feat: 新增密钥管理界面

#1

packages/backend/src/services/connection.service.ts

@@ -1,6 +1,7 @@
 import * as ConnectionRepository from '../repositories/connection.repository';
 import { encrypt, decrypt } from '../utils/crypto';
-import { AuditLogService } from '../services/audit.service';
+import { AuditLogService } from './audit.service';
+import * as SshKeyService from './ssh_key.service'; // +++ Import SshKeyService +++
 import {
     ConnectionBase,
     ConnectionWithTags,
@@ -36,6 +37,9 @@ export const getConnectionById = async (id: number): Promise<ConnectionWithTags
  * 创建新连接
  */
 export const createConnection = async (input: CreateConnectionInput): Promise<ConnectionWithTags> => {
+    // +++ Define a local type alias for clarity, including ssh_key_id +++
+    type ConnectionDataForRepo = Omit<FullConnectionData, 'id' | 'created_at' | 'updated_at' | 'last_connected_at' | 'tag_ids'>;
+
     console.log('[Service:createConnection] Received input:', JSON.stringify(input, null, 2)); // Log input
     // 1. 验证输入 (包含 type)
     // Convert type to uppercase for validation and consistency
@@ -54,8 +58,12 @@ export const createConnection = async (input: CreateConnectionInput): Promise<Co
         if (input.auth_method === 'password' && !input.password) {
             throw new Error('SSH 密码认证方式需要提供 password。');
         }
-        if (input.auth_method === 'key' && !input.private_key) {
-            throw new Error('SSH 密钥认证方式需要提供 private_key。');
+        // If using ssh_key_id, private_key is not required in the input
+        if (input.auth_method === 'key' && !input.ssh_key_id && !input.private_key) {
+            throw new Error('SSH 密钥认证方式需要提供 private_key 或选择一个已保存的密钥 (ssh_key_id)。');
+        }
+        if (input.auth_method === 'key' && input.ssh_key_id && input.private_key) {
+            throw new Error('不能同时提供 private_key 和 ssh_key_id。');
         }
     } else if (connectionType === 'RDP') {
         if (!input.password) {
@@ -64,10 +72,11 @@ export const createConnection = async (input: CreateConnectionInput): Promise<Co
         // For RDP, we'll ignore auth_method, private_key, passphrase from input if provided
     }
 
-    // 2. 加密凭证 (根据 type)
+    // 2. 处理凭证和 ssh_key_id (根据 type)
     let encryptedPassword = null;
     let encryptedPrivateKey = null;
     let encryptedPassphrase = null;
+    let sshKeyIdToSave: number | null = null; // +++ Variable for ssh_key_id +++
     // Default to 'password' for DB compatibility, especially for RDP
     let authMethodForDb: 'password' | 'key' = 'password';
 
@@ -75,10 +84,28 @@ export const createConnection = async (input: CreateConnectionInput): Promise<Co
         authMethodForDb = input.auth_method!; // Already validated above
         if (input.auth_method === 'password') {
             encryptedPassword = encrypt(input.password!);
-        } else { // key
-            encryptedPrivateKey = encrypt(input.private_key!);
-            if (input.passphrase) {
-                encryptedPassphrase = encrypt(input.passphrase);
+            sshKeyIdToSave = null; // Password auth cannot use ssh_key_id
+        } else { // auth_method is 'key'
+            if (input.ssh_key_id) {
+                // Validate the provided ssh_key_id
+                const keyExists = await SshKeyService.getSshKeyDbRowById(input.ssh_key_id);
+                if (!keyExists) {
+                    throw new Error(`提供的 SSH 密钥 ID ${input.ssh_key_id} 无效或不存在。`);
+                }
+                sshKeyIdToSave = input.ssh_key_id;
+                // When using ssh_key_id, connection's own key fields should be null
+                encryptedPrivateKey = null;
+                encryptedPassphrase = null;
+            } else if (input.private_key) {
+                // Encrypt the provided private key and passphrase
+                encryptedPrivateKey = encrypt(input.private_key!);
+                if (input.passphrase) {
+                    encryptedPassphrase = encrypt(input.passphrase);
+                }
+                sshKeyIdToSave = null; // Ensure ssh_key_id is null if providing key directly
+            } else {
+                 // This case should be caught by validation above, but as a safeguard:
+                 throw new Error('SSH 密钥认证方式内部错误：未提供 private_key 或 ssh_key_id。');
             }
         }
     } else { // RDP (connectionType is 'RDP')
@@ -91,23 +118,30 @@ export const createConnection = async (input: CreateConnectionInput): Promise<Co
 
