[SalimKayal]

Summary

Exposes the SSH public key store over the data-services API: GET/POST /user/ssh_keys and GET/DELETE /user/ssh_keys/{key_id}. Users can register, list, and revoke their own keys. Second PR of the three-PR SSH stack; the internal proxy endpoints follow in #1446 .

Motivation and context

#1442 added the storage foundation but nothing could reach it. This PR is the user-facing surface that lets a user manage the keys the SSH gateway will authenticate them with. Keys belong to the authenticated user, so every route is owner-scoped at the SQL level.

Behavior

• GET /user/ssh_keys lists the caller's keys; POST /user/ssh_keys registers one (201).
• GET /user/ssh_keys/{key_id} returns one key; DELETE /user/ssh_keys/{key_id} removes it (204, idempotent).
• Registering a malformed/unsupported key is 422; an already-registered fingerprint is 409; a key that isn't the caller's is indistinguishable from one that doesn't exist (404).
• public_key is canonicalized (comment stripped) and fingerprinted as ssh-keygen -l reports, so the stored fingerprint is display-ready.

Changes

• components/renku_data_services/users/api.spec.yaml: new /user/ssh_keys and /user/ssh_keys/{key_id} paths; SSHKey, SSHKeyPost (with maxLength: 256 on name), SSHKeysList schemas.
• components/renku_data_services/users/apispec.py: regenerated with the pinned datamodel-code-generator 0.57.0 (see Notes).
• components/renku_data_services/users/blueprints.py: SSHKeysBP, modeled on UserSecretsBP, delegating to SSHKeyRepository and validate_unsaved_ssh_key.
• bases/renku_data_services/data_api/{app.py,dependencies.py}: construct and wire SSHKeyRepository; register the blueprint.
• test/utils.py: TestDependencyManager passes the new ssh_key_repo field.
• test/bases/renku_data_services/data_api/test_ssh_keys.py: CRUD, 409 duplicate, 404/204 missing id, 422 malformed and overlong name, 401 unauthenticated, cross-user scoping.

Notes

• No PATCH/replace endpoint: replace is delete + create.

---

PR Stack

• feat: add support for ssh pubkeys storing / validating / retrieving  #1441
  • feat(users): store ssh keys #1442
    • feat(users): add /user/ssh_keys CRUD API #1444 ◀️ this PR
      • feat: proxy api for ssh keys #1446
        • feat: ssh proxy service account authn #1448
          • feat(notebooks): configure proxy-to-session key secret names #1452
            • Add frontend variant as session label #1455
              • feat(notebooks): mount proxy-to-session keys only for ssh frontends #1458

[coveralls]

Coverage Report for CI Build 36726908623

Warning

Build has drifted: This PR's base is out of sync with its target branch, so coverage data may include unrelated changes.
Quick fix: rebase this PR. Learn more →

Warning

No base build found for commit e04664f on salimkayal/feat/ssh-keys.
Coverage changes can't be calculated without a base build.
If a base build is processing, this comment will update automatically when it completes.

Coverage: 85.296%

Details

• Patch coverage: 91 of 91 lines across 4 files are fully covered (100%).

Uncovered Changes

No uncovered changes found.

Coverage Regressions

Requires a base build to compare against. How to fix this →

---

Coverage Stats

Relevant Lines:	34658
Covered Lines:	29562
Line Coverage:	85.3%
Coverage Strength:	1.48 hits per line

---

💛 - Coveralls