detssh 0.6.0__tar.gz → 0.7.0__tar.gz

{detssh-0.6.0 → detssh-0.7.0}/CHANGELOG.md

@@ -7,6 +7,25 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.7.0] - 2026-10-05
+
+### Added
+
+- `--authorize`: derive the key, but only append its public half to
+  `~/.ssh/authorized_keys` (or `--authorized-keys FILE`), the way
+  `ssh-copy-id` would. No private key is written, so a machine you only want
+  to log *into* never holds one. A key that's already in the file (under any
+  comment or options) is left alone, and an existing file keeps its mode; a
+  new one is created 600 inside a 700 `~/.ssh`.
+- Interactive mode now opens by asking whether to generate a keypair or only
+  add the public key. Generating stays the default. `detssh --authorize`
+  skips that question and still prompts for everything else, so the seed
+  passphrase never has to go on the command line.
+
+### Changed
+
+- `--create-parent-dirs` applies to the `--authorized-keys` file's parent too.
+
 ## [0.6.0] - 2026-09-19
 
 ### Added

{detssh-0.6.0 → detssh-0.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: detssh
-Version: 0.6.0
+Version: 0.7.0
 Summary: Deterministic Ed25519 SSH key generation from a seed passphrase, via configurable KDF and salt-hash backends.
 Project-URL: Homepage, https://github.com/isik-kaplan/detssh
 Project-URL: Repository, https://github.com/isik-kaplan/detssh
@@ -50,6 +50,26 @@ never touches key derivation, so it doesn't need to be remembered to
 *recreate* the key, only to unlock the file you already have. Same caveat as
 `--seed` applies if passed as a flag.
 
+## Only installing the public key
+
+Because the same seed and parameters always give the same key, a machine
+you only want to log *into* doesn't need the private key at all. Run this
+on that machine instead:
+```
+detssh --authorize
+```
+It prompts for the same seed, label and backend settings as a normal run,
+then appends the public key to `~/.ssh/authorized_keys`, `ssh-copy-id`
+style. No private key is written. If the key is already there, the file is
+left untouched, so running it twice is harmless. The interactive wizard
+asks about this up front too ("Only add the public key to an
+authorized_keys file").
+
+In flag mode, add `--authorize` to the usual flags, plus `--authorized-keys
+FILE` for a file other than `~/.ssh/authorized_keys`. `--output`,
+`--key-passphrase`, `--register` and `--overwrite-files` are rejected
+alongside it, because they only apply when a private key is written.
+
 ## Using the key with `ssh`
 
 `ssh` only auto-offers keys with default filenames (`id_rsa`, `id_ed25519`, ...)

{detssh-0.6.0 → detssh-0.7.0}/README.md

@@ -29,6 +29,26 @@ never touches key derivation, so it doesn't need to be remembered to
 *recreate* the key, only to unlock the file you already have. Same caveat as
 `--seed` applies if passed as a flag.
 
+## Only installing the public key
+
+Because the same seed and parameters always give the same key, a machine
+you only want to log *into* doesn't need the private key at all. Run this
+on that machine instead:
+```
+detssh --authorize
+```
+It prompts for the same seed, label and backend settings as a normal run,
+then appends the public key to `~/.ssh/authorized_keys`, `ssh-copy-id`
+style. No private key is written. If the key is already there, the file is
+left untouched, so running it twice is harmless. The interactive wizard
+asks about this up front too ("Only add the public key to an
+authorized_keys file").
+
+In flag mode, add `--authorize` to the usual flags, plus `--authorized-keys
+FILE` for a file other than `~/.ssh/authorized_keys`. `--output`,
+`--key-passphrase`, `--register` and `--overwrite-files` are rejected
+alongside it, because they only apply when a private key is written.
+
 ## Using the key with `ssh`
 
 `ssh` only auto-offers keys with default filenames (`id_rsa`, `id_ed25519`, ...)

{detssh-0.6.0 → detssh-0.7.0}/detssh/__init__.py

@@ -3,7 +3,7 @@ from detssh.backends.salt import ALGOS as SALT_ALGOS
 from detssh.keygen import default_output_path, keypair_from_seed, public_key_path, write_keypair
 
 
-__version__ = "0.6.0"
+__version__ = "0.7.0"
 __all__ = [
     "KDF_BACKENDS",
     "SALT_ALGOS",

{detssh-0.6.0 → detssh-0.7.0}/detssh/backends/base.py

@@ -3,7 +3,14 @@ from pathlib import Path
 import click
 import questionary
 
-from detssh.keygen import keypair_from_seed, public_key_path, ssh_dir, write_keypair
+from detssh.keygen import (
+    authorize_public_key,
+    keypair_from_seed,
+    public_key_line,
+    public_key_path,
+    ssh_dir,
+    write_keypair,
+)
 
 
 def _display_path(path):
@@ -215,9 +222,31 @@ def write_keypair_and_recap(seed_bytes, output, comment, recap, key_passphrase="
     click.echo(f"Wrote private key: {priv_path}{' (encrypted)' if key_passphrase else ''}")
     click.echo(f"Wrote public key:  {pub_path}")
 
