for existing CA
+        const existingCA = await this.getActiveCA();
+        if (existingCA) {
+            // Check if it's the same CA (by fingerprint)
+            if (existingCA.fingerprint === fingerprint) {
+                throw new common_1.ConflictException(`CA with fingerprint ${fingerprint} is already registered`);
+            }
+            // If replace flag is not set, throw error
+            if (!options.replace) {
+                throw new common_1.ConflictException('CA already exists. Use replace=true to replace existing CA.');
+            }
+            // Deactivate existing CA
+            this.logger.log(`Deactivating existing CA: ${existingCA.name}`);
+            existingCA.isActive = false;
+            await this.caRepository.save(existingCA);
+        }
+        // Generate name if not provided
+        const name = options.name || `flui-ca-${new Date().toISOString().split('T')[0]}`;
+        const encryptedPrivateKey = options.privateKey
+            ? this.keyStorage.encryptKeyToString(options.privateKey.replaceAll(String.raw `\r\n`, '\n').trimEnd() +
+                '\n')
+            : null;
+        const ca = this.caRepository.create({
+            name,
+            publicKey: trimmedKey,
+            encryptedPrivateKey,
+            fingerprint,
+            type: keyType,
+            isActive: true,
+            expiresAt: null,
+            // Store metadata if provided
+            ...(options.metadata && { metadata: options.metadata }),
+        });
+        const saved = await this.caRepository.save(ca);
+        this.logger.log(`External CA registered: ${saved.name} (${saved.fingerprint})`);
+        return saved;
+    }
+    /**
+     * Backfill the encrypted private key on an existing CA row that was
+     * originally seeded with only the public half. Used by the bootstrap
+     * seeder so once SSH_CA_PRIVATE_KEY appears in the environment the DB
+     * row becomes self-sufficient and survives even when the env var is no
+     * longer mounted.
+     */
+    async attachPrivateKey(caId, privateKey) {
+        const ca = await this.caRepository.findOne({ where: { id: caId } });
+        if (!ca) {
+            throw new common_1.NotFoundException(`CA ${caId} not found`);
+        }
+        ca.encryptedPrivateKey = this.keyStorage.encryptKeyToString(privateKey.replaceAll(String.raw `\r\n`, '\n').trimEnd() + '\n');
+        await this.caRepository.save(ca);
+        this.logger.log(`CA ${ca.name} private key attached`);
+    }
+    /**
+     * Compute SHA256 fingerprint for a public key
+     * @param publicKey - OpenSSH format public key
+     * @param keyType - Key type (ed25519 or rsa)
+     */
+    computeFingerprint(publicKey, keyType) {
+        // Extract the base64 part (second field in OpenSSH format)
+        const parts = publicKey.trim().split(' ');
+        if (parts.length < 2) {
+            throw new common_1.BadRequestException('Invalid public key format');
+        }
+        const keyData = parts[1];
+        const keyBuffer = Buffer.from(keyData, 'base64');
+        // Compute SHA256 hash
+        const hash = crypto.createHash('sha256').update(keyBuffer).digest('base64');
+        return `SHA256:${hash.replace(/=+$/, '')}`; // Remove trailing =
+    }
+};
+exports.CAManagerService = CAManagerService;
+exports.CAManagerService = CAManagerService = CAManagerService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, typeorm_1.InjectRepository)(ca_keypair_entity_1.CAKeypairEntity)),
+    __metadata("design:paramtypes", [typeorm_2.Repository,
+        ssh_key_generator_service_1.SSHKeyGeneratorService,
+        key_storage_service_1.KeyStorageService])
+], CAManagerService);

package/lib/src/modules/access/services/certificate-signer.service.d.ts

@@ -0,0 +1,36 @@
+import { SSHKeyGeneratorService } from './ssh-key-generator.service';
+import { CAManagerService } from './ca-manager.service';
+/**
+ * Internal interface for ephemeral certificates
+ * Not exposed via REST API
+ * @internal
+ */
+export interface EphemeralCertificate {
+    certificate: string;
+    privateKey: string;
+    publicKey: string;
+    fingerprint: string;
+    expiresAt: Date;
+    tenantId?: string;
+}
+/**
+ * Internal service for generating ephemeral SSH certificates
+ * Used only by the terminal service for WebSocket SSH connections
+ * @internal
+ */
+export declare class CertificateSignerService {
+    private readonly keyGenerator;
+    private readonly caManager;
+    private readonly logger;
+    constructor(keyGenerator: SSHKeyGeneratorService, caManager: CAManagerService);
+    /**
+     * Generate ephemeral certificate for internal SSH connections
+     * This is ONLY called internally by the terminal service
+     * Never expose this via REST API as it returns private keys
+     */
+    generateEphemeralCertificate(tenantId?: string, ttlSeconds?: number): Promise<EphemeralCertificate>;
+    /**
+     * Sign public key with CA (internal helper)
+     */
+    private signPublicKeyWithCA;
+}

