Integrated code lifecycle: Support multiple SSH keys per user

src/main/java/de/tum/cit/aet/artemis/core/web/AccountResource.java

@@ -7,8 +7,8 @@
 import java.net.URISyntaxException;
 import java.nio.file.Path;
 import java.security.GeneralSecurityException;
-import java.security.PublicKey;
 import java.time.ZonedDateTime;
+import java.util.List;
 import java.util.Optional;
 
 import jakarta.validation.Valid;
@@ -45,8 +45,9 @@
 import de.tum.cit.aet.artemis.core.service.FileService;
 import de.tum.cit.aet.artemis.core.service.user.UserCreationService;
 import de.tum.cit.aet.artemis.core.service.user.UserService;
+import de.tum.cit.aet.artemis.programming.domain.UserSshPublicKey;
+import de.tum.cit.aet.artemis.programming.service.UserSshPublicKeyService;
 import de.tum.cit.aet.artemis.programming.service.localvc.LocalVCPersonalAccessTokenManagementService;
-import de.tum.cit.aet.artemis.programming.service.localvc.ssh.HashUtils;
 
 /**
  * REST controller for managing the current user's account.
@@ -67,6 +68,8 @@ public class AccountResource {
 
     private final UserService userService;
 
+    private final UserSshPublicKeyService userSshPublicKeyService;
+
     private final UserCreationService userCreationService;
 
     private final AccountService accountService;
@@ -75,13 +78,14 @@ public class AccountResource {
 
     private static final float MAX_PROFILE_PICTURE_FILESIZE_IN_MEGABYTES = 0.1f;
 
-    public AccountResource(UserRepository userRepository, UserService userService, UserCreationService userCreationService, AccountService accountService,
-            FileService fileService) {
+    public AccountResource(UserRepository userRepository, UserService userService, UserCreationService userCreationService, AccountService accountService, FileService fileService,
+            UserSshPublicKeyService userSSHPublicKeyService) {
         this.userRepository = userRepository;
         this.userService = userService;
         this.userCreationService = userCreationService;
         this.accountService = accountService;
         this.fileService = fileService;
+        this.userSshPublicKeyService = userSSHPublicKeyService;
     }
 
     /**
@@ -132,6 +136,32 @@ public ResponseEntity<Void> changePassword(@RequestBody PasswordChangeDTO passwo
         return ResponseEntity.ok().build();
     }
 
+    /**
+     * GET account/ssh-public-keys : sets the ssh public key
+     *
+     * @return the ResponseEntity containing all public SSH keys of a user with status 200 (OK), or with status 400 (Bad Request)
+     */
+    @GetMapping("account/ssh-public-keys")
+    @EnforceAtLeastStudent
+    public ResponseEntity<List<UserSshPublicKey>> getSshPublicKey() {
+        User user = userRepository.getUser();
+        List<UserSshPublicKey> keys = userSshPublicKeyService.getAllSshKeysForUser(user);
+        return ResponseEntity.ok(keys);
+    }
+
+    /**
+     * GET account/ssh-public-key : sets the ssh public key
+     *
+     * @return the ResponseEntity containing the requested public SSH key of a user with status 200 (OK), or with status 400 (Bad Request)
+     */
+    @GetMapping("account/ssh-public-key")
+    @EnforceAtLeastStudent
+    public ResponseEntity<UserSshPublicKey> getSshPublicKey(@RequestParam("keyId") Long keyId) {
+        User user = userRepository.getUser();
+        UserSshPublicKey key = userSshPublicKeyService.getSshKeyForUser(user, keyId);
+        return ResponseEntity.ok(key);
+    }
+
     /**
      * PUT account/ssh-public-key : sets the ssh public key
      *
@@ -141,22 +171,21 @@ public ResponseEntity<Void> changePassword(@RequestBody PasswordChangeDTO passwo
      */
     @PutMapping("account/ssh-public-key")
     @EnforceAtLeastStudent
-    public ResponseEntity<Void> addSshPublicKey(@RequestBody String sshPublicKey) throws GeneralSecurityException, IOException {
+    public ResponseEntity<Void> addSshPublicKey(@RequestBody UserSshPublicKey sshPublicKey) throws GeneralSecurityException, IOException {
 