+    echo_recap(recap)
+
+    return priv_path, pub_path
+
+
+def authorize_and_recap(seed_bytes, authorized_keys, comment, recap, create_parent_dirs=False):
+    _, public_key = keypair_from_seed(seed_bytes)
+    try:
+        added = authorize_public_key(
+            public_key, authorized_keys, comment=comment, create_parent_dirs=create_parent_dirs
+        )
+    except OSError as e:
+        raise click.ClickException(f"couldn't write {authorized_keys}: {e.strerror or e}") from e
+
+    if added:
+        click.echo(f"Added public key to {authorized_keys}:")
+    else:
+        click.echo(f"Public key already in {authorized_keys}, left it unchanged:")
+    click.echo(f"  {public_key_line(public_key, comment).decode('utf-8').rstrip()}")
+
+    echo_recap(recap)
+
+
+def echo_recap(recap):
     click.echo()
     click.echo("To recreate this exact key, remember your passphrase (keep it secret) plus:")
     for name, value in (*recap, ("algorithm", "ed25519")):
         click.echo(f"  {name:<18} {value}")
-
-    return priv_path, pub_path

{detssh-0.6.0 → detssh-0.7.0}/detssh/cli.py

@@ -1,5 +1,6 @@
 import sys
 import textwrap
+from pathlib import Path
 
 import click
 from click.formatting import measure_table
@@ -8,6 +9,8 @@ from detssh.backends import kdf, salt
 from detssh.backends.base import (
     DEFAULT_TEXT_MARKER,
     Field,
+    _display_path,
+    authorize_and_recap,
     build_options,
     confirm_create_parent_dirs,
     confirm_overwrite,
@@ -17,7 +20,12 @@ from detssh.backends.base import (
 )
 from detssh.backends.kdf.base import KDFError
 from detssh.backends.salt.base import SaltError
-from detssh.keygen import COMMENT_FORBIDDEN_CHARS, ED25519_SEED_LENGTH, default_output_path
+from detssh.keygen import (
+    COMMENT_FORBIDDEN_CHARS,
+    ED25519_SEED_LENGTH,
+    default_authorized_keys_path,
+    default_output_path,
+)
 from detssh.ssh_cli import OptionalPort, register_entry, split_destination
 
 
@@ -25,6 +33,12 @@ DEFAULT_KDF = "argon2id"
 DEFAULT_SALT_ALGO = "blake2b"
 HASH_LEN = ED25519_SEED_LENGTH
 
+GENERATE_MODE = "Generate a keypair (private + public key)"
+AUTHORIZE_MODE = "Only add the public key to an authorized_keys file"
+MODE = Field("What do you want to do?", kind="select", choices=(GENERATE_MODE, AUTHORIZE_MODE))
+# Flags that only make sense when a private key gets written.
+KEYPAIR_ONLY_FLAGS = ("output", "key_passphrase", "register", "register_port")
+
 SELECTORS = {
     "kdf": Field("KDF backend", kind="select", choices=tuple(kdf.BACKENDS)),
     "salt_algo": Field("Salt hash algorithm", kind="select", choices=tuple(salt.ALGOS)),
@@ -65,8 +79,8 @@ def _peek(args, flag, default):
     return value
 
 
-def _fields_for(kdf_cls, salt_cls):
-    return {
+def _fields_for(kdf_cls, salt_cls, authorize=False):
+    fields = {
         "seed": COMMON["seed"],
         "label": COMMON["label"],
         **kdf_cls.fields,
@@ -75,6 +89,9 @@ def _fields_for(kdf_cls, salt_cls):
         "comment": COMMON["comment"],
         "key_passphrase": COMMON["key_passphrase"],
     }
+    if authorize:
+        del fields["output"], fields["key_passphrase"]
+    return fields
 
 
 def _help_note(kdf_cls, salt_cls):
@@ -110,6 +127,30 @@ def _registration_from_flags(label, values):
     return label, user, host, port
 
 
+def _check_authorize_flags(authorize, authorized_keys, overwrite_files, values):
+    """Reject flag combinations --authorize can't honor, before any key derivation."""
+    if not authorize:
+        if authorized_keys is not None:
+            raise click.UsageError("--authorized-keys needs --authorize")
+        return
+    if overwrite_files:
+        raise click.UsageError("--overwrite-files can't be used with --authorize: it only appends")
+    for name in KEYPAIR_ONLY_FLAGS:
+        if values.get(name) is not None:
+            flag = f"--{name.replace('_', '-')}"
+            raise click.UsageError(f"{flag} can't be used with --authorize: no private key is written")
+
+
+def _ask_authorized_keys():
+    default = default_authorized_keys_path()
+    return click.prompt(
+        f"authorized_keys file to add the public key to [{_display_path(default)}]",
+        default=default,
+        type=click.Path(dir_okay=False, path_type=Path),
+        show_default=False,
+    )
+
+
 def _register_interactively(label, key_path):
     """Offer to wire the key we just wrote into ~/.ssh/config. Declining leaves the key
     exactly as written - `detssh ssh register` does the same thing later on."""
@@ -143,12 +184,26 @@ class KDFSaltCommand(click.Command):
         fields = {**SELECTORS, **_fields_for(kdf_cls, salt_cls)}
         defaults = {**DEFAULTS, **kdf_cls.defaults, **salt_cls.defaults}
         self.params = build_options(fields, defaults) + [
+            click.Option(
+                ["--authorize"],
+                is_flag=True,
+                help="Only add the public key to an authorized_keys file (see --authorized-keys), so the "
+                "machine accepts logins from wherever you derived the private key. Writes no private key. "
+                "Doesn't switch to flag mode on its own: `detssh --authorize` still prompts for the rest.",
+            ),
+            click.Option(
+                ["--authorized-keys"],
+                type=click.Path(dir_okay=False, path_type=Path),
+                default=None,
+                help="authorized_keys file for --authorize to append to. Skipped if the key is already "
+                f"in it.{DEFAULT_TEXT_MARKER}[default: ~/.ssh/authorized_keys]",
+            ),
             click.Option(["--overwrite-files"], is_flag=True, help="Overwrite existing output files without asking."),
             click.Option(
                 ["--create-parent-dirs"],
                 is_flag=True,
-                help="Create the output path's parent directories if missing, even outside ~/.ssh. "
-                "Interactive mode prompts for this itself if you don't pass the flag; "
+                help="Create the output path's (or --authorized-keys file's) parent directories if missing, "
+                "even outside ~/.ssh. Interactive mode prompts for this itself if you don't pass the flag; "
                 "non-interactive mode requires it explicitly.",
             ),
             click.Option(
@@ -199,10 +254,14 @@ class KDFSaltCommand(click.Command):
 
