swadhinbiswas feat: implement production-grade security and fix critical vulnerabilities · 1/1/2026
0c17327
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
---
import SettingsLayout from "@/layouts/SettingsLayout.astro";
import { getDatabase } from "@/db";
import { sshKeys } from "@/db/schema";
import { eq, desc } from "drizzle-orm";
const user = Astro.locals.user;
if (!user) {
return Astro.redirect("/login");
}
const db = getDatabase();
let keys: any[] = [];
try {
keys = await db.query.sshKeys.findMany({
where: eq(sshKeys.userId, user.id),
orderBy: [desc(sshKeys.createdAt)],
});
} catch (e) {}
---
<SettingsLayout title="SSH Keys">
<div class="space-y-6">
<!-- Header -->
<div class="flex items-center justify-between">
<div>
<h3 class="text-xl font-bold text-white flex items-center gap-3">
<div class="p-2 rounded-lg bg-gradient-to-br from-green-500/20 to-emerald-500/20 border border-green-500/30">
<svg class="h-5 w-5 text-green-400" fill="none" stroke="currentColor" viewBox="0 0 24 24">
<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15 7a2 2 0 012 2m4 0a6 6 0 01-7.743 5.743L11 17H9v2H7v2H4a1 1 0 01-1-1v-2.586a1 1 0 01.293-.707l5.964-5.964A6 6 0 1121 9z"></path>
</svg>
</div>
SSH Keys
</h3>
<p class="text-gray-500 text-sm mt-2 ml-12">
SSH keys allow secure authentication without passwords.
</p>
</div>
<button
type="button"
id="add-key-btn"
class="inline-flex items-center gap-2 px-4 py-2.5 rounded-lg bg-gradient-to-r from-green-500 to-emerald-600 text-sm font-medium text-white shadow-lg shadow-green-500/25 hover:shadow-green-500/40 transition-all"
>
<svg class="h-4 w-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 4v16m8-8H4"></path>
</svg>
New SSH Key
</button>
</div>
<!-- Keys List -->
<div class="relative">
<div class="absolute -inset-[1px] bg-gradient-to-r from-green-500/20 via-transparent to-emerald-500/20 rounded-xl opacity-50"></div>
<div class="relative rounded-xl border border-white/10 bg-[#0d1117]/80 backdrop-blur-sm overflow-hidden">
{keys.length > 0 ? (
<div class="divide-y divide-white/5">
{keys.map((key: any) => (
<div class="flex items-center justify-between p-4 hover:bg-white/[0.02] transition-colors group">
<div class="flex items-center gap-3">
<div class="p-2 rounded-lg bg-green-500/10">
<svg class="h-5 w-5 text-green-400" fill="none" stroke="currentColor" viewBox="0 0 24 24">
<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15 7a2 2 0 012 2m4 0a6 6 0 01-7.743 5.743L11 17H9v2H7v2H4a1 1 0 01-1-1v-2.586a1 1 0 01.293-.707l5.964-5.964A6 6 0 1121 9z"></path>
</svg>
</div>
<div>
<p class="font-medium text-white">{key.title}</p>
<p class="text-sm text-gray-500 font-mono">{key.fingerprint}</p>
<p class="text-xs text-gray-600 mt-1">
Added {new Date(key.createdAt).toLocaleDateString()}
</p>
</div>
</div>
<button
type="button"
class="delete-key-btn opacity-0 group-hover:opacity-100 px-3 py-1.5 rounded-lg bg-red-500/10 border border-red-500/30 text-sm text-red-400 hover:bg-red-500/20 transition-all"
data-id={key.id}
>
Delete
</button>
</div>
))}
</div>
) : (
<div class="text-center py-16">
<div class="relative inline-block mb-4">
<svg class="h-16 w-16 text-green-400" fill="none" stroke="currentColor" viewBox="0 0 24 24">
<path stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5" d="M15 7a2 2 0 012 2m4 0a6 6 0 01-7.743 5.743L11 17H9v2H7v2H4a1 1 0 01-1-1v-2.586a1 1 0 01.293-.707l5.964-5.964A6 6 0 1121 9z"></path>
</svg>
<div class="absolute inset-0 bg-green-500 blur-2xl opacity-20"></div>
</div>
<h3 class="text-lg font-semibold text-white mb-2">No SSH keys</h3>
<p class="text-gray-500 mb-4">Add an SSH key to push to repositories securely.</p>
<button
type="button"
id="add-first-key-btn"
class="inline-flex items-center gap-2 px-4 py-2.5 rounded-lg bg-gradient-to-r from-green-500 to-emerald-600 text-sm font-medium text-white"