         User user = userRepository.getUser();
         log.debug("REST request to add SSH key to user {}", user.getLogin());
         // Parse the public key string
         AuthorizedKeyEntry keyEntry;
         try {
-            keyEntry = AuthorizedKeyEntry.parseAuthorizedKeyEntry(sshPublicKey);
+            keyEntry = AuthorizedKeyEntry.parseAuthorizedKeyEntry(sshPublicKey.getPublicKey());
         }
         catch (IllegalArgumentException e) {
             throw new BadRequestAlertException("Invalid SSH key format", "SSH key", "invalidKeyFormat", true);
         }
         // Extract the PublicKey object
-        PublicKey publicKey = keyEntry.resolvePublicKey(null, null, null);
-        String keyHash = HashUtils.getSha512Fingerprint(publicKey);
-        userRepository.updateUserSshPublicKeyHash(user.getId(), keyHash, sshPublicKey);
+        userSshPublicKeyService.createSshKeyForUser(user, keyEntry, sshPublicKey);
+        // userRepository.updateUserSshPublicKeyHash(user.getId(), keyHash, sshPublicKey);
         return ResponseEntity.ok().build();
     }
 
@@ -167,12 +196,12 @@ public ResponseEntity<Void> addSshPublicKey(@RequestBody String sshPublicKey) th
      */
     @DeleteMapping("account/ssh-public-key")
     @EnforceAtLeastStudent
-    public ResponseEntity<Void> deleteSshPublicKey() {
+    public ResponseEntity<Void> deleteSshPublicKey(@RequestParam("keyId") Long keyId) {
         User user = userRepository.getUser();
         log.debug("REST request to remove SSH key of user {}", user.getLogin());
-        userRepository.updateUserSshPublicKeyHash(user.getId(), null, null);
+        userSshPublicKeyService.deleteUserSshPublicKey(user.getId(), keyId);
 
-        log.debug("Successfully deleted SSH key of user {}", user.getLogin());
+        log.debug("Successfully deleted SSH key with id {} of user {}", keyId, user.getLogin());
         return ResponseEntity.ok().build();
     }
 

src/main/java/de/tum/cit/aet/artemis/programming/domain/UserSshPublicKey.java

@@ -0,0 +1,131 @@
+package de.tum.cit.aet.artemis.programming.domain;
+
+import java.time.ZonedDateTime;
+
+import jakarta.annotation.Nullable;
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.Table;
+import jakarta.validation.constraints.NotNull;
+import jakarta.validation.constraints.Size;
+
+import org.hibernate.annotations.Cache;
+import org.hibernate.annotations.CacheConcurrencyStrategy;
+
+import de.tum.cit.aet.artemis.core.domain.DomainObject;
+
+/**
+ * A public SSH key of a user.
+ */
+@Entity
+@Table(name = "user_public_ssh_key")
+@Cache(usage = CacheConcurrencyStrategy.NONSTRICT_READ_WRITE)
+public class UserSshPublicKey extends DomainObject {
+
+    /**
+     * The user who is owner of the public key
+     */
+    @NotNull
+    @Column(name = "user_id")
+    private Long userId;
+
+    /**
+     * The label of the SSH key shwon in the UI
+     */
+    @Size(max = 50)
+    @Column(name = "label", length = 50)
+    private String label;
+
+    /**
+     * The actual full public ssh key of a user used to authenticate git clone and git push operations if available
+     */
+    @Column(name = "public_key")
+    private String publicKey;
+
+    /**
+     * A hash of the public ssh key for fast comparison in the database (with an index)
+     */
+    @Nullable
+    @Size(max = 100)
+    @Column(name = "key_hash")
+    private String keyHash;
+
+    /**
+     * The expiry date of the public SSH key
+     */
+    @Column(name = "creation_date")
+    private ZonedDateTime creationDate = null;
+
+    /**
+     * The expiry date of the public SSH key
+     */
+    @Nullable
+    @Column(name = "last_used_date")
+    private ZonedDateTime lastUsedDate = null;
+
+    /**
+     * The expiry date of the public SSH key
+     */
+    @Nullable
+    @Column(name = "expiry_date")
+    private ZonedDateTime expiryDate = null;
+
+    public @NotNull Long getUserId() {
+        return userId;
+    }
+
+    public void setUserId(@NotNull Long userId) {
+        this.userId = userId;
+    }
+
+    public @Size(max = 50) String getLabel() {
+        return label;
+    }
+
+    public void setLabel(@Size(max = 50) String label) {
+        this.label = label;
+    }
+
+    public String getPublicKey() {
+        return publicKey;
+    }
+
+    public void setPublicKey(String publicKey) {
+        this.publicKey = publicKey;
+    }
+
+    @Nullable
+    public @Size(max = 100) String getKeyHash() {
+        return keyHash;
+    }
+
+    public void setKeyHash(@Nullable @Size(max = 100) String keyHash) {
+        this.keyHash = keyHash;
+    }
+
+    public ZonedDateTime getCreationDate() {
+        return creationDate;
+    }
+
+    public void setCreationDate(ZonedDateTime creationDate) {
+        this.creationDate = creationDate;
+    }
+
+    @Nullable
+    public ZonedDateTime getLastUsedDate() {
+        return lastUsedDate;
+    }
+
+    public void setLastUsedDate(@Nullable ZonedDateTime lastUsedDate) {
+        this.lastUsedDate = lastUsedDate;
+    }
+
+    @Nullable
+    public ZonedDateTime getExpiryDate() {
+        return expiryDate;
+    }
+
+    public void setExpiryDate(@Nullable ZonedDateTime expiryDate) {
+        this.expiryDate = expiryDate;
+    }
+}