 
 @click.command(cls=KDFSaltCommand, context_settings={"help_option_names": ["-h", "--help"], "max_content_width": 120})
-def main(overwrite_files, create_parent_dirs, **values):
+def main(overwrite_files, create_parent_dirs, authorize, authorized_keys, **values):
     interactive = is_interactive(values)
     force_allow_soft_constraints = bool(values.get("force_allow_soft_constraints"))
 
+    _check_authorize_flags(authorize, authorized_keys, overwrite_files, values)
+    if interactive and not authorize:
+        authorize = MODE.ask(GENERATE_MODE) == AUTHORIZE_MODE
+
     kdf_name = values["kdf"]
     if kdf_name is None:
         kdf_name = SELECTORS["kdf"].ask(DEFAULTS["kdf"]) if interactive else DEFAULTS["kdf"]
@@ -213,7 +272,7 @@ def main(overwrite_files, create_parent_dirs, **values):
         salt_name = SELECTORS["salt_algo"].ask(DEFAULTS["salt_algo"]) if interactive else DEFAULTS["salt_algo"]
     salt_cls = salt.ALGOS[salt_name]
 
-    fields = _fields_for(kdf_cls, salt_cls)
+    fields = _fields_for(kdf_cls, salt_cls, authorize)
     defaults = {**DEFAULTS, **kdf_cls.defaults, **salt_cls.defaults}
 
     resolved = {
@@ -226,6 +285,13 @@ def main(overwrite_files, create_parent_dirs, **values):
     if any(char in resolved["comment"] for char in COMMENT_FORBIDDEN_CHARS):
         raise click.UsageError("--comment must not contain newlines")
 
+    if authorize:
+        if authorized_keys is None:
+            authorized_keys = _ask_authorized_keys() if interactive else default_authorized_keys_path()
+        target = authorized_keys.expanduser()
+    else:
+        target = resolved["output"]
+
     registration = None if interactive else _registration_from_flags(resolved["label"], values)
 
     try:
@@ -236,8 +302,9 @@ def main(overwrite_files, create_parent_dirs, **values):
     if salt_error:
         raise click.UsageError(f"{kdf_name} {salt_error}")
 
-    confirm_overwrite(resolved["output"], overwrite_files)
-    create_parent_dirs = confirm_create_parent_dirs(resolved["output"], create_parent_dirs, interactive)
+    if not authorize:
+        confirm_overwrite(target, overwrite_files)
+    create_parent_dirs = confirm_create_parent_dirs(target, create_parent_dirs, interactive)
 
     click.echo("Deriving key...")
     try:
@@ -255,6 +322,10 @@ def main(overwrite_files, create_parent_dirs, **values):
         ("hash-len", resolved["hash_len"]),
     )
 
+    if authorize:
+        authorize_and_recap(seed_bytes, target, resolved["comment"], recap, create_parent_dirs=create_parent_dirs)
+        return
+
     priv_path, _ = write_keypair_and_recap(
         seed_bytes,
         resolved["output"],

{detssh-0.6.0 → detssh-0.7.0}/detssh/keygen.py

@@ -20,6 +20,10 @@ def default_output_path():
     return ssh_dir() / "id_ed25519"
 
 
+def default_authorized_keys_path():
+    return ssh_dir() / "authorized_keys"
+
+
 # ed25519 is the only algorithm whose private key is literally its own seed, so it's the only one usable here.
 def keypair_from_seed(seed):
     if len(seed) != ED25519_SEED_LENGTH:
@@ -33,9 +37,20 @@ def public_key_path(private_key_path):
     return private_key_path.with_name(private_key_path.name + ".pub")
 
 
-def write_keypair(private_key, public_key, output_path, comment="", key_passphrase="", create_parent_dirs=False):
+def public_key_line(public_key, comment=""):
+    """The public key as one authorized_keys / .pub line, newline included."""
     if any(char in comment for char in COMMENT_FORBIDDEN_CHARS):
         raise ValueError("comment must not contain newlines")
+    public_bytes = public_key.public_bytes(
+        encoding=serialization.Encoding.OpenSSH,
+        format=serialization.PublicFormat.OpenSSH,
+    )
+    comment_suffix = f" {comment}" if comment else ""
+    return public_bytes + comment_suffix.encode("utf-8") + b"\n"
+
+
+def write_keypair(private_key, public_key, output_path, comment="", key_passphrase="", create_parent_dirs=False):
+    pub_line = public_key_line(public_key, comment)
 
     output_path = Path(output_path)
     pub_path = public_key_path(output_path)
@@ -53,17 +68,35 @@ def write_keypair(private_key, public_key, output_path, comment="", key_passphra
         format=serialization.PrivateFormat.OpenSSH,
         encryption_algorithm=encryption_algorithm,
     )
-    public_bytes = public_key.public_bytes(
-        encoding=serialization.Encoding.OpenSSH,
-        format=serialization.PublicFormat.OpenSSH,
-    )
 
     fd = os.open(output_path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, PRIVATE_KEY_MODE)
     os.fchmod(fd, PRIVATE_KEY_MODE)
     with os.fdopen(fd, "wb") as f:
         f.write(private_bytes)
 
