feat(security): add editable cloud credential pages

Add dedicated show/edit pages for cloud provider tokens and cloud-init
scripts, including descriptions and UUID routes.

Generate private keys directly from the index and surface cloud provider
API loading errors in server creation flows.

app/Livewire/Security/CloudInitScript/Show.php

@@ -0,0 +1,97 @@
+<?php
+
+namespace App\Livewire\Security\CloudInitScript;
+
+use App\Models\CloudInitScript;
+use App\Rules\ValidCloudInitYaml;
+use Illuminate\Auth\Access\AuthorizationException;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Livewire\Component;
+
+class Show extends Component
+{
+    use AuthorizesRequests;
+
+    public CloudInitScript $cloudInitScript;
+
+    public string $name = '';
+
+    public string $script = '';
+
+    protected function rules(): array
+    {
+        return [
+            'name' => 'required|string|max:255',
+            'script' => ['required', 'string', new ValidCloudInitYaml],
+        ];
+    }
+
+    protected function messages(): array
+    {
+        return [
+            'name.required' => 'Script name is required.',
+            'name.max' => 'Script name cannot exceed 255 characters.',
+            'script.required' => 'Cloud-init script content is required.',
+        ];
+    }
+
+    public function mount(string $cloud_init_script_uuid): void
+    {
+        try {
+            $this->cloudInitScript = CloudInitScript::ownedByCurrentTeam()
+                ->whereUuid($cloud_init_script_uuid)
+                ->firstOrFail();
+
+            $this->authorize('view', $this->cloudInitScript);
+
+            $this->name = $this->cloudInitScript->name;
+            $this->script = $this->cloudInitScript->script;
+        } catch (AuthorizationException) {
+            abort(403, 'You do not have permission to view this cloud-init script.');
+        } catch (\Throwable) {
+            abort(404);
+        }
+    }
+
+    public function save(): void
+    {
+        $this->authorize('update', $this->cloudInitScript);
+        $this->validate();
+
+        $this->cloudInitScript->update([
+            'name' => $this->name,
+            'script' => $this->script,
+        ]);
+
+        auditLog('ui.cloud_init_script.updated', [
+            'team_id' => currentTeam()->id,
+            'cloud_init_script_id' => $this->cloudInitScript->id,
+            'cloud_init_script_name' => $this->cloudInitScript->name,
+        ]);
+
+        $this->dispatch('success', 'Cloud-init script updated successfully.');
+    }
+
+    public function delete(): mixed
+    {
+        $this->authorize('delete', $this->cloudInitScript);
+
+        $scriptId = $this->cloudInitScript->id;
+        $scriptName = $this->cloudInitScript->name;
+
+        $this->cloudInitScript->delete();
+
+        auditLog('ui.cloud_init_script.deleted', [
+            'team_id' => currentTeam()->id,
+            'cloud_init_script_id' => $scriptId,
+            'cloud_init_script_name' => $scriptName,
+        ]);
+
+        return redirectRoute($this, 'security.cloud-init-scripts');
+    }
+
+    public function render()
+    {
+        return view('livewire.security.cloud-init-script.show');
+    }
+}

app/Livewire/Security/CloudInitScripts.php

@@ -27,6 +27,13 @@ class CloudInitScripts extends Component
 
     public function loadScripts()
     {
+        CloudInitScript::ownedByCurrentTeam()
+            ->whereNull('uuid')
+            ->get()
+            ->each(function (CloudInitScript $script): void {
+                $script->forceFill(['uuid' => new_public_id()])->save();
+            });
+
         $this->scripts = CloudInitScript::ownedByCurrentTeam()->orderBy('created_at', 'desc')->get();
     }
 

app/Livewire/Security/CloudProviderToken/Show.php

@@ -0,0 +1,177 @@
+<?php
+
+namespace App\Livewire\Security\CloudProviderToken;
+
+use App\Models\CloudProviderToken;
+use Illuminate\Auth\Access\AuthorizationException;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\Support\Facades\Http;
+use Livewire\Component;
+
+class Show extends Component
+{
+    use AuthorizesRequests;
+
+    public CloudProviderToken $cloudProviderToken;
+
+    public string $name = '';
+
+    public ?string $description = null;
+
+    protected function rules(): array
+    {
+        return [
+            'name' => 'required|string|max:255',
+            'description' => 'nullable|string|max:1000',
+        ];
+    }
+
+    protected function messages(): array
+    {
+        return [
+            'name.required' => 'Token name is required.',
+        ];
+    }
+
+    public function mount(string $cloud_token_uuid): void
+    {
+        try {
+            $this->cloudProviderToken = CloudProviderToken::ownedByCurrentTeam()
+                ->whereUuid($cloud_token_uuid)
+                ->firstOrFail();
+
+            $this->authorize('view', $this->cloudProviderToken);
+
+            $this->name = $this->cloudProviderToken->name;
+            $this->description = $this->cloudProviderToken->description;
+        } catch (AuthorizationException) {
+            abort(403, 'You do not have permission to view this cloud token.');
+        } catch (\Throwable) {
+            abort(404);
+        }
+    }
+
+    public function save(): void
+    {
+        $this->authorize('update', $this->cloudProviderToken);
+        $this->validate();
+
+        $description = trim($this->description ?? '');
+
+        $this->cloudProviderToken->update([
+            'name' => $this->name,
+            'description' => $description === '' ? null : $description,
+        ]);
+
+        auditLog('ui.cloud_token.updated', [
+            'team_id' => currentTeam()->id,
+            'cloud_token_uuid' => $this->cloudProviderToken->uuid,
+            'cloud_token_name' => $this->cloudProviderToken->name,
+            'provider' => $this->cloudProviderToken->provider,
+        ]);
+
+        $this->dispatch('success', 'Cloud provider token updated.');
+    }
+
+    public function validateToken(): void
+    {
+        $this->authorize('view', $this->cloudProviderToken);
+
+        $isValid = match ($this->cloudProviderToken->provider) {
+            'hetzner' => $this->validateHetznerToken($this->cloudProviderToken->token),
+            'digitalocean' => $this->validateDigitalOceanToken($this->cloudProviderToken->token),
+            'vultr' => $this->validateVultrToken($this->cloudProviderToken->token),
+            default => false,
+        };
+
+        $providerName = $this->providerName();
+
+        $this->dispatch(
+            $isValid ? 'success' : 'error',
+            $isValid
+                ? "{$providