feat: SSH代理支持公钥认证（入站密钥免密登录）

- proxy.go: ServerConfig 添加 PublicKeyCallback
- resolver.go: 新增 ResolveContainerByPublicKey 方法
  通过 host short ID + 客户端公钥匹配 DB 中的入站密钥
- resolverRepo 接口新增 ListSSHKeysByUserAndPurpose
- 公钥认证和密码认证并存，客户端可以用任一方式登录

Made-with: Cursor

Author: ZaneL1u

internal/sshproxy/proxy.go

@@ -18,10 +18,9 @@ import (
 	"golang.org/x/crypto/ssh"
 )
 
-// ContainerResolver maps an SSH login (host_short_id + entry_password)
-// to the target container's SSH address and credentials.
 type ContainerResolver interface {
 	ResolveContainer(ctx context.Context, hostShortID, password string) (ContainerTarget, error)
+	ResolveContainerByPublicKey(ctx context.Context, hostShortID string, clientKey ssh.PublicKey) (ContainerTarget, error)
 }
 
 type Server struct {
@@ -114,7 +113,24 @@ func (s *Server) ListenAndServe(ctx context.Context) error {
 
 			target, err := s.resolver.ResolveContainer(authCtx, conn.User(), string(password))
 			if err != nil {
-				s.logger.Debug("SSH auth failed", "user", conn.User(), "remote", conn.RemoteAddr(), "reason", err)
+				s.logger.Debug("SSH password auth failed", "user", conn.User(), "remote", conn.RemoteAddr(), "reason", err)
+				return nil, fmt.Errorf("auth failed")
+			}
+			return &ssh.Permissions{
+				Extensions: map[string]string{
+					"target_addr":     target.Addr,
+					"target_user":     target.User,
+					"target_password": target.Password,
+				},
+			}, nil
+		},
+		PublicKeyCallback: func(conn ssh.ConnMetadata, key ssh.PublicKey) (*ssh.Permissions, error) {
+			authCtx, cancel := context.WithTimeout(ctx, 10*time.Second)
+			defer cancel()
+
+			target, err := s.resolver.ResolveContainerByPublicKey(authCtx, conn.User(), key)
+			if err != nil {
+				s.logger.Debug("SSH pubkey auth failed", "user", conn.User(), "remote", conn.RemoteAddr(), "reason", err)
 				return nil, fmt.Errorf("auth failed")
 			}
 			return &ssh.Permissions{

internal/sshproxy/resolver.go

@@ -7,23 +7,22 @@ import (
 	"os/exec"
 	"strings"
 
+	gossh "golang.org/x/crypto/ssh"
+
 	"github.com/zanel1u/cloud-cli-proxy/internal/store/repository"
 )
 
 type resolverRepo interface {
 	GetHostByShortID(ctx context.Context, shortID string) (repository.HostSSHAuth, error)
+	ListSSHKeysByUserAndPurpose(ctx context.Context, userID, purpose string) ([]repository.SSHKey, error)
 }
 
-// ContainerTarget is the SSH endpoint and credentials for dialing the user container.
 type ContainerTarget struct {
 	Addr     string
 	User     string
 	Password string
 }
 
-// RepoResolver implements ContainerResolver using the database repository.
-// It validates the host's entry_password, checks that the owning user is
-// active and the host is running, then resolves the container's SSH address.
 type RepoResolver struct {
 	repo resolverRepo
 }
@@ -42,10 +41,43 @@ func (r *RepoResolver) ResolveContainer(ctx context.Context, hostShortID, passwo
 		return ContainerTarget{}, fmt.Errorf("invalid credentials")
 	}
 
+	return r.resolveTarget(ctx, auth)
+}
+
+func (r *RepoResolver) ResolveContainerByPublicKey(ctx context.Context, hostShortID string, clientKey gossh.PublicKey) (ContainerTarget, error) {
+	auth, err := r.repo.GetHostByShortID(ctx, hostShortID)
+	if err != nil {
+		return ContainerTarget{}, fmt.Errorf("host not found")
+	}
+
+	inboundKeys, err := r.repo.ListSSHKeysByUserAndPurpose(ctx, auth.UserID, "inbound")
+	if err != nil || len(inboundKeys) == 0 {
+		return ContainerTarget{}, fmt.Errorf("no inbound keys configured")
+	}
+
+	clientKeyData := clientKey.Marshal()
+	matched := false
+	for _, k := range inboundKeys {
+		parsed, _, _, _, err := gossh.ParseAuthorizedKey([]byte(k.PublicKey))
+		if err != nil {
+			continue
+		}
+		if clientKey.Type() == parsed.Type() && subtle.ConstantTimeCompare(clientKeyData, parsed.Marshal()) == 1 {
+			matched = true
+			break
+		}
+	}
+	if !matched {
+		return ContainerTarget{}, fmt.Errorf("public key not authorized")
+	}
+
+	return r.resolveTarget(ctx, auth)
+}
+
+func (r *RepoResolver) resolveTarget(ctx context.Context, auth repository.HostSSHAuth) (ContainerTarget, error) {
 	if auth.UserStatus != "active" {
 		return ContainerTarget{}, fmt.Errorf("user suspended")
 	}
-
 	if auth.HostStatus != "running" {
 		return ContainerTarget{}, fmt.Errorf("host not running (status: %s)", auth.HostStatus)
 	}