-    comment_suffix = f" {comment}" if comment else ""
-    pub_path.write_bytes(public_bytes + comment_suffix.encode("utf-8") + b"\n")
+    pub_path.write_bytes(pub_line)
 
     return output_path, pub_path
+
+
+def authorize_public_key(public_key, authorized_keys_path, comment="", create_parent_dirs=False):
+    """Append the public key to an authorized_keys file, ssh-copy-id style. Returns False
+    without touching the file when the key is already in it (under any comment or options)."""
+    line = public_key_line(public_key, comment)
+    key_blob = line.split()[1]
+    authorized_keys_path = Path(authorized_keys_path)
+
+    existing = authorized_keys_path.read_bytes() if authorized_keys_path.exists() else b""
+    if any(key_blob in existing_line.split() for existing_line in existing.splitlines()):
+        return False
+
+    if create_parent_dirs or authorized_keys_path.parent == ssh_dir():
+        authorized_keys_path.parent.mkdir(mode=SSH_DIR_MODE, parents=True, exist_ok=True)
+
+    # An existing file keeps its own mode; sshd's StrictModes is what decides whether that's acceptable.
+    fd = os.open(authorized_keys_path, os.O_WRONLY | os.O_CREAT | os.O_APPEND, PRIVATE_KEY_MODE)
+    with os.fdopen(fd, "wb") as f:
+        if existing and not existing.endswith(b"\n"):
+            f.write(b"\n")
+        f.write(line)
+    return True

{detssh-0.6.0 → detssh-0.7.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "detssh"
-version = "0.6.0"
+version = "0.7.0"
 description = "Deterministic Ed25519 SSH key generation from a seed passphrase, via configurable KDF and salt-hash backends."
 readme = "README.md"
 authors = [

{detssh-0.6.0 → detssh-0.7.0}/tests/golden/help_default.txt

@@ -23,13 +23,22 @@ Options:
   --comment TEXT                  Comment for the public key
   --key-passphrase TEXT           Passphrase to encrypt the private key file
                                   with (leave empty for none)
+  --authorize                     Only add the public key to an authorized_keys
+                                  file (see --authorized-keys), so the machine
+                                  accepts logins from wherever you derived the
+                                  private key. Writes no private key. Doesn't
+                                  switch to flag mode on its own: `detssh
+                                  --authorize` still prompts for the rest.
+  --authorized-keys FILE          authorized_keys file for --authorize to append
+                                  to. Skipped if the key is already in it.
+                                  [default: ~/.ssh/authorized_keys]
   --overwrite-files               Overwrite existing output files without
                                   asking.
-  --create-parent-dirs            Create the output path's parent directories if
-                                  missing, even outside ~/.ssh. Interactive mode
-                                  prompts for this itself if you don't pass the
-                                  flag; non-interactive mode requires it
-                                  explicitly.
+  --create-parent-dirs            Create the output path's (or --authorized-keys
+                                  file's) parent directories if missing, even
+                                  outside ~/.ssh. Interactive mode prompts for
+                                  this itself if you don't pass the flag; non-
+                                  interactive mode requires it explicitly.
   --register USER@HOST            Register the generated key so plain `ssh
                                   <label>` connects to USER@HOST, as `detssh ssh
                                   register` would. Needs --label, which names

{detssh-0.6.0 → detssh-0.7.0}/tests/golden/help_pbkdf2_sha256.txt

@@ -17,13 +17,22 @@ Options:
   --comment TEXT                  Comment for the public key
   --key-passphrase TEXT           Passphrase to encrypt the private key file
                                   with (leave empty for none)
+  --authorize                     Only add the public key to an authorized_keys
+                                  file (see --authorized-keys), so the machine
+                                  accepts logins from wherever you derived the
+                                  private key. Writes no private key. Doesn't
+                                  switch to flag mode on its own: `detssh
+                                  --authorize` still prompts for the rest.
+  --authorized-keys FILE          authorized_keys file for --authorize to append
+                                  to. Skipped if the key is already in it.
+                                  [default: ~/.ssh/authorized_keys]
   --overwrite-files               Overwrite existing output files without
                                   asking.
-  --create-parent-dirs            Create the output path's parent directories if
-                                  missing, even outside ~/.ssh. Interactive mode
-                                  prompts for this itself if you don't pass the
-                                  flag; non-interactive mode requires it
-                                  explicitly.
+  --create-parent-dirs            Create the output path's (or --authorized-keys
+                                  file's) parent directories if missing, even
+                                  outside ~/.ssh. Interactive mode prompts for
+                                  this itself if you don't pass the flag; non-
+                                  interactive mode requires it explicitly.
   --register USER@HOST            Register the generated key so plain `ssh
                                   <label>` connects to USER@HOST, as `detssh ssh
                                   register` would. Needs --label, which names