     // 3. 准备仓库数据
     const defaultPort = input.type === 'RDP' ? 3389 : 22;
-    // Explicitly type the object being passed to the repository
-    const connectionData: Omit<ConnectionRepository.FullConnectionData, 'id' | 'created_at' | 'updated_at' | 'last_connected_at' | 'tag_ids'> = {
+    // +++ Explicitly type connectionData using the local alias +++
+    const connectionData: ConnectionDataForRepo = {
         name: input.name || '',
-        type: connectionType, // Use the validated uppercase type
+        type: connectionType,
         host: input.host,
         port: input.port ?? defaultPort, // Use type-specific default port
         username: input.username,
         auth_method: authMethodForDb, // Use determined auth method
         encrypted_password: encryptedPassword,
-        encrypted_private_key: encryptedPrivateKey, // Will be null for RDP
-        encrypted_passphrase: encryptedPassphrase, // Will be null for RDP
+        encrypted_private_key: encryptedPrivateKey, // Null if using ssh_key_id or RDP
+        encrypted_passphrase: encryptedPassphrase, // Null if using ssh_key_id or RDP
+        ssh_key_id: sshKeyIdToSave, // +++ Add ssh_key_id +++
         proxy_id: input.proxy_id ?? null,
     };
-    console.log('[Service:createConnection] Data to be saved:', JSON.stringify(connectionData, null, 2)); // Log data before saving
+    // Remove ssh_key_id property if it's null before logging/saving if repository expects exact type match without optional nulls
+    const finalConnectionData = { ...connectionData };
+    if (finalConnectionData.ssh_key_id === null) {
+        delete (finalConnectionData as any).ssh_key_id; // Adjust based on repository function signature if needed
+    }
+    console.log('[Service:createConnection] Data to be saved:', JSON.stringify(finalConnectionData, null, 2)); // Log data before saving
 
     // 4. 在仓库中创建连接记录
-    const newConnectionId = await ConnectionRepository.createConnection(connectionData);
+    // Pass the potentially modified finalConnectionData
+    const newConnectionId = await ConnectionRepository.createConnection(finalConnectionData as Omit<ConnectionRepository.FullConnectionData, 'id' | 'created_at' | 'updated_at' | 'last_connected_at' | 'tag_ids'>);
 
     // 5. 处理标签
     const tagIds = input.tag_ids?.filter(id => typeof id === 'number' && id > 0) ?? [];
@@ -139,8 +173,8 @@ export const updateConnection = async (id: number, input: UpdateConnectionInput)
     }
 
     // 2. 准备更新数据
-    // Explicitly type dataToUpdate to match the repository's expected input
-    const dataToUpdate: Partial<Omit<ConnectionRepository.FullConnectionData, 'id' | 'created_at' | 'last_connected_at' | 'tag_ids'>> = {};
+    // Explicitly type dataToUpdate to match the repository's expected input, including ssh_key_id
+    const dataToUpdate: Partial<Omit<ConnectionRepository.FullConnectionData & { ssh_key_id?: number | null }, 'id' | 'created_at' | 'last_connected_at' | 'tag_ids'>> = {};
     let needsCredentialUpdate = false;
     // Determine the final type, converting input type to uppercase if provided
     const targetType = input.type?.toUpperCase() as 'SSH' | 'RDP' | undefined || currentFullConnection.type;
@@ -153,6 +187,8 @@ export const updateConnection = async (id: number, input: UpdateConnectionInput)
     if (input.port !== undefined) dataToUpdate.port = input.port;
     if (input.username !== undefined) dataToUpdate.username = input.username;
     if (input.proxy_id !== undefined) dataToUpdate.proxy_id = input.proxy_id;
+    // Handle ssh_key_id update (can be set to null or a new ID)
+    if (input.ssh_key_id !== undefined) dataToUpdate.ssh_key_id = input.ssh_key_id;
 
