feat(server): improve private key and cloud link flows

Add server private key generation from the dropdown, prevent deleting
private keys that are still in use, and close cloud provider link modals
after successful linking.

tests/Feature/CloudProviderLinkDropdownTest.php

@@ -0,0 +1,192 @@
+<?php
+
+use App\Livewire\Server\Show;
+use App\Models\CloudProviderToken;
+use App\Models\InstanceSettings;
+use App\Models\Server;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Http;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    config([
+        'app.maintenance.driver' => 'file',
+        'cache.default' => 'array',
+        'session.driver' => 'array',
+    ]);
+
+    InstanceSettings::unguarded(fn () => InstanceSettings::query()->create([
+        'id' => 0,
+        'is_api_enabled' => true,
+    ]));
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'ip' => '1.2.3.4',
+    ]);
+});
+
+it('shows link cloud provider dropdown with available unlinked providers', function () {
+    CloudProviderToken::query()->create([
+        'team_id' => $this->team->id,
+        'provider' => 'hetzner',
+        'token' => 'test-hetzner-token',
+        'name' => 'Test Hetzner Token',
+    ]);
+
+    CloudProviderToken::query()->create([
+        'team_id' => $this->team->id,
+        'provider' => 'vultr',
+        'token' => 'test-vultr-token',
+        'name' => 'Test Vultr Token',
+    ]);
+
+    CloudProviderToken::query()->create([
+        'team_id' => $this->team->id,
+        'provider' => 'digitalocean',
+        'token' => 'test-digitalocean-token',
+        'name' => 'Test DigitalOcean Token',
+    ]);
+
+    Livewire::test(Show::class, ['server_uuid' => $this->server->uuid])
+        ->assertSee('Link Cloud Provider')
+        ->assertSee('Hetzner')
+        ->assertSee('DigitalOcean')
+        ->assertSee('Vultr')
+        ->assertSee('Hetzner Token')
+        ->assertSee('DigitalOcean Token')
+        ->assertSee('Vultr Token')
+        ->assertSee('Server ID')
+        ->assertSee('Droplet ID')
+        ->assertSee('Instance ID')
+        ->assertSee('Search by IP')
+        ->assertSee('Search');
+});
+
+it('hides link cloud provider dropdown when no providers can be linked', function () {
+    Livewire::test(Show::class, ['server_uuid' => $this->server->uuid])
+        ->assertDontSee('Link Cloud Provider');
+});
+
+it('does not list providers already linked to the server', function () {
+    CloudProviderToken::query()->create([
+        'team_id' => $this->team->id,
+        'provider' => 'hetzner',
+        'token' => 'test-hetzner-token',
+        'name' => 'Test Hetzner Token',
+    ]);
+
+    CloudProviderToken::query()->create([
+        'team_id' => $this->team->id,
+        'provider' => 'vultr',
+        'token' => 'test-vultr-token',
+        'name' => 'Test Vultr Token',
+    ]);
+
+    $this->server->update(['hetzner_server_id' => 123]);
+
+    Livewire::test(Show::class, ['server_uuid' => $this->server->uuid])
+        ->assertSee('Link Cloud Provider')
+        ->assertSee('Vultr Token')
+        ->assertDontSee('Hetzner Token');
+});
+
+it('shows Hetzner search by IP errors in the modal', function () {
+    $token = CloudProviderToken::query()->create([
+        'team_id' => $this->team->id,
+        'provider' => 'hetzner',
+        'token' => 'invalid-hetzner-token',
+        'name' => 'Invalid Hetzner Token',