{detssh-0.6.0 → detssh-0.7.0}/tests/mutmut_known_equivalents.txt

@@ -34,18 +34,16 @@ detssh.cli.xǁKDFSaltCommandǁparse_args__mutmut_13
 
 # click.Option's own default for the `default=` kwarg is already None for a non-flag
 # option, so passing default=None explicitly vs. omitting it are identical.
-detssh.cli.xǁKDFSaltCommandǁparse_args__mutmut_75
-detssh.cli.xǁKDFSaltCommandǁparse_args__mutmut_94
+detssh.cli.xǁKDFSaltCommandǁparse_args__mutmut_64
+detssh.cli.xǁKDFSaltCommandǁparse_args__mutmut_110
+detssh.cli.xǁKDFSaltCommandǁparse_args__mutmut_129
 
-# format_options' first_col/text_width arithmetic: the 30-char cap and 1-off changes to
-# it (mutmut_13) or to the -4/10 padding (21, 22) only produce a different wrapped line
-# for option-name/help-text/terminal-width combinations that land exactly on the changed
-# boundary - the real --help output (checked byte-for-byte by test_help_text.py) never
-# does, and test_format_options_sizes_the_first_column_from_option_names_not_help_text
+# format_options' text_width floor: a 1-off change to the 10 (mutmut_22) only produces a
+# different wrapped line on a terminal narrow enough to hit the floor at all, landing
+# exactly on the changed boundary - the real --help output (checked byte-for-byte by
+# test_help_text.py) never does, and test_format_options_sizes_the_first_column_from_option_names_not_help_text
 # already pins the one-character-off-by-a-lot case (measure_table()[0] vs [1]) that
 # *does* show up in real output.
-detssh.cli.xǁKDFSaltCommandǁformat_options__mutmut_13
-detssh.cli.xǁKDFSaltCommandǁformat_options__mutmut_21
 detssh.cli.xǁKDFSaltCommandǁformat_options__mutmut_22
 # help_text.split(DEFAULT_TEXT_MARKER, 1) vs rsplit(..., 1) vs split(..., 2) vs
 # split(..., ) (no limit): DEFAULT_TEXT_MARKER ("\x00") is inserted into a help string at
@@ -75,14 +73,15 @@ detssh.cli.x_run__mutmut_16
 detssh.ssh_config.x_write_hosts_file__mutmut_16
 # Same reasoning: write_keypair's os.open(..., PRIVATE_KEY_MODE) is followed by an
 # unconditional os.fchmod(fd, PRIVATE_KEY_MODE).
-detssh.keygen.x_write_keypair__mutmut_48
+detssh.keygen.x_write_keypair__mutmut_43
 
 # Python's codec lookup is case-insensitive ("utf-8" and "UTF-8" resolve to the same
 # codec), and hashlib's hash-algorithm-name lookup is too ("sha256" and "SHA256" give the
 # same digest) - every one of these mutates a hardcoded codec/hash name to a different
 # case, which cannot change what the code does.
 detssh.keygen.x_write_keypair__mutmut_29
-detssh.keygen.x_write_keypair__mutmut_71
+detssh.keygen.x_public_key_line__mutmut_20
+detssh.backends.base.x_authorize_and_recap__mutmut_25
 detssh.backends.kdf.scrypt.xǁScryptǁrun__mutmut_35
 detssh.backends.kdf.bcrypt_pbkdf.xǁBcryptPbkdfǁrun__mutmut_13
 detssh.backends.kdf.pbkdf2.xǁPbkdf2ǁrun__mutmut_12
@@ -108,6 +107,17 @@ detssh.backends.base.xǁFieldǁ__init____mutmut_2
 # see the type= mutants on the same line (mutmut_34, 38), which ARE real and are killed
 # by test_wizard_register_prompt_reasks_on_a_non_integer_port.
 detssh.cli.x__register_interactively__mutmut_33
+# Same for _ask_authorized_keys, whose default is a Path (truthy): click only shows the
+# hint when show_default is truthy or a str, and None is neither, so it behaves exactly
+# like False. The hint the prompt does show is written into its message by hand.
+detssh.cli.x__ask_authorized_keys__mutmut_5
+
+# click.Path only ever reads dir_okay through truthiness (`if not self.dir_okay and ...`),
+# so dir_okay=None behaves exactly like dir_okay=False. The dir_okay=True and omitted
+# mutants on the same lines are real and killed by the "rejects_a_directory" tests in
+# test_authorize.py.
+detssh.cli.x__ask_authorized_keys__mutmut_11
+detssh.cli.xǁKDFSaltCommandǁparse_args__mutmut_68
 
 # Two mutants turn a loop into an infinite one (an absolute assignment replacing a += in
 # _peek's index-advance; `name = None` inside `_register_interactively`'s `while not