     // 处理认证方法更改或凭证更新 (根据 targetType)
     // Use the validated targetType for logic
@@ -177,31 +213,67 @@ export const updateConnection = async (id: number, input: UpdateConnectionInput)
                  dataToUpdate.encrypted_password = input.password ? encrypt(input.password) : null;
                  needsCredentialUpdate = true;
             }
-            // When switching to password, clear key fields
+            // When switching to password, clear key fields and ssh_key_id
             if (finalAuthMethod !== currentAuthMethod) {
                 dataToUpdate.encrypted_private_key = null;
                 dataToUpdate.encrypted_passphrase = null;
+                dataToUpdate.ssh_key_id = null; // Clear ssh_key_id when switching to password
             }
         } else { // finalAuthMethod is 'key'
-            let keyUpdated = false;
-            // If switching to key or updating key
-            if (input.private_key !== undefined) {
-                 if (!input.private_key && finalAuthMethod !== currentAuthMethod) {
-                     // Switching to key requires a private key
-                     throw new Error('切换到密钥认证时需要提供 private_key。');
-                 }
-                 // Encrypt if key is not empty, otherwise set to null (to clear)
-                 dataToUpdate.encrypted_private_key = input.private_key ? encrypt(input.private_key) : null;
-                 needsCredentialUpdate = true;
-                 keyUpdated = true;
-            }
-            // Update passphrase only if key was updated OR passphrase itself was provided
-            if (keyUpdated || input.passphrase !== undefined) {
-                 // Encrypt if passphrase is not empty, otherwise set to null (to clear)
+            // Handle ssh_key_id selection or direct key input
+            if (input.ssh_key_id !== undefined) {
+                // User selected a stored key
+                if (input.ssh_key_id === null) {
+                    // User explicitly wants to clear the stored key association
+                    dataToUpdate.ssh_key_id = null;
+                    // If clearing ssh_key_id, we might need a direct key, but validation should handle this?
+                    // Or assume clearing means switching back to direct key input (which might be empty)
+                    // Let's assume clearing ssh_key_id means we expect a direct key or nothing
+                    if (input.private_key === undefined) {
+                        // If no direct key provided when clearing ssh_key_id, clear connection's key fields
+                        dataToUpdate.encrypted_private_key = null;
+                        dataToUpdate.encrypted_passphrase = null;
+                    } else {
+                        // Encrypt the direct key provided alongside clearing ssh_key_id
+                        dataToUpdate.encrypted_private_key = input.private_key ? encrypt(input.private_key) : null;
+                        dataToUpdate.encrypted_passphrase = input.passphrase ? encrypt(input.passphrase) : null;
+                    }
+                } else {
+                    // Validate the provided ssh_key_id
+                    const keyExists = await SshKeyService.getSshKeyDbRowById(input.ssh_key_id);
+                    if (!keyExists) {
+                        throw new Error(`提供的 SSH 密钥 ID ${input.ssh_key_id} 无效或不存在。`);
+                    }
+                    dataToUpdate.ssh_key_id = input.ssh_key_id;
+                    // Clear direct key fields when selecting a stored key
+                    dataToUpdate.encrypted_private_key = null;
+                    dataToUpdate.encrypted_passphrase = null;
+                }
+                needsCredentialUpdate = true; // Changing key source is a credential update
+            } else if (input.private_key !== undefined) {
+                // User provided a direct key
+                if (!input.private_key && finalAuthMethod !== currentAuthMethod) {
+                    // Switching to key requires a private key if not using ssh_key_id
+                    throw new Error('切换到密钥认证时需要提供 private_key 或选择一个已保存的密钥。');
+                }
+                // Encrypt if key is not empty, otherwise set to null (to clear)
+                dataToUpdate.encrypted_private_key = input.private_key ? encrypt(input.private_key) : null;
+                // Update passphrase only if direct key was provided OR passphrase itself was provided
+                if (input.passphrase !== undefined) {
+                    dataToUpdate.encrypted_passphrase = input.passphrase ? encrypt(input.passphrase) : null;
+                } else if (input.private_key) {
+                    // If only private_key is provided, clear passphrase
+                    dataToUpdate.encrypted_passphrase = null;
+                }
+                dataToUpdate.ssh_key_id = null; // Clear ssh_key_id when providing direct key
+                needsCredentialUpdate = true;
+            } else if (input.passphrase !== undefined && !input.ssh_key_id && currentFullConnection.encrypted_private_key) {
+                 // Only passphrase provided, and not using ssh_key_id, and a direct key already exists
                  dataToUpdate.encrypted_passphrase = input.passphrase ? encrypt(input.passphrase) : null;
-                 needsCredentialUpdate = true; // Consider passphrase change a credential update
+                 needsCredentialUpdate = true;
             }
-             // When switching to key, clear password field
+
+            // When switching to key, clear password field
             if (finalAuthMethod !== currentAuthMethod) {
                 dataToUpdate.encrypted_password = null;
             }
@@ -218,6 +290,7 @@ export const updateConnection = async (id: number, input: UpdateConnectionInput)
             dataToUpdate.auth_method = 'password'; // RDP uses password auth method in DB
             dataToUpdate.encrypted_private_key = null;
             dataToUpdate.encrypted_passphrase = null;
+            dataToUpdate.ssh_key_id = null; // RDP cannot use ssh_key_id
         }
     }
 
