test: cover API keys and the legacy password upgrade end to end

[otavio]

Summary

Covers Domain 18 (API Keys) of shellhub-io/team#243, along with the remaining Domain 1 API key and legacy password items, with testcontainers tests. Some open items were already asserted by #7363's tests, so this PR does not test them again.

tests/
├── environment/
│   ├── api_key.go              # ExpireAPIKeyIn: an API key expiring seconds from now
│   └── user.go                 # read and replace a user's stored password digest
├── api_key_test.go             # TestNamespaceAPIKeyAuthentication: tags, role, -1, expiry, instance prefix
├── api_key_ssh_test.go         # TestAPIKeySSHAccess: no grant, deny over allow, identity TTL, key deletion
├── password_hash_test.go       # TestLegacyPasswordDigest: SHA256 digest rehashed with bcrypt on login
└── identity_helpers_test.go    # enrollAPIKeyIdentity, expireIdentityAndRequireRefused (refactor commit)

Item	Test
D18 tag operations	TestNamespaceAPIKeyAuthentication/a_key_creates,_lists,_attaches,_detaches_and_deletes_tags
D18 + D1 expired API key rejected	…/a_key_is_refused_once_its_expiry_passes
D18 non-expiring key (-1)	…/a_key_that_never_expires_is_stored_without_an_expiry_and_authenticates
D18 key respects its role	…/a_key_acts_only_within_its_role
D18 instance key rejected on regular routes	…/a_key_carrying_the_instance_key_prefix_is_refused_on_a_namespace_route
D18 SSH denied without policy	TestAPIKeySSHAccess/a_key_no_policy_names_is_refused
D18 SSH deny overrides allow	TestAPIKeySSHAccess/a_deny_policy_naming_the_key_beats_the_allow_that_names_it
D18 SSH expired identity, identity within TTL	TestAPIKeySSHAccess/a_key's_identity_is_accepted_until_its_expiry_and_refused_after
D18 deleting the key revokes its identities	TestAPIKeySSHAccess/deleting_a_key_revokes_its_identities
D18 not matched by all-members	#7363: TestAccessPolicyEvaluation/an_every-member_policy_grants_members_and_not_API_keys
D18 single-use consumed, rejected on second attempt	#7363: TestSSHIdentityConnection, both single-use subtests
D18 skips RequireReauth	#7363: TestAccessPolicyReauth/an_API_key_is_never_asked_to_re-authenticate
D1 SHA256 password upgrades to bcrypt	TestLegacyPasswordDigest

Each refusal asserts a specific outcome: an HTTP status (401, 403 or 404), or the denial reason in the server log on the same line as the key's ID. The API key expiry test sets an expiry 10 seconds ahead and waits for it to pass. The SSH identity expiry test moves expires_at into the past. No test deletes a row to fake an expiry.

Not covered:

• Instance key admin routes, creation, the creator losing admin, and instance key expiry (D18: 4 items, D1: 2). The routes are mounted only by cloud/internal/admin/routes/routes.go. The gateway proxies /admin/api* only when enterprise is enabled, and this suite runs the community stack.
• D1 "API key role capped at creator's current role". b6689e5 deliberately stopped re-capping a key when its creator is demoted, and members.spec.ts asserts that. At creation, only administrators and owners hold APIKeyCreate, and no key can be owner, so the creator's role and the administrator ceiling are the same limit.
• Renaming a tag. PATCH /api/tags/:name answers 200 with no body, but the spec declares the renamed tag. The strict-validating stack turns that into a 500.
• The instance prefix subtest is weak. The server refuses an sh_admin_ key outside /admin/api before looking it up. An unknown key would get the same 401, so no server mutation can make this subtest fail.

Evidence

• Before: these items had no test.
  After: the full tests/ suite passes on the tree before rebasing onto test: cover SSH legacy mode end to end #7366. After the rebase, it fails only in test: cover SSH legacy mode end to end #7366's TestSSHServerRestart, which fails the same way intermittently when run alone (unable to authenticate, after a 30-second wait). The new tests pass:

  TestNamespaceAPIKeyAuthentication  7/7
  TestAPIKeySSHAccess                4/4
  TestLegacyPasswordDigest           2/2
  TestSSHIdentityConnection          5/5  (helper extraction)
  

• The tests fail when the behaviour breaks. I mutated the server code each subtest guards, ran the tests, then reverted:

  • APIKey.IsValid always true: the API key expiry subtest fails
  • apiKeyRoleLimit always administrator: the observer and operator subtests fail
  • SHA256 rehash skipped at login: the upgrade subtest fails
  • identity.Active not checked in the SSH auther: the identity expiry subtest fails
  • a matching deny ignored for API keys: the deny-over-allow subtest fails
  • an allow that does not match granting API keys anyway: the no-grant subtest fails
  • DeleteAPIKey deleting nothing: the key-deletion subtest fails
  • -1 read as a timestamp: the never-expires subtest fails, along with every other subtest that uses a -1 key

Merge Danger

Door: two-way

Blast Radius: tests

Test code only. The refactor commit moves helpers that #7363's identity tests and the enrollment tests call: tagNames now takes []models.Tag.

[github-actions]

Claude encountered an error after 1s —— View job

---

I'll analyze this and get back to you.