From a5c518822b3f6645302ec29657537f87554f2b77 Mon Sep 17 00:00:00 2001
From: boban <boban@git.bave.dev>
Date: Sun, 14 Jun 2026 10:30:07 +0200
Subject: [PATCH] feat(servers): hint that disabling password login leaves
 key-only access
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds a muted one-line hint on the SSH-Passwort-Login checklist row while
password auth is still on, so the operator knows access becomes SSH-key only
(and to deposit a key first) before toggling — mirroring the lockout guard.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 lang/de/servers.php                           |  1 +
 lang/en/servers.php                           |  1 +
 .../views/livewire/servers/show.blade.php     |  4 ++
 tests/Feature/ServerShowSshHintTest.php       | 38 +++++++++++++++++++
 4 files changed, 44 insertions(+)
 create mode 100644 tests/Feature/ServerShowSshHintTest.php

diff --git a/lang/de/servers.php b/lang/de/servers.php
index 2fad059..65fb2e4 100644
--- a/lang/de/servers.php
+++ b/lang/de/servers.php
@@ -11,6 +11,7 @@ return [
     'status_warning' => 'Warnung',
     'status_offline' => 'Offline',
     'status_pending' => 'Initialisierung',
+    'ssh_key_only_hint' => 'Nach dem Deaktivieren ist der Zugang nur per SSH-Key möglich — Key zuerst hinterlegen.',
 
     // ── Index: header ─────────────────────────────────────────────────────
     'fleet_eyebrow' => 'Flotte',
diff --git a/lang/en/servers.php b/lang/en/servers.php
index 84f59c6..daefc42 100644
--- a/lang/en/servers.php
+++ b/lang/en/servers.php
@@ -11,6 +11,7 @@ return [
     'status_warning' => 'Warning',
     'status_offline' => 'Offline',
     'status_pending' => 'Initializing',
+    'ssh_key_only_hint' => 'After disabling, access is SSH-key only — deposit a key first.',
 
     // ── Index: header ─────────────────────────────────────────────────────
     'fleet_eyebrow' => 'Fleet',
diff --git a/resources/views/livewire/servers/show.blade.php b/resources/views/livewire/servers/show.blade.php
index bce8f19..5ad384a 100644
--- a/resources/views/livewire/servers/show.blade.php
+++ b/resources/views/livewire/servers/show.blade.php
@@ -211,6 +211,10 @@
                                     @endif
                                 </p>
                                 <p class="truncate font-mono text-[11px] text-ink-3">{{ $supported ? $check['detail'] : $check['reason'] }}</p>
+                                {{-- Key-only warning: disabling password login leaves SSH-key access only. --}}
+                                @if ($supported && $check['key'] === 'ssh_password' && $check['featureOn'])
+                                    <p class="mt-0.5 font-mono text-[11px] text-ink-4">{{ __('servers.ssh_key_only_hint') }}</p>
+                                @endif
                             </div>
                             @if ($supported)
                                 @if ($check['key'] === 'fail2ban')
diff --git a/tests/Feature/ServerShowSshHintTest.php b/tests/Feature/ServerShowSshHintTest.php
new file mode 100644
index 0000000..ad1e61e
--- /dev/null
+++ b/tests/Feature/ServerShowSshHintTest.php
@@ -0,0 +1,38 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Livewire\Servers\Show;
+use App\Models\Server;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Features\SupportTesting\Testable;
+use Livewire\Livewire;
+use Tests\TestCase;
+
+class ServerShowSshHintTest extends TestCase
+{
+    use RefreshDatabase;
+
+    private function show(array $hardening): Testable
+    {
+        $this->actingAs(User::factory()->create());
+        $server = Server::create(['name' => 's', 'ip' => '10.0.0.9', 'ssh_port' => 22, 'status' => 'online']);
+
+        return Livewire::test(Show::class, ['server' => $server])->set('ready', true)->set('hardening', $hardening);
+    }
+
+    public function test_key_only_hint_shown_when_password_login_on(): void
+    {
+        $this->show([
+            ['key' => 'ssh_password', 'label' => 'SSH-Passwort-Login', 'detail' => 'PasswordAuthentication yes', 'featureOn' => true, 'secure' => false, 'supported' => true, 'reason' => null, 'neutral' => false],
+        ])->assertSee(__('servers.ssh_key_only_hint'));
+    }
+
+    public function test_key_only_hint_hidden_when_password_login_off(): void
+    {
+        $this->show([
+            ['key' => 'ssh_password', 'label' => 'SSH-Passwort-Login', 'detail' => 'PasswordAuthentication no', 'featureOn' => false, 'secure' => true, 'supported' => true, 'reason' => null, 'neutral' => false],
+        ])->assertDontSee(__('servers.ssh_key_only_hint'));
+    }
+}