@@ -279,8 +352,7 @@ export const deleteConnection = async (id: number): Promise<boolean> => {
 export const getConnectionWithDecryptedCredentials = async (
     id: number
 ): Promise<{ connection: ConnectionWithTags; decryptedPassword?: string; decryptedPrivateKey?: string; decryptedPassphrase?: string } | null> => {
-    // 1. 获取完整的连接数据（包含加密字段）
-    // Assuming findFullConnectionById exists and returns FullConnectionDbRow or null
+    // 1. 获取完整的连接数据（包含加密字段和可能的 ssh_key_id）
     const fullConnectionDbRow = await ConnectionRepository.findFullConnectionById(id);
     if (!fullConnectionDbRow) {
         console.log(`[Service:getConnWithDecrypt] Connection not found for ID: ${id}`);
@@ -291,11 +363,11 @@ export const getConnectionWithDecryptedCredentials = async (
     const fullConnection: FullConnectionData = {
         ...fullConnectionDbRow,
         encrypted_password: fullConnectionDbRow.encrypted_password ?? null,
-        encrypted_private_key: fullConnectionDbRow.encrypted_private_key ?? null,
-        encrypted_passphrase: fullConnectionDbRow.encrypted_passphrase ?? null,
+        encrypted_private_key: fullConnectionDbRow.encrypted_private_key ?? null, // May be null if using ssh_key_id
+        encrypted_passphrase: fullConnectionDbRow.encrypted_passphrase ?? null, // May be null if using ssh_key_id
+        ssh_key_id: fullConnectionDbRow.ssh_key_id ?? null, // +++ Include ssh_key_id +++
         // Ensure other fields match FullConnectionData if necessary
-        // (Assuming FullConnectionDbRow includes all fields of FullConnectionData)
-    };
+    } as FullConnectionData & { ssh_key_id: number | null }; // Type assertion
 
