discover: broaden discovery to feed the new drivers

Per the standing directive (dynamic discovery per credential type as each driver lands): - env.go: tag DB connection URLs by scheme (postgres/postgresql, mysql/mariadb, redis/rediss) with a user:password authority, routing DATABASE_URL/REDIS_URL/ MYSQL_URL straight to the in-place DB drivers, kept regardless of the secret-name heuristic. - aws.go: emit the driver-ready single-line blob (was the bare secret) and resolve region from env / ~/.aws/config. - ssh.go: content-based key detection (not just id_*) + ~/.ssh/config IdentityFile parsing. - tea.go: new scanner mapping Gitea `tea` CLI config to a driver-ready PAT blob. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-06-18 14:48:30 -07:00
parent 59af53dcc0
commit 1c0896347b
5 changed files with 433 additions and 42 deletions
@@ -1,6 +1,7 @@
 package discover

 import (
+	"bufio"
 	"bytes"
 	"context"
 	"os"
@@ -13,8 +14,15 @@ import (

 func init() { Register(&sshScanner{}) }

-// sshScanner harvests private keys from ~/.ssh (files named id_* that aren't
-// .pub). The whole key file is the secret. Read-only.
+// sshScanner harvests SSH private keys from their common locations:
+//
+//   - every regular file in ~/.ssh whose CONTENT is a private key (not just the
+//     conventional id_* names — a key may be named anything), excluding the
+//     obvious non-key companions (*.pub, known_hosts, authorized_keys, config…);
+//   - any path referenced by an `IdentityFile` directive in ~/.ssh/config, which
+//     legitimately points keys at non-default locations.
+//
+// The whole key file is the secret. Read-only; deduplicated by absolute path.
 type sshScanner struct{}

 func (s *sshScanner) Name() string { return "ssh" }
@@ -29,39 +37,118 @@ func (s *sshScanner) Available() bool {
 	return err == nil && fi.IsDir()
 }

+// nonKeyNames are files that live in ~/.ssh but are never private keys; skipping
+// them by name avoids reading large/irrelevant files (the content gate would also
+// reject them, this is just cheaper and clearer).
+var nonKeyNames = map[string]bool{
+	"known_hosts":     true,
+	"known_hosts.old": true,
+	"authorized_keys": true,
+	"config":          true,
+	"environment":     true,
+	"rc":              true,
+}
+
 func (s *sshScanner) Scan(ctx context.Context, v *vault.Vault) ([]Credential, error) {
-	entries, err := os.ReadDir(s.dir())
-	if err != nil {
-		return nil, err
-	}
+	seen := map[string]bool{}
 	var creds []Credential
-	for _, e := range entries {
-		name := e.Name()
-		if !e.Type().IsRegular() || !strings.HasPrefix(name, "id_") || strings.HasSuffix(name, ".pub") {
-			continue
+
+	add := func(p string) {
+		abs, err := filepath.Abs(p)
+		if err != nil || seen[abs] {
+			return
 		}
-		p := filepath.Join(s.dir(), name)
-		b, err := os.ReadFile(p) // read-only
-		if err != nil {
-			continue
+		seen[abs] = true
+		if c, ok := s.keyCred(abs, v); ok {
+			creds = append(creds, c)
 		}
-		if !bytes.Contains(b, []byte("PRIVATE KEY")) {
-			continue // not a private key file
-		}
-		fi, _ := os.Stat(p)
-		// Best-effort: PEM-encrypted keys carry an explicit marker. (OpenSSH-format
-		// encryption isn't detectable without parsing the body, so this can
-		// under-report; it never claims a plaintext key is encrypted.)
-		encrypted := bytes.Contains(b, []byte("ENCRYPTED"))
-		creds = append(creds, Credential{
-			Source:   s.Name(),
-			Kind:     KindPrivateKey,
-			Identity: name,
-			Location: p,
-			Modified: fi.ModTime(),
-			Secret:   v.Store(b),
-			Meta:     map[string]string{"encrypted": strconv.FormatBool(encrypted)},
-		})
 	}
+
+	// 1. Every regular file directly in ~/.ssh, filtered by name then content.
+	if entries, err := os.ReadDir(s.dir()); err == nil {
+		for _, e := range entries {
+			name := e.Name()
+			if !e.Type().IsRegular() {
+				continue
+			}
+			if strings.HasSuffix(name, ".pub") || nonKeyNames[name] {
+				continue
+			}
+			add(filepath.Join(s.dir(), name))
+		}
+	}
+
+	// 2. Keys referenced from ~/.ssh/config (often outside ~/.ssh).
+	for _, p := range s.identityFiles() {
+		add(p)
+	}
+
 	return creds, nil
 }
+
+// keyCred reads p and, if it is a private key file, returns a Credential for it.
+func (s *sshScanner) keyCred(p string, v *vault.Vault) (Credential, bool) {
+	b, err := os.ReadFile(p) // read-only
+	if err != nil {
+		return Credential{}, false
+	}
+	if !bytes.Contains(b, []byte("PRIVATE KEY")) {
+		return Credential{}, false // not a private key file
+	}
+	fi, _ := os.Stat(p)
+	// Best-effort: PEM-encrypted keys carry an explicit marker. (OpenSSH-format
+	// encryption isn't detectable without parsing the body, so this can
+	// under-report; it never claims a plaintext key is encrypted.)
+	encrypted := bytes.Contains(b, []byte("ENCRYPTED"))
+	c := Credential{
+		Source:   s.Name(),
+		Kind:     KindPrivateKey,
+		Identity: filepath.Base(p),
+		Location: p,
+		Secret:   v.Store(b),
+		Meta:     map[string]string{"encrypted": strconv.FormatBool(encrypted)},
+	}
+	if fi != nil {
+		c.Modified = fi.ModTime()
+	}
+	return c, true
+}
+
+// identityFiles parses ~/.ssh/config and returns the expanded paths of every
+// IdentityFile directive. Tilde and $HOME are expanded; relative paths resolve
+// against ~/.ssh (the ssh client's own behavior).
+func (s *sshScanner) identityFiles() []string {
+	f, err := os.Open(filepath.Join(s.dir(), "config"))
+	if err != nil {
+		return nil
+	}
+	defer f.Close()
+
+	home, _ := os.UserHomeDir()
+	var out []string
+	sc := bufio.NewScanner(f)
+	for sc.Scan() {
+		line := strings.TrimSpace(sc.Text())
+		if line == "" || strings.HasPrefix(line, "#") {
+			continue
+		}
+		// "IdentityFile <path>" — keyword is case-insensitive, may use '=' .
+		fields := strings.FieldsFunc(line, func(r rune) bool {
+			return r == ' ' || r == '\t' || r == '='
+		})
+		if len(fields) < 2 || !strings.EqualFold(fields[0], "IdentityFile") {
+			continue
+		}
+		p := strings.Trim(fields[1], `"`)
+		switch {
+		case strings.HasPrefix(p, "~/"):
+			p = filepath.Join(home, p[2:])
+		case strings.HasPrefix(p, "$HOME/"):
+			p = filepath.Join(home, p[len("$HOME/"):])
+		case !filepath.IsAbs(p):
+			p = filepath.Join(s.dir(), p)
+		}
+		out = append(out, p)
+	}
+	return out
+}