39 lines
1.1 KiB
PHP
39 lines
1.1 KiB
PHP
<?php
|
|
|
|
namespace App\Support\Ssh;
|
|
|
|
use App\Models\Server;
|
|
use phpseclib3\Crypt\Common\AsymmetricKey;
|
|
use phpseclib3\Crypt\PublicKeyLoader;
|
|
use RuntimeException;
|
|
|
|
/**
|
|
* Resolves a server's stored SSH credential into a usable phpseclib login
|
|
* secret. Encryption-at-rest is handled by the SshCredential model
|
|
* ('encrypted' casts via APP_KEY); this class never logs the secret.
|
|
*/
|
|
class CredentialVault
|
|
{
|
|
/**
|
|
* @return array{username: string, secret: AsymmetricKey|string}
|
|
*/
|
|
public function resolve(Server $server): array
|
|
{
|
|
$cred = $server->credential;
|
|
|
|
if (! $cred) {
|
|
throw new RuntimeException(__('backend.no_ssh_credential', ['server' => $server->name]));
|
|
}
|
|
|
|
if ($cred->disabled_at !== null) {
|
|
throw new RuntimeException(__('backend.ssh_access_locked', ['server' => $server->name]));
|
|
}
|
|
|
|
$secret = $cred->auth_type === 'key'
|
|
? PublicKeyLoader::load($cred->secret, $cred->passphrase ?: false)
|
|
: $cred->secret; // password auth
|
|
|
|
return ['username' => $cred->username, 'secret' => $secret];
|
|
}
|
|
}
|