     // 2. 获取带标签的连接数据（用于返回给调用者）
     const connectionWithTags: ConnectionWithTags | null = await ConnectionRepository.findConnectionByIdWithTags(id);
@@ -318,15 +390,31 @@ export const getConnectionWithDecryptedCredentials = async (
         }
         // Decrypt key and passphrase if method is 'key'
         else if (fullConnection.auth_method === 'key') {
-            if (fullConnection.encrypted_private_key) {
+            if (fullConnection.ssh_key_id) {
+                // +++ If using ssh_key_id, fetch and decrypt the stored key +++
+                console.log(`[Service:getConnWithDecrypt] Connection ${id} uses stored SSH key ID: ${fullConnection.ssh_key_id}. Fetching key...`);
+                const storedKeyDetails = await SshKeyService.getDecryptedSshKeyById(fullConnection.ssh_key_id);
+                if (!storedKeyDetails) {
+                    // This indicates an inconsistency, as the ssh_key_id should be valid
+                    console.error(`[Service:getConnWithDecrypt] Error: Connection ${id} references non-existent SSH key ID ${fullConnection.ssh_key_id}`);
+                    throw new Error(`关联的 SSH 密钥 (ID: ${fullConnection.ssh_key_id}) 未找到。`);
+                }
+                decryptedPrivateKey = storedKeyDetails.privateKey;
+                decryptedPassphrase = storedKeyDetails.passphrase;
+                console.log(`[Service:getConnWithDecrypt] Successfully fetched and decrypted stored SSH key ${fullConnection.ssh_key_id} for connection ${id}.`);
+            } else if (fullConnection.encrypted_private_key) {
+                // Decrypt the key stored directly in the connection record
                 decryptedPrivateKey = decrypt(fullConnection.encrypted_private_key);
-            }
-            // Only decrypt passphrase if it exists
-            if (fullConnection.encrypted_passphrase) {
-                decryptedPassphrase = decrypt(fullConnection.encrypted_passphrase);
+                // Only decrypt passphrase if it exists alongside the direct key
+                if (fullConnection.encrypted_passphrase) {
+                    decryptedPassphrase = decrypt(fullConnection.encrypted_passphrase);
+                }
+            } else {
+                 console.warn(`[Service:getConnWithDecrypt] Connection ${id} uses key auth but has neither ssh_key_id nor encrypted_private_key.`);
+                 // No key available to decrypt
             }
         }
-    } catch (error) {
+    } catch (error: any) { // Catch decryption or key fetching errors
         console.error(`[Service:getConnWithDecrypt] Failed to decrypt credentials for connection ID ${id}:`, error);
         // Decide how to handle decryption errors. Throw? Return null password?
         // For now, we'll log and continue, returning undefined credentials.

packages/backend/src/services/ssh.service.ts

@@ -5,6 +5,7 @@ import net from 'net';
 import * as ConnectionRepository from '../repositories/connection.repository';
 import * as ProxyRepository from '../repositories/proxy.repository';
 import { decrypt } from '../utils/crypto';
+import * as SshKeyService from './ssh_key.service'; // +++ Import SshKeyService +++
 
 const CONNECT_TIMEOUT = 20000; // 连接超时时间 (毫秒)
 const TEST_TIMEOUT = 15000; // 测试连接超时时间 (毫秒)
@@ -56,12 +57,41 @@ export const getConnectionDetails = async (connectionId: number): Promise<Decryp
             port: rawConnInfo.port ?? (() => { throw new Error(`Connection ID ${connectionId} has null port.`); })(),
             username: rawConnInfo.username ?? (() => { throw new Error(`Connection ID ${connectionId} has null username.`); })(),
             auth_method: rawConnInfo.auth_method ?? (() => { throw new Error(`Connection ID ${connectionId} has null auth_method.`); })(),
-            password: (rawConnInfo.auth_method === 'password' && rawConnInfo.encrypted_password) ? decrypt(rawConnInfo.encrypted_password) : undefined,
-            privateKey: (rawConnInfo.auth_method === 'key' && rawConnInfo.encrypted_private_key) ? decrypt(rawConnInfo.encrypted_private_key) : undefined,
-            passphrase: (rawConnInfo.auth_method === 'key' && rawConnInfo.encrypted_passphrase) ? decrypt(rawConnInfo.encrypted_passphrase) : undefined,
+            // Initialize credentials
+            password: undefined,
+            privateKey: undefined,
+            passphrase: undefined,
             proxy: null,
         };
 