detssh-0.7.0/tests/test_authorize.py

@@ -0,0 +1,394 @@
+import stat
+
+import click
+import pytest
+import questionary
+from click.testing import CliRunner
+
+from detssh.backends.base import authorize_and_recap
+from detssh.cli import AUTHORIZE_MODE, GENERATE_MODE, main
+from detssh.keygen import (
+    authorize_public_key,
+    default_authorized_keys_path,
+    keypair_from_seed,
+    public_key_line,
+)
+
+
+SEED = b"\x01" * 32
+OTHER_SEED = b"\x02" * 32
+FLAG_RUN = ["--kdf", "pbkdf2", "--iterations", "2", "--seed", "s", "--label", "work"]
+
+
+def _public_key(seed=SEED):
+    return keypair_from_seed(seed)[1]
+
+
+def _blob(seed=SEED):
+    return public_key_line(_public_key(seed)).rstrip(b"\n")
+
+
+def _fake_select(answer_for_mode):
+    """Pick `answer_for_mode` at the mode question and pbkdf2 at the KDF picker, recording
+    every question asked so tests can check which ones came up."""
+    asked = []
+
+    def select(message, choices, default):
+        asked.append((message, tuple(choices), default))
+        if message == "What do you want to do?":
+            answer = answer_for_mode
+        else:
+            answer = "pbkdf2" if "pbkdf2" in choices else default
+        return type("Q", (), {"ask": lambda self: answer})()
+
+    return select, asked
+
+
+def test_default_authorized_keys_path_is_in_ssh_dir(monkeypatch, tmp_path):
+    monkeypatch.setenv("HOME", str(tmp_path))
+    assert default_authorized_keys_path() == tmp_path / ".ssh" / "authorized_keys"
+
+
+def test_public_key_line_is_type_blob_comment_newline():
+    line = public_key_line(_public_key(), "me@work laptop")
+    key_type, blob, comment = line.decode("utf-8").rstrip("\n").split(" ", 2)
+    assert (key_type, comment) == ("ssh-ed25519", "me@work laptop")
+    assert line == f"ssh-ed25519 {blob} me@work laptop\n".encode()
+
+
+def test_public_key_line_without_comment_has_no_trailing_space():
+    assert public_key_line(_public_key()) == _blob() + b"\n"
+    assert not _blob().endswith(b" ")
+
+
+def test_public_key_line_rejects_a_comment_with_a_newline():
+    with pytest.raises(ValueError, match="^comment must not contain newlines$"):
+        public_key_line(_public_key(), "a\nb")
+
+
+def test_authorize_creates_ssh_dir_and_file_with_private_modes(monkeypatch, tmp_path):
+    monkeypatch.setenv("HOME", str(tmp_path))
+    path = tmp_path / ".ssh" / "authorized_keys"
+
+    assert authorize_public_key(_public_key(), path, comment="c") is True
+
+    assert path.read_bytes() == _blob() + b" c\n"
+    assert stat.S_IMODE(path.stat().st_mode) == 0o600
+    assert stat.S_IMODE(path.parent.stat().st_mode) == 0o700
+
+
+def test_authorize_appends_after_existing_keys(tmp_path):
+    path = tmp_path / "authorized_keys"
+    path.write_bytes(_blob(OTHER_SEED) + b" other\n")
+
+    assert authorize_public_key(_public_key(), path) is True
+
+    assert path.read_bytes() == _blob(OTHER_SEED) + b" other\n" + _blob() + b"\n"
+
+
+def test_authorize_adds_the_missing_newline_before_appending(tmp_path):
+    path = tmp_path / "authorized_keys"
+    path.write_bytes(b"ssh-rsa AAAA old")
+
+    authorize_public_key(_public_key(), path)
+
+    assert path.read_bytes() == b"ssh-rsa AAAA old\n" + _blob() + b"\n"
+
+
+def test_authorize_into_an_empty_file_adds_no_leading_newline(tmp_path):
+    path = tmp_path / "authorized_keys"
+    path.write_bytes(b"")
+
+    authorize_public_key(_public_key(), path)
+
+    assert path.read_bytes() == _blob() + b"\n"
+
+
+def test_authorize_skips_a_key_already_present_under_other_options_and_comment(tmp_path):
+    path = tmp_path / "authorized_keys"
+    original = b'from="10.0.0.1" ' + _blob() + b" old comment\n"
+    path.write_bytes(original)
+
+    assert authorize_public_key(_public_key(), path, comment="new comment") is False
+
+    assert path.read_bytes() == original
+
+
+def test_authorize_only_matches_the_whole_key_blob_not_a_substring(tmp_path):
+    path = tmp_path / "authorized_keys"
+    key_blob = _blob().split()[1]
+    path.write_bytes(b"ssh-ed25519 " + key_blob + b"XYZ\n")
+
+    assert authorize_public_key(_public_key(), path) is True
+
+
+def test_authorize_keeps_an_existing_files_mode(tmp_path):
+    path = tmp_path / "authorized_keys"
+    path.write_bytes(b"")
+    path.chmod(0o640)
+
+    authorize_public_key(_public_key(), path)
+
+    assert stat.S_IMODE(path.stat().st_mode) == 0o640
+
+
+def test_authorize_outside_ssh_dir_needs_create_parent_dirs(monkeypatch, tmp_path):
+    monkeypatch.setenv("HOME", str(tmp_path))
+    path = tmp_path / "elsewhere" / "authorized_keys"
+
+    with pytest.raises(FileNotFoundError):
+        authorize_public_key(_public_key(), path)
+
+    assert authorize_public_key(_public_key(), path, create_parent_dirs=True) is True
+    assert stat.S_IMODE(path.parent.stat().st_mode) == 0o700
+
+
+def _invoke_recap(path):
+    @click.command()
+    def cmd():
+        authorize_and_recap(SEED, path, "c", recap=(("kdf", "pbkdf2"),))