+    ]);
+
+    Http::fake([
+        'https://api.hetzner.cloud/v1/servers*' => Http::response([
+            'error' => ['message' => 'invalid token'],
+        ], 401),
+    ]);
+
+    Livewire::test(Show::class, ['server_uuid' => $this->server->uuid])
+        ->set('selectedHetznerTokenId', $token->id)
+        ->call('searchHetznerServer')
+        ->assertSet('hetznerSearchError', fn (string $error) => str_contains($error, 'Failed to search Hetzner servers:') && str_contains($error, 'invalid token'))
+        ->assertSee('Failed to search Hetzner servers:')
+        ->assertSee('invalid token');
+});
+
+it('shows Hetzner search by ID errors in the modal', function () {
+    $token = CloudProviderToken::query()->create([
+        'team_id' => $this->team->id,
+        'provider' => 'hetzner',
+        'token' => 'invalid-hetzner-token',
+        'name' => 'Invalid Hetzner Token',
+    ]);
+
+    Http::fake([
+        'https://api.hetzner.cloud/v1/servers/12345678' => Http::response([
+            'error' => ['message' => 'invalid token'],
+        ], 401),
+    ]);
+
+    Livewire::test(Show::class, ['server_uuid' => $this->server->uuid])
+        ->set('selectedHetznerTokenId', $token->id)
+        ->set('manualHetznerServerId', '12345678')
+        ->call('searchHetznerServerById')
+        ->assertSet('hetznerSearchError', fn (string $error) => str_contains($error, 'Failed to fetch Hetzner server:') && str_contains($error, 'invalid token'))
+        ->assertSee('Failed to fetch Hetzner server:')
+        ->assertSee('invalid token');
+});
+
+it('shows DigitalOcean search errors in the modal', function () {
+    $token = CloudProviderToken::query()->create([
+        'team_id' => $this->team->id,
+        'provider' => 'digitalocean',
+        'token' => 'invalid-digitalocean-token',
+        'name' => 'Invalid DigitalOcean Token',
+    ]);
+
+    Http::fake([
+        'https://api.digitalocean.com/v2/droplets*' => Http::response([
+            'message' => 'invalid token',
+        ], 401),
+    ]);
+
+    Livewire::test(Show::class, ['server_uuid' => $this->server->uuid])
+        ->set('selectedDigitalOceanTokenId', $token->id)
+        ->call('searchDigitalOceanDroplet')
+        ->assertSet('digitalOceanSearchError', fn (string $error) => str_contains($error, 'Failed to search DigitalOcean droplets:') && str_contains($error, 'invalid token'))
+        ->assertSee('Failed to search DigitalOcean droplets:')
+        ->assertSee('invalid token');
+});
+
+it('shows Vultr search errors in the modal', function () {
+    $token = CloudProviderToken::query()->create([
+        'team_id' => $this->team->id,
+        'provider' => 'vultr',
+        'token' => 'invalid-vultr-token',
+        'name' => 'Invalid Vultr Token',
+    ]);
+
+    Http::fake([
+        'https://api.vultr.com/v2/instances*' => Http::response([
+            'error' => 'invalid token',
+        ], 401),
+    ]);
+
+    Livewire::test(Show::class, ['server_uuid' => $this->server->uuid])
+        ->set('selectedVultrTokenId', $token->id)
+        ->call('searchVultrInstance')
+        ->assertSet('vultrSearchError', fn (string $error) => str_contains($error, 'Failed to search Vultr instances:') && str_contains($error, 'invalid token'))
+        ->assertSee('Failed to search Vultr instances:')
+        ->assertSee('invalid token');
+});