+        // Decrypt password if method is password
+        if (fullConnInfo.auth_method === 'password' && rawConnInfo.encrypted_password) {
+            fullConnInfo.password = decrypt(rawConnInfo.encrypted_password);
+        }
+        // Handle key auth: prioritize ssh_key_id, then direct key
+        else if (fullConnInfo.auth_method === 'key') {
+            // +++ Use rawConnInfo.ssh_key_id instead of undefined sshKeyId +++
+            if (rawConnInfo.ssh_key_id) {
+                console.log(`SshService: Connection ${connectionId} uses stored SSH key ID: ${rawConnInfo.ssh_key_id}. Fetching key...`);
+                const storedKeyDetails = await SshKeyService.getDecryptedSshKeyById(rawConnInfo.ssh_key_id); // Use imported SshKeyService
+                if (!storedKeyDetails) {
+                    console.error(`SshService: Error: Connection ${connectionId} references non-existent SSH key ID ${rawConnInfo.ssh_key_id}`);
+                    throw new Error(`关联的 SSH 密钥 (ID: ${rawConnInfo.ssh_key_id}) 未找到。`);
+                }
+                fullConnInfo.privateKey = storedKeyDetails.privateKey;
+                fullConnInfo.passphrase = storedKeyDetails.passphrase;
+                console.log(`SshService: Successfully fetched and decrypted stored SSH key ${rawConnInfo.ssh_key_id} for connection ${connectionId}.`);
+            } else if (rawConnInfo.encrypted_private_key) {
+                // Decrypt direct key only if ssh_key_id is not present
+                fullConnInfo.privateKey = decrypt(rawConnInfo.encrypted_private_key);
+                if (rawConnInfo.encrypted_passphrase) {
+                    fullConnInfo.passphrase = decrypt(rawConnInfo.encrypted_passphrase);
+                }
+            } else {
+                 console.warn(`SshService: Connection ${connectionId} uses key auth but has neither ssh_key_id nor encrypted_private_key.`);
+            }
+        }
+
         if (rawConnInfo.proxy_db_id) {
              // Add null checks for required proxy fields inside the if block
              const proxyName = rawConnInfo.proxy_name ?? (() => { throw new Error(`Proxy for Connection ID ${connectionId} has null name.`); })();
@@ -307,14 +337,16 @@ export const testConnection = async (connectionId: number): Promise<{ latency: n
  * @returns Promise<{ latency: number }> - 如果连接成功则 resolve 包含延迟的对象，否则 reject
  * @throws Error 如果连接失败或配置错误
  */
+// Ensure ssh_key_id is part of the input type definition
 export const testUnsavedConnection = async (connectionConfig: {
     host: string;
     port: number;
     username: string;
     auth_method: 'password' | 'key';
     password?: string;
-    private_key?: string; // 注意这里是 private_key
+    private_key?: string; // Keep this for direct input
     passphrase?: string;
+    ssh_key_id?: number | null; // Ensure this is present
     proxy_id?: number | null;
 }): Promise<{ latency: number }> => {
     console.log(`SshService: 测试未保存的连接到 ${connectionConfig.host}:${connectionConfig.port}...`);
@@ -329,13 +361,33 @@ export const testUnsavedConnection = async (connectionConfig: {
             port: connectionConfig.port,
             username: connectionConfig.username,
             auth_method: connectionConfig.auth_method,
-            // 直接使用传入的凭证，因为它们是未加密的
-            password: connectionConfig.password,
-            privateKey: connectionConfig.private_key, // 映射 private_key
-            passphrase: connectionConfig.passphrase,
+            // Initialize credentials, will be populated based on input
+            password: undefined,
+            privateKey: undefined,
+            passphrase: undefined,
             proxy: null, // 稍后填充
         };
 
+        // Populate credentials based on auth method and ssh_key_id presence
+        if (tempConnDetails.auth_method === 'password') {
+            tempConnDetails.password = connectionConfig.password;
+        } else { // auth_method is 'key'
+            if (connectionConfig.ssh_key_id) {
+                // Fetch and decrypt stored key if ssh_key_id is provided
+                console.log(`SshService: Testing unsaved connection using stored SSH key ID: ${connectionConfig.ssh_key_id}...`);
+                const storedKeyDetails = await SshKeyService.getDecryptedSshKeyById(connectionConfig.ssh_key_id); // Use imported SshKeyService
+                if (!storedKeyDetails) {
+                    throw new Error(`选择的 SSH 密钥 (ID: ${connectionConfig.ssh_key_id}) 未找到。`);
+                }
+                tempConnDetails.privateKey = storedKeyDetails.privateKey;
+                tempConnDetails.passphrase = storedKeyDetails.passphrase;
+            } else {
+                // Use direct key input if ssh_key_id is not provided
+                tempConnDetails.privateKey = connectionConfig.private_key; // Use private_key from input
+                tempConnDetails.passphrase = connectionConfig.passphrase;
+            }
+        }
+
         // 2. 如果提供了 proxy_id，获取并解密代理信息
         if (connectionConfig.proxy_id) {
             console.log(`SshService: 测试连接需要获取代理 ${connectionConfig.proxy_id} 的信息...`);