package/lib/src/modules/access/services/certificate-signer.service.js

@@ -0,0 +1,155 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var CertificateSignerService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CertificateSignerService = void 0;
+const common_1 = require("@nestjs/common");
+const ssh_key_generator_service_1 = require("./ssh-key-generator.service");
+const ca_manager_service_1 = require("./ca-manager.service");
+const node_fs_1 = require("node:fs");
+const node_child_process_1 = require("node:child_process");
+const node_util_1 = require("node:util");
+const path = __importStar(require("node:path"));
+const os = __importStar(require("node:os"));
+const execAsync = (0, node_util_1.promisify)(node_child_process_1.exec);
+/**
+ * Internal service for generating ephemeral SSH certificates
+ * Used only by the terminal service for WebSocket SSH connections
+ * @internal
+ */
+let CertificateSignerService = CertificateSignerService_1 = class CertificateSignerService {
+    constructor(keyGenerator, caManager) {
+        this.keyGenerator = keyGenerator;
+        this.caManager = caManager;
+        this.logger = new common_1.Logger(CertificateSignerService_1.name);
+    }
+    /**
+     * Generate ephemeral certificate for internal SSH connections
+     * This is ONLY called internally by the terminal service
+     * Never expose this via REST API as it returns private keys
+     */
+    async generateEphemeralCertificate(tenantId, ttlSeconds = 180) {
+        this.logger.debug(`Generating ephemeral certificate for tenant ${tenantId || 'global'}, TTL: ${ttlSeconds}s`);
+        // Generate ephemeral keypair (never stored, only in memory)
+        const ephemeralKeyPair = await this.keyGenerator.generateKeyPair('ed25519');
+        // Get CA private key for this tenant
+        const caPrivateKey = await this.caManager.getCAPrivateKey(tenantId);
+        // Standard principals for server access
+        const principals = ['root', 'ubuntu', 'admin'];
+        // Sign the ephemeral public key with tenant's CA
+        const certificate = await this.signPublicKeyWithCA(ephemeralKeyPair.publicKey, caPrivateKey, principals, ttlSeconds);
+        const expiresAt = new Date();
+        expiresAt.setSeconds(expiresAt.getSeconds() + ttlSeconds);
+        return {
+            certificate,
+            privateKey: ephemeralKeyPair.privateKey,
+            publicKey: ephemeralKeyPair.publicKey,
+            fingerprint: ephemeralKeyPair.fingerprint,
+            expiresAt,
+            tenantId,
+        };
+    }
+    /**
+     * Sign public key with CA (internal helper)
+     */
+    async signPublicKeyWithCA(publicKey, caPrivateKey, principals, validitySeconds) {
+        let tempDir = null;
+        try {
+            tempDir = await node_fs_1.promises.mkdtemp(path.join(os.tmpdir(), 'flui-ca-'));
+            const caKeyPath = path.join(tempDir, 'ca');
+            const pubKeyPath = path.join(tempDir, 'ephemeral.pub');
+            const certPath = path.join(tempDir, 'ephemeral-cert.pub');
+            await node_fs_1.promises.writeFile(caKeyPath, caPrivateKey, { mode: 0o600 });
+            await node_fs_1.promises.writeFile(pubKeyPath, publicKey);
+            const principalsStr = principals.join(',');
+            const timestamp = Date.now();
+            const command = `ssh-keygen -s "${caKeyPath}" -I "flui-ephemeral-${timestamp}" -n "${principalsStr}" -V "+${validitySeconds}s" "${pubKeyPath}"`;
+            this.logger.debug(`Executing ssh-keygen signing command...`);
+            this.logger.debug(`Command: ${command}`);
+            // Execute ssh-keygen and capture output
+            const { stdout, stderr } = await execAsync(command, { cwd: tempDir });
+            if (stdout)
+                this.logger.debug(`ssh-keygen stdout: ${stdout}`);
+            if (stderr)
+                this.logger.debug(`ssh-keygen stderr: ${stderr}`);
+            // Read the generated certificate
+            const certificate = await node_fs_1.promises.readFile(certPath, 'utf-8');
+            const certStats = await node_fs_1.promises.stat(certPath);
+            this.logger.debug(`Certificate file size: ${certStats.size} bytes`);
+            this.logger.debug(`Certificate preview (first 200 chars): ${certificate.substring(0, 200)}...`);
+            // Validate the certificate using ssh-keygen -L
+            try {
+                const validateCommand = `ssh-keygen -L -f "${certPath}"`;
+                const { stdout: certInfo } = await execAsync(validateCommand, {
+                    cwd: tempDir,
+                });
+                this.logger.debug(`Certificate validation info:\n${certInfo}`);
+            }
+            catch (validateError) {
+                this.logger.warn(`Failed to validate certificate: ${validateError.message}`);
+            }
+            return certificate.trim();
+        }
+        catch (error) {
+            this.logger.error('Failed to sign certificate:', error.message);
+            throw error;
+        }
+        finally {
+            if (tempDir) {
+                try {
+                    await node_fs_1.promises.rm(tempDir, { recursive: true, force: true });
+                }
+                catch (cleanupError) {
+                    this.logger.warn(`Failed to cleanup temp directory: ${cleanupError.message}`);
+                }
+            }
+        }
+    }
+};
+exports.CertificateSignerService = CertificateSignerService;
+exports.CertificateSignerService = CertificateSignerService = CertificateSignerService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [ssh_key_generator_service_1.SSHKeyGeneratorService,
+        ca_manager_service_1.CAManagerService])
+], CertificateSignerService);

package/lib/src/modules/access/services/key-storage.service.d.ts

@@ -0,0 +1,17 @@
+import { ConfigService } from '@nestjs/config';
+export declare class KeyStorageService {
+    private readonly configService;
+    private readonly keyBasePath;
+    private readonly encryptionKey;
+    private readonly logger;
+    constructor(configService: ConfigService);
+    storePrivateKey(userId: string, keyId: string, privateKey: string): Promise<string>;
+    retrievePrivateKey(keyPath: string): Promise<string>;
+    deleteKey(keyPath: string): Promise<void>;
+    encryptKeyToString(privateKey: string): string;
+    encryptKey(privateKey: string): Buffer;
+    decryptKey(encryptedData: Buffer): string;
+    decryptKeyFromString(encryptedString: string): string;
+    private getKeyPath;
+    private cleanupKeyDirectory;
+}