tests/Feature/Security/PrivateKeyDropdownTest.php

@@ -2,8 +2,10 @@
 
 use App\Livewire\Security\PrivateKey\Create;
 use App\Livewire\Security\PrivateKey\Index;
+use App\Livewire\Security\PrivateKey\Show;
 use App\Models\InstanceSettings;
 use App\Models\PrivateKey;
+use App\Models\Server;
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
@@ -95,3 +97,38 @@ test('github app badge appears before the save button in the title row', functio
         ->and($view)->toContain('<x-forms.button canGate="update" :canResource="$private_key" type="submit">')
         ->and($badgePosition)->toBeLessThan($saveButtonPosition);
 });
+
+test('used private key details disable delete with an explanation', function () {
+    $privateKey = PrivateKey::factory()->create([
+        'team_id' => $this->team->id,
+    ]);
+
+    Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $privateKey->id,
+    ]);
+
+    $this->get(route('security.private-key.show', [
+        'private_key_uuid' => $privateKey->uuid,
+    ]))
+        ->assertSuccessful()
+        ->assertSee('This private key is currently used by a server, application, or Git app and cannot be deleted.', false)
+        ->assertSee('disabled', false);
+});
+
+test('used private key delete action keeps the key and shows an error', function () {
+    $privateKey = PrivateKey::factory()->create([
+        'team_id' => $this->team->id,
+    ]);
+
+    Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $privateKey->id,
+    ]);
+
+    Livewire::test(Show::class, ['private_key_uuid' => $privateKey->uuid])
+        ->call('delete')
+        ->assertDispatched('error');
+
+    expect($privateKey->fresh())->not->toBeNull();
+});

tests/Feature/ServerPrivateKeyDropdownTest.php

@@ -0,0 +1,100 @@
+<?php
+
+use App\Livewire\Server\PrivateKey\Show;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\Server;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Config;
+use Illuminate\Support\Facades\Storage;
+use Illuminate\Support\Once;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    if (! InstanceSettings::query()->whereKey(0)->exists()) {
+        $settings = new InstanceSettings;
+        $settings->id = 0;
+        $settings->save();
+    }
+
+    Once::flush();
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    session(['currentTeam' => $this->team]);
+    $this->actingAs($this->user);
+
+    Config::set('cache.default', 'array');
+    Storage::fake('ssh-keys');
+
+    $this->currentPrivateKey = PrivateKey::factory()->create([
+        'team_id' => $this->team->id,
+    ]);
+
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $this->currentPrivateKey->id,
+    ]);
+});
+
+test('server private key page shows highlighted add dropdown actions', function () {
+    Livewire::test(Show::class, ['server_uuid' => $this->server->uuid])
+        ->assertSee('+ Add')
+        ->assertSee('Generate ED25519')
+        ->assertSee('Generate RSA')
+        ->assertSee('Add manually')
+        ->assertSee('Check connection');
+});
+
+test('generating a server private key stores it and refreshes the current view', function () {
+    $component = Livewire::test(Show::class, ['server_uuid' => $this->server->uuid])
+        ->call('generatePrivateKey', 'ed25519')
+        ->assertNoRedirect()
+        ->assertDispatched('success');
+
+    $privateKey = PrivateKey::query()
+        ->where('id', '!=', $this->currentPrivateKey->id)
+        ->firstOrFail();
+
+    expect($privateKey->team_id)->toBe($this->team->id)
+        ->and($privateKey->public_key)->toStartWith('ssh-ed25519');
+
+    $component
+        ->assertDispatched('copyPublicKeyToClipboard', publicKey: $privateKey->public_key)
+        ->assertSee($privateKey->name);
+});
+
+test('server private key page copies generated public keys and shows a copied hint', function () {
+    $view = file_get_contents(resource_path('views/livewire/server/private-key/show.blade.php'));
+
+    expect($view)->toContain('copyPublicKeyToClipboard')
+        ->and($view)->toContain('navigator.clipboard.writeText')
+        ->and($view)->toContain('Public key copied to clipboard.');
+});
+
+test('server private key cards include a copy public key button', function () {
+    $keyData = PrivateKey::generateNewKeyPair('rsa');
+
+    PrivateKey::createAndStore([
+        'team_id' => $this->team->id,
+        'name' => 'Alternative SSH Key',
+        'description' => 'Created by test',
+        'private_key' => $keyData['private_key'],
+    ]);
+
+    Livewire::test(Show::class, ['server_uuid' => $this->server->uuid])
+        ->assertSee('Copy public key')
+        ->assertSee('Alternative SSH Key');
+
+    $view = file_get_contents(resource_path('views/livewire/server/private-key/show.blade.php'));
+
+    expect($view)->toContain('Copy public key')
+        ->and($view)->toContain('$private_key->public_key')
+        ->and($view)->toContain('Public key copied to clipboard.');
+});