packages/backend/src/services/ssh_key.service.ts

@@ -0,0 +1,183 @@
+import * as SshKeyRepository from '../repositories/ssh_key.repository';
+import { encrypt, decrypt } from '../utils/crypto';
+import { SshKeyDbRow, CreateSshKeyData, UpdateSshKeyData } from '../repositories/ssh_key.repository';
+
+// 定义 Service 层返回给 Controller 的基本密钥信息 (不含加密内容)
+export interface SshKeyBasicInfo {
+    id: number;
+    name: string;
+}
+
+// 定义 Service 层创建密钥时的输入类型
+export interface CreateSshKeyInput {
+    name: string;
+    private_key: string; // 明文私钥
+    passphrase?: string; // 明文密码短语 (可选)
+}
+
+// 定义 Service 层更新密钥时的输入类型 (名称必选，凭证可选)
+export interface UpdateSshKeyInput {
+    name?: string; // 名称可选，但通常会提供
+    private_key?: string; // 明文私钥 (可选，表示要更新)
+    passphrase?: string; // 明文密码短语 (可选，如果提供了私钥，则此项也可能需要更新)
+}
+
+// 定义包含解密后凭证的密钥详情
+export interface DecryptedSshKeyDetails extends SshKeyBasicInfo {
+    privateKey: string; // 解密后的私钥
+    passphrase?: string; // 解密后的密码短语
+}
+
+
+/**
+ * 创建新的 SSH 密钥
+ * @param input 包含名称和明文凭证的对象
+ * @returns Promise<SshKeyBasicInfo> 新创建密钥的基本信息
+ */
+export const createSshKey = async (input: CreateSshKeyInput): Promise<SshKeyBasicInfo> => {
+    // 1. 验证输入
+    if (!input.name || !input.private_key) {
+        throw new Error('必须提供密钥名称和私钥内容。');
+    }
+    // 可选：添加更严格的私钥格式验证
+
+    // 2. 加密凭证
+    const encrypted_private_key = encrypt(input.private_key);
+    const encrypted_passphrase = input.passphrase ? encrypt(input.passphrase) : null;
+
+    // 3. 准备仓库数据
+    const dataToSave: CreateSshKeyData = {
+        name: input.name,
+        encrypted_private_key,
+        encrypted_passphrase,
+    };
+
+    // 4. 调用仓库创建记录
+    try {
+        const newId = await SshKeyRepository.createSshKey(dataToSave);
+        return { id: newId, name: input.name };
+    } catch (error: any) {
+        // 处理可能的 UNIQUE constraint 错误
+        if (error.message && error.message.includes('UNIQUE constraint failed: ssh_keys.name')) {
+            throw new Error(`SSH 密钥名称 "${input.name}" 已存在。`);
+        }
+        throw error; // 重新抛出其他错误
+    }
+};
+
+/**
+ * 获取所有 SSH 密钥的基本信息 (ID 和 Name)
+ * @returns Promise<SshKeyBasicInfo[]> 密钥列表
+ */
+export const getAllSshKeyNames = async (): Promise<SshKeyBasicInfo[]> => {
+    return SshKeyRepository.findAllSshKeyNames();
+};
+
+/**
+ * 根据 ID 获取 SSH 密钥的完整数据库行 (包含加密凭证)
+ * 供内部服务使用，例如需要解密的场景
+ * @param id 密钥 ID
+ * @returns Promise<SshKeyDbRow | null> 密钥数据库行或 null
+ */
+export const getSshKeyDbRowById = async (id: number): Promise<SshKeyDbRow | null> => {
+    return SshKeyRepository.findSshKeyById(id);
+};
+
+
+/**
+ * 根据 ID 获取解密后的 SSH 密钥详情
+ * @param id 密钥 ID
+ * @returns Promise<DecryptedSshKeyDetails | null> 解密后的密钥详情或 null
+ */
+export const getDecryptedSshKeyById = async (id: number): Promise<DecryptedSshKeyDetails | null> => {
+    const dbRow = await SshKeyRepository.findSshKeyById(id);
+    if (!dbRow) {
