Add SSH-managed node registry with connection testing and reauth.

Register hosts under Containers/VMs/Docker with encrypted key storage, and require re-authentication for sensitive account changes.

service/internal/auth/sshkey_test.go

@@ -0,0 +1,63 @@
+package auth
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestGenerateSSHKeyEd25519(t *testing.T) {
+	generated, err := GenerateSSHKey(SSHKeyAlgoEd25519, 0, 100)
+	if err != nil {
+		t.Fatalf("GenerateSSHKey: %v", err)
+	}
+	if generated.Algorithm != SSHKeyAlgoEd25519 {
+		t.Fatalf("algorithm = %q", generated.Algorithm)
+	}
+	if generated.KDFRounds != 100 {
+		t.Fatalf("kdf rounds = %d", generated.KDFRounds)
+	}
+	if !strings.Contains(generated.PrivateKeyPEM, "BEGIN OPENSSH PRIVATE KEY") {
+		t.Fatal("expected openssh private key")
+	}
+	if !strings.HasPrefix(generated.PublicKey, "ssh-ed25519 ") {
+		t.Fatalf("public key = %q", generated.PublicKey)
+	}
+
+	parsed, err := ParseSSHPrivateKey(generated.PrivateKeyPEM)
+	if err != nil {
+		t.Fatalf("ParseSSHPrivateKey: %v", err)
+	}
+	if parsed.PublicKey != generated.PublicKey {
+		t.Fatalf("parsed public key mismatch")
+	}
+}
+
+func TestGenerateSSHKeyRSABits(t *testing.T) {
+	generated, err := GenerateSSHKey(SSHKeyAlgoRSA, 2048, 0)
+	if err != nil {
+		t.Fatalf("GenerateSSHKey: %v", err)
+	}
+	if generated.RSABits != 2048 {
+		t.Fatalf("rsa bits = %d", generated.RSABits)
+	}
+	if !strings.HasPrefix(generated.PublicKey, "ssh-rsa ") {
+		t.Fatalf("public key = %q", generated.PublicKey)
+	}
+}
+
+func TestGenerateSSHKeyRejectsInvalidRSABits(t *testing.T) {
+	_, err := GenerateSSHKey(SSHKeyAlgoRSA, 1024, 0)
+	if err == nil {
+		t.Fatal("expected error")
+	}
+}
+
+func TestNewUUIDFormat(t *testing.T) {
+	value, err := NewUUID()
+	if err != nil {
+		t.Fatalf("NewUUID: %v", err)
+	}
+	if len(value) != 36 {
+		t.Fatalf("uuid length = %d", len(value))
+	}
+}