+
+    return CliRunner().invoke(cmd)
+
+
+def test_authorize_and_recap_reports_the_added_line_then_the_recap(tmp_path):
+    path = tmp_path / "authorized_keys"
+
+    result = _invoke_recap(path)
+
+    assert result.exit_code == 0, result.output
+    assert result.output == (
+        f"Added public key to {path}:\n"
+        f"  {_blob().decode()} c\n"
+        "\n"
+        "To recreate this exact key, remember your passphrase (keep it secret) plus:\n"
+        "  kdf                pbkdf2\n"
+        "  algorithm          ed25519\n"
+    )
+
+
+def test_authorize_and_recap_says_when_the_key_was_already_there(tmp_path):
+    path = tmp_path / "authorized_keys"
+    path.write_bytes(_blob() + b"\n")
+
+    result = _invoke_recap(path)
+
+    assert result.output.splitlines()[:2] == [
+        f"Public key already in {path}, left it unchanged:",
+        f"  {_blob().decode()} c",
+    ]
+
+
+def test_authorize_and_recap_turns_os_errors_into_a_clean_message(tmp_path):
+    path = tmp_path / "authorized_keys"
+    path.mkdir()
+
+    result = _invoke_recap(path)
+
+    assert result.exit_code == 1
+    assert result.exc_info[0] is SystemExit
+    assert result.output == f"Error: couldn't write {path}: Is a directory\n"
+
+
+def test_flag_mode_authorizes_the_same_public_key_a_full_run_writes(monkeypatch, tmp_path):
+    monkeypatch.setenv("HOME", str(tmp_path))
+    pair = tmp_path / "pair" / "id_ed25519"
+
+    full = CliRunner().invoke(main, [*FLAG_RUN, "--output", str(pair), "--create-parent-dirs"])
+    authorized = CliRunner().invoke(main, [*FLAG_RUN, "--authorize"])
+
+    assert full.exit_code == 0, full.output
+    assert authorized.exit_code == 0, authorized.output
+    ssh_dir = tmp_path / ".ssh"
+    assert (ssh_dir / "authorized_keys").read_bytes() == (tmp_path / "pair" / "id_ed25519.pub").read_bytes()
+    assert sorted(p.name for p in ssh_dir.iterdir()) == ["authorized_keys"]
+    assert f"Added public key to {ssh_dir / 'authorized_keys'}:" in authorized.output
+    assert "Wrote private key" not in authorized.output
+
+
+def test_flag_mode_appends_to_an_existing_authorized_keys_without_asking(monkeypatch, tmp_path):
+    monkeypatch.setenv("HOME", str(tmp_path))
+    path = tmp_path / ".ssh" / "authorized_keys"
+    path.parent.mkdir()
+    path.write_bytes(b"ssh-rsa AAAA old\n")
+
+    result = CliRunner().invoke(main, [*FLAG_RUN, "--authorize", "--comment", "work"])
+
+    assert result.exit_code == 0, result.output
+    assert "Overwrite?" not in result.output
+    lines = path.read_bytes().splitlines()
+    assert lines[0] == b"ssh-rsa AAAA old"
+    assert lines[1].endswith(b" work")
+
+
+def test_flag_mode_expands_tilde_in_authorized_keys(monkeypatch, tmp_path):
+    monkeypatch.setenv("HOME", str(tmp_path))
+
+    result = CliRunner().invoke(
+        main, [*FLAG_RUN, "--authorize", "--authorized-keys", "~/.ssh/other_keys", "--create-parent-dirs"]
+    )
+
+    assert result.exit_code == 0, result.output
+    assert (tmp_path / ".ssh" / "other_keys").exists()
+
+
+def test_flag_mode_requires_create_parent_dirs_outside_ssh_dir(monkeypatch, tmp_path):
+    monkeypatch.setenv("HOME", str(tmp_path))
+    path = tmp_path / "srv" / "authorized_keys"
+
+    refused = CliRunner().invoke(main, [*FLAG_RUN, "--authorize", "--authorized-keys", str(path)])
+    allowed = CliRunner().invoke(
+        main, [*FLAG_RUN, "--authorize", "--authorized-keys", str(path), "--create-parent-dirs"]
+    )
+
+    assert refused.exit_code == 2
+    assert "~/srv doesn't exist. Pass --create-parent-dirs to create it." in refused.output
+    assert allowed.exit_code == 0, allowed.output
+    assert path.exists()
+
+
+def test_authorized_keys_needs_authorize(tmp_path):
+    result = CliRunner().invoke(main, [*FLAG_RUN, "--authorized-keys", str(tmp_path / "k")])
+
+    assert result.exit_code == 2
+    assert "Error: --authorized-keys needs --authorize" in result.output
+    assert "Deriving key" not in result.output
+
+
+@pytest.mark.parametrize(
+    ("extra", "message"),
+    [
+        (["--overwrite-files"], "--overwrite-files can't be used with --authorize: it only appends"),
+        (["--output", "k"], "--output can't be used with --authorize: no private key is written"),
+        (["--key-passphrase", "p"], "--key-passphrase can't be used with --authorize: no private key is written"),
+        (["--register", "a@b"], "--register can't be used with --authorize: no private key is written"),
+        (["--register-port", "22"], "--register-port can't be used with --authorize: no private key is written"),
+    ],
+)
+def test_authorize_rejects_keypair_only_flags_before_deriving(extra, message):
+    result = CliRunner().invoke(main, [*FLAG_RUN, "--authorize", *extra])
+
+    assert result.exit_code == 2
+    assert f"Error: {message}" in result.output
+    assert "Deriving key" not in result.output
+
+
+def _interactive_answers(*after_comment):
+    return (
+        "\n".join(