+        return null;
+    }
+
+    try {
+        const privateKey = decrypt(dbRow.encrypted_private_key);
+        const passphrase = dbRow.encrypted_passphrase ? decrypt(dbRow.encrypted_passphrase) : undefined;
+        return {
+            id: dbRow.id,
+            name: dbRow.name,
+            privateKey,
+            passphrase,
+        };
+    } catch (error: any) {
+        console.error(`Service: 解密 SSH 密钥 ${id} 失败:`, error);
+        // 根据策略决定是抛出错误还是返回 null/部分信息
+        throw new Error(`解密 SSH 密钥 ${id} 失败。`);
+    }
+};
+
+
+/**
+ * 更新 SSH 密钥
+ * @param id 要更新的密钥 ID
+ * @param input 包含要更新字段的对象 (明文凭证)
+ * @returns Promise<SshKeyBasicInfo | null> 更新后的密钥基本信息或 null (如果未找到)
+ */
+export const updateSshKey = async (id: number, input: UpdateSshKeyInput): Promise<SshKeyBasicInfo | null> => {
+    // 1. 检查密钥是否存在
+    const existingKey = await SshKeyRepository.findSshKeyById(id);
+    if (!existingKey) {
+        return null; // 未找到
+    }
+
+    // 2. 准备要更新的数据
+    const dataToUpdate: UpdateSshKeyData = {};
+    let finalName = existingKey.name; // 保留现有名称，除非输入中提供了新名称
+
+    if (input.name !== undefined) {
+        if (!input.name) {
+             throw new Error('密钥名称不能为空。');
+        }
+        dataToUpdate.name = input.name;
+        finalName = input.name; // 更新最终名称
+    }
+
+    // 只有当提供了新的私钥时，才更新私钥和密码短语
+    if (input.private_key !== undefined) {
+         if (!input.private_key) {
+             throw new Error('私钥内容不能为空。');
+         }
+        dataToUpdate.encrypted_private_key = encrypt(input.private_key);
+        // 如果更新了私钥，则密码短语也需要更新（即使是设为 null）
+        dataToUpdate.encrypted_passphrase = input.passphrase ? encrypt(input.passphrase) : null;
+    } else if (input.passphrase !== undefined && existingKey.encrypted_private_key) {
+        // 如果只提供了密码短语，且当前存在私钥，则只更新密码短语
+        dataToUpdate.encrypted_passphrase = input.passphrase ? encrypt(input.passphrase) : null;
+    }
+
+
+    // 3. 如果有数据需要更新，则调用仓库
+    if (Object.keys(dataToUpdate).length > 0) {
+        try {
+            const updated = await SshKeyRepository.updateSshKey(id, dataToUpdate);
+            if (!updated) {
+                // 理论上不应发生，因为我们已经检查过存在性
+                throw new Error('更新 SSH 密钥记录失败。');
+            }
+        } catch (error: any) {
+             // 处理可能的 UNIQUE constraint 错误
+             if (error.message && error.message.includes('UNIQUE constraint failed: ssh_keys.name')) {
+                 throw new Error(`SSH 密钥名称 "${input.name}" 已存在。`);
+             }
+             throw error; // 重新抛出其他错误
+        }
+    }
+
+    // 4. 返回更新后的基本信息
+    return { id: id, name: finalName };
+};
+
+/**
+ * 删除 SSH 密钥
+ * @param id 要删除的密钥 ID
+ * @returns Promise<boolean> 是否删除成功
+ */
+export const deleteSshKey = async (id: number): Promise<boolean> => {
+    // 注意：删除密钥前，相关的 connections 表中的 ssh_key_id 会被设为 NULL (ON DELETE SET NULL)
+    return SshKeyRepository.deleteSshKey(id);
+};