>
<svg class="h-4 w-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 4v16m8-8H4"></path>
</svg>
Add your first SSH key
</button>
</div>
)}
</div>
</div>
<!-- Add Key Modal -->
<div id="add-key-modal" class="hidden fixed z-50 inset-0 overflow-y-auto">
<div class="flex items-center justify-center min-h-screen p-4">
<div class="fixed inset-0 bg-black/70 backdrop-blur-sm" id="modal-backdrop"></div>
<div class="relative rounded-2xl border border-white/10 bg-[#0d1117] p-6 w-full max-w-lg">
<h3 class="text-lg font-bold text-white mb-4 flex items-center gap-2">
<svg class="h-5 w-5 text-green-400" fill="none" stroke="currentColor" viewBox="0 0 24 24">
<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 4v16m8-8H4"></path>
</svg>
Add New SSH Key
</h3>
<form id="ssh-key-form" class="space-y-4">
<div>
<label class="block text-sm font-medium text-gray-300 mb-2">Title</label>
<input
type="text"
name="title"
required
placeholder="e.g. Personal Laptop"
class="w-full rounded-lg border border-white/10 bg-white/5 px-4 py-2.5 text-white placeholder:text-gray-600 focus:outline-none focus:border-green-500/50 focus:ring-2 focus:ring-green-500/20 transition-all"
/>
</div>
<div>
<label class="block text-sm font-medium text-gray-300 mb-2">Key</label>
<textarea
name="key"
rows="5"
required
placeholder="ssh-rsa AAAAB3NzaC1yc2E..."
class="w-full rounded-lg border border-white/10 bg-white/5 px-4 py-2.5 text-white placeholder:text-gray-600 focus:outline-none focus:border-green-500/50 focus:ring-2 focus:ring-green-500/20 transition-all resize-none font-mono text-sm"
></textarea>
</div>
<div class="flex gap-3 pt-2">
<button
type="button"
id="cancel-add-key-btn"
class="flex-1 px-4 py-2.5 rounded-lg border border-white/10 bg-white/5 text-sm text-gray-300 hover:bg-white/10 transition-colors"
>
Cancel
</button>
<button
type="submit"
class="flex-1 px-4 py-2.5 rounded-lg bg-gradient-to-r from-green-500 to-emerald-600 text-sm font-medium text-white"
>
Add Key
</button>
</div>
</form>
</div>
</div>
</div>
</div>
</SettingsLayout>
<script>
const addBtn = document.getElementById("add-key-btn");
const addFirstBtn = document.getElementById("add-first-key-btn");
const modal = document.getElementById("add-key-modal");
const backdrop = document.getElementById("modal-backdrop");
const cancelBtn = document.getElementById("cancel-add-key-btn");
const form = document.getElementById("ssh-key-form") as HTMLFormElement;
const deleteBtns = document.querySelectorAll(".delete-key-btn");
const openModal = () => modal?.classList.remove("hidden");
const closeModal = () => {
modal?.classList.add("hidden");
form.reset();
};
addBtn?.addEventListener("click", openModal);
addFirstBtn?.addEventListener("click", openModal);
cancelBtn?.addEventListener("click", closeModal);
backdrop?.addEventListener("click", closeModal);
form?.addEventListener("submit", async (e) => {
e.preventDefault();
const formData = new FormData(form);
try {
const response = await fetch("/api/user/keys", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify(Object.fromEntries(formData)),
});
if (response.ok) {
window.location.reload();
} else {
const error = await response.json();
alert(error.message || "Failed to add SSH key");
}
} catch (error) {
console.error("Error adding SSH key:", error);
alert("An error occurred");
}
});
deleteBtns.forEach((btn) => {
btn.addEventListener("click", async () => {
if (confirm("Are you sure you want to delete this SSH key?")) {
const id = btn.getAttribute("data-id");
try {
const response = await fetch(`/api/user/keys/${id}`, { method: "DELETE" });
if (response.ok) {
window.location.reload();
} else {
alert("Failed to delete SSH key");
}
} catch (error) {
console.error("Error deleting SSH key:", error);
}
}
});
});
</script>