src/main/java/de/tum/cit/aet/artemis/programming/repository/UserPublicSshKeyRepository.java

@@ -0,0 +1,21 @@
+package de.tum.cit.aet.artemis.programming.repository;
+
+import static de.tum.cit.aet.artemis.core.config.Constants.PROFILE_CORE;
+
+import java.util.List;
+import java.util.Optional;
+
+import org.springframework.context.annotation.Profile;
+import org.springframework.stereotype.Repository;
+
+import de.tum.cit.aet.artemis.core.repository.base.ArtemisJpaRepository;
+import de.tum.cit.aet.artemis.programming.domain.UserSshPublicKey;
+
+@Profile(PROFILE_CORE)
+@Repository
+public interface UserPublicSshKeyRepository extends ArtemisJpaRepository<UserSshPublicKey, Long> {
+
+    List<UserSshPublicKey> findAllByUserId(Long userId);
+
+    Optional<UserSshPublicKey> findByKeyHash(String keyHash);
+}

src/main/java/de/tum/cit/aet/artemis/programming/service/UserSshPublicKeyService.java

@@ -0,0 +1,76 @@
+package de.tum.cit.aet.artemis.programming.service;
+
+import static de.tum.cit.aet.artemis.core.config.Constants.PROFILE_CORE;
+
+import java.io.IOException;
+import java.security.GeneralSecurityException;
+import java.security.PublicKey;
+import java.time.ZonedDateTime;
+import java.util.List;
+import java.util.Objects;
+
+import org.apache.sshd.common.config.keys.AuthorizedKeyEntry;
+import org.springframework.context.annotation.Profile;
+import org.springframework.stereotype.Service;
+
+import de.tum.cit.aet.artemis.core.domain.User;
+import de.tum.cit.aet.artemis.core.exception.AccessForbiddenException;
+import de.tum.cit.aet.artemis.core.exception.BadRequestAlertException;
+import de.tum.cit.aet.artemis.core.exception.EntityNotFoundException;
+import de.tum.cit.aet.artemis.programming.domain.UserSshPublicKey;
+import de.tum.cit.aet.artemis.programming.repository.UserPublicSshKeyRepository;
+import de.tum.cit.aet.artemis.programming.service.localvc.ssh.HashUtils;
+
+@Profile(PROFILE_CORE)
+@Service
+public class UserSshPublicKeyService {
+
+    private final UserPublicSshKeyRepository userPublicSshKeyRepository;
+
+    public UserSshPublicKeyService(UserPublicSshKeyRepository userPublicSshKeyRepository) {
+        this.userPublicSshKeyRepository = userPublicSshKeyRepository;
+    }
+
+    public void createSshKeyForUser(User user, AuthorizedKeyEntry keyEntry, UserSshPublicKey sshPublicKey) throws GeneralSecurityException, IOException {
+        PublicKey publicKey = keyEntry.resolvePublicKey(null, null, null);
+        String keyHash = HashUtils.getSha512Fingerprint(publicKey);
+
+        if (userPublicSshKeyRepository.findByKeyHash(keyHash).isPresent()) {
+            throw new BadRequestAlertException("Invalid SSH key format", "SSH key", "invalidKeyFormat", true);
+        }
+
+        UserSshPublicKey newUserSshPublicKey = new UserSshPublicKey();
+        newUserSshPublicKey.setUserId(user.getId());
+        newUserSshPublicKey.setLabel(sshPublicKey.getLabel());
+        newUserSshPublicKey.setPublicKey(sshPublicKey.getPublicKey());
+        newUserSshPublicKey.setKeyHash(keyHash);
+        newUserSshPublicKey.setExpiryDate(sshPublicKey.getExpiryDate());
+        newUserSshPublicKey.setCreationDate(ZonedDateTime.now());
+        newUserSshPublicKey.setExpiryDate(sshPublicKey.getExpiryDate());
+        userPublicSshKeyRepository.save(newUserSshPublicKey);
+    }
+
+    public UserSshPublicKey getSshKeyForUser(User user, Long keyId) {
+        var userSshPublicKey = userPublicSshKeyRepository.findByIdElseThrow(keyId);
+        if (Objects.equals(userSshPublicKey.getUserId(), user.getId())) {
+            return userSshPublicKey;
+        }
+        else {
+            throw new EntityNotFoundException();
+        }
+    }
+
+    public List<UserSshPublicKey> getAllSshKeysForUser(User user) {
+        return userPublicSshKeyRepository.findAllByUserId(user.getId());
+    }
+
+    public void deleteUserSshPublicKey(Long userId, Long keyId) {
+        var keys = userPublicSshKeyRepository.findAllByUserId(userId);
+        if (!keys.isEmpty() && keys.stream().map(UserSshPublicKey::getId).toList().contains(keyId)) {
+            userPublicSshKeyRepository.deleteById(keyId);
+        }
+        else {
+            throw new AccessForbiddenException("SSH key", keyId);
+        }
+    }
+}

