headquarter/openspec/specs/ssh-keys/spec.md

SSH Key Management Specification

Purpose

Generate and manage SSH keys for git operations with external providers.

Requirements

Requirement: Key Generation

The system SHALL generate Ed25519 SSH key pairs.

Scenario: Generate key

• GIVEN an authenticated user
• WHEN they request a new SSH key
• THEN an Ed25519 key pair is generated
• AND the private key is encrypted with Fernet
• AND the public key is stored in OpenSSH format

Requirement: Key Association

The system SHALL only allow project default-key assignment using keys valid for the authenticated owner's project scope.

Scenario: Valid default key assignment

• GIVEN a project owner and an eligible SSH key
• WHEN the owner sets the key as default for the project
• THEN the project stores that key reference

Scenario: Invalid default key assignment

• GIVEN a project owner
• WHEN the owner attempts to set an ineligible SSH key as project default
• THEN the system responds with validation failure

Requirement: Key Display

The system SHALL display public keys for copying.

Scenario: Copy public key

• GIVEN an authenticated user
• WHEN they view their SSH keys
• THEN each public key is displayed in OpenSSH format
• AND a copy button is available

Requirement: Key Deletion

The system SHALL support key removal.

Scenario: Delete key

• GIVEN an authenticated user
• WHEN they delete an SSH key
• THEN it's removed from the database
• AND the key files are deleted

Dependencies

• Database models: SSHKey, User, Project
• cryptography library for key generation

Quality Gates

• pytest must pass
• mypy . must pass
• ruff check . must pass
• npm run typecheck must pass
• npm run lint must pass