+            [
+                "s",  # seed passphrase
+                "s",  # ... confirmed
+                "work",  # label
+                "2",  # pbkdf2 iterations
+                "",  # salt digest size: default
+                "",  # comment
+                *after_comment,
+            ]
+        )
+        + "\n"
+    )
+
+
+def test_interactive_mode_question_defaults_to_generating_a_keypair(monkeypatch, tmp_path):
+    monkeypatch.setenv("HOME", str(tmp_path))
+    select, asked = _fake_select(GENERATE_MODE)
+    monkeypatch.setattr(questionary, "select", select)
+
+    CliRunner().invoke(main, [], input="\n")
+
+    assert asked[0] == ("What do you want to do?", (GENERATE_MODE, AUTHORIZE_MODE), GENERATE_MODE)
+    assert GENERATE_MODE == "Generate a keypair (private + public key)"
+    assert AUTHORIZE_MODE == "Only add the public key to an authorized_keys file"
+
+
+def test_interactive_authorize_skips_private_key_prompts_and_registration(monkeypatch, tmp_path):
+    monkeypatch.setenv("HOME", str(tmp_path))
+    select, _ = _fake_select(AUTHORIZE_MODE)
+    monkeypatch.setattr(questionary, "select", select)
+
+    result = CliRunner().invoke(main, [], input=_interactive_answers(""))
+
+    assert result.exit_code == 0, result.output
+    assert "authorized_keys file to add the public key to [~/.ssh/authorized_keys]: " in result.output
+    assert "Output path" not in result.output
+    assert "Passphrase to encrypt" not in result.output
+    assert "Register this key" not in result.output
+    path = tmp_path / ".ssh" / "authorized_keys"
+    assert path.read_bytes().startswith(b"ssh-ed25519 ")
+    assert sorted(p.name for p in path.parent.iterdir()) == ["authorized_keys"]
+
+
+def test_interactive_authorize_expands_tilde_and_asks_before_creating_parent_dirs(monkeypatch, tmp_path):
+    monkeypatch.setenv("HOME", str(tmp_path))
+    select, _ = _fake_select(AUTHORIZE_MODE)
+    monkeypatch.setattr(questionary, "select", select)
+
+    result = CliRunner().invoke(main, [], input=_interactive_answers("~/srv/authorized_keys", "y"))
+
+    assert result.exit_code == 0, result.output
+    assert "Warning: ~/srv is outside ~/.ssh." in result.output
+    assert (tmp_path / "srv" / "authorized_keys").exists()
+
+
+def test_authorize_flag_alone_stays_interactive_without_the_mode_question(monkeypatch, tmp_path):
+    monkeypatch.setenv("HOME", str(tmp_path))
+    select, asked = _fake_select(GENERATE_MODE)
+    monkeypatch.setattr(questionary, "select", select)
+
+    result = CliRunner().invoke(main, ["--authorize"], input=_interactive_answers(""))
+
+    assert result.exit_code == 0, result.output
+    assert [message for message, _, _ in asked] == ["KDF backend", "Salt hash algorithm"]
+    assert (tmp_path / ".ssh" / "authorized_keys").exists()
+    assert not (tmp_path / ".ssh" / "id_ed25519").exists()
+
+
+def test_authorized_keys_flag_skips_its_prompt_in_interactive_mode(monkeypatch, tmp_path):
+    monkeypatch.setenv("HOME", str(tmp_path))
+    select, _ = _fake_select(GENERATE_MODE)
+    monkeypatch.setattr(questionary, "select", select)
+    path = tmp_path / "keys"
+
+    result = CliRunner().invoke(main, ["--authorize", "--authorized-keys", str(path)], input=_interactive_answers())
+
+    assert result.exit_code == 0, result.output
+    assert "authorized_keys file to add" not in result.output
+    assert path.exists()
+
+
+def test_authorize_creates_every_missing_parent_level(tmp_path):
+    path = tmp_path / "a" / "b" / "authorized_keys"
+
+    assert authorize_public_key(_public_key(), path, create_parent_dirs=True) is True
+    assert path.exists()
+
+
+def test_authorize_and_recap_does_not_create_parent_dirs_unless_asked(monkeypatch, tmp_path):
+    monkeypatch.setenv("HOME", str(tmp_path))
+    path = tmp_path / "missing" / "authorized_keys"
+
+    result = _invoke_recap(path)
+
+    assert result.exit_code == 1
+    assert result.output == f"Error: couldn't write {path}: No such file or directory\n"
+
+
+def test_authorized_keys_flag_rejects_a_directory(tmp_path):
+    result = CliRunner().invoke(main, [*FLAG_RUN, "--authorize", "--authorized-keys", str(tmp_path)])
+
+    assert result.exit_code == 2
+    assert "is a directory" in result.output
+
+
+def test_interactive_authorized_keys_prompt_rejects_a_directory(monkeypatch, tmp_path):
+    monkeypatch.setenv("HOME", str(tmp_path))
+    select, _ = _fake_select(AUTHORIZE_MODE)
+    monkeypatch.setattr(questionary, "select", select)
+    path = tmp_path / "keys"
+
+    result = CliRunner().invoke(main, [], input=_interactive_answers(str(tmp_path), str(path)))
+
+    assert result.exit_code == 0, result.output
+    assert "is a directory" in result.output
+    assert path.exists()

{detssh-0.6.0 → detssh-0.7.0}/uv.lock

@@ -386,7 +386,7 @@ wheels = [
 
 [[package]]
 name = "detssh"
-version = "0.6.0"
+version = "0.7.0"
 source = { editable = "." }
 dependencies = [
     { name = "argon2-cffi" },