src/main/java/de/tum/cit/aet/artemis/programming/service/localvc/GitPublickeyAuthenticatorService.java

@@ -18,6 +18,7 @@
 
 import de.tum.cit.aet.artemis.buildagent.dto.BuildAgentInformation;
 import de.tum.cit.aet.artemis.core.repository.UserRepository;
+import de.tum.cit.aet.artemis.programming.repository.UserPublicSshKeyRepository;
 import de.tum.cit.aet.artemis.programming.service.localci.SharedQueueManagementService;
 import de.tum.cit.aet.artemis.programming.service.localvc.ssh.HashUtils;
 import de.tum.cit.aet.artemis.programming.service.localvc.ssh.SshConstants;
@@ -32,19 +33,27 @@ public class GitPublickeyAuthenticatorService implements PublickeyAuthenticator
 
     private final Optional<SharedQueueManagementService> localCIBuildJobQueueService;
 
-    public GitPublickeyAuthenticatorService(UserRepository userRepository, Optional<SharedQueueManagementService> localCIBuildJobQueueService) {
+    private final UserPublicSshKeyRepository userPublicSshKeyRepository;
+
+    public GitPublickeyAuthenticatorService(UserRepository userRepository, Optional<SharedQueueManagementService> localCIBuildJobQueueService,
+            UserPublicSshKeyRepository userPublicSshKeyRepository) {
         this.userRepository = userRepository;
         this.localCIBuildJobQueueService = localCIBuildJobQueueService;
+        this.userPublicSshKeyRepository = userPublicSshKeyRepository;
     }
 
     @Override
     public boolean authenticate(String username, PublicKey publicKey, ServerSession session) {
         String keyHash = HashUtils.getSha512Fingerprint(publicKey);
-        var user = userRepository.findBySshPublicKeyHash(keyHash);
+        var userSshPublicKey = userPublicSshKeyRepository.findByKeyHash(keyHash);
+        if (userSshPublicKey.isEmpty()) {
+            return false;
+        }
+        var user = userRepository.findById(userSshPublicKey.get().getUserId());
         if (user.isPresent()) {
             try {
                 // Retrieve the stored public key string
-                String storedPublicKeyString = user.get().getSshPublicKey();
+                String storedPublicKeyString = userSshPublicKey.get().getPublicKey();
 
                 // Parse the stored public key string
                 AuthorizedKeyEntry keyEntry = AuthorizedKeyEntry.parseAuthorizedKeyEntry(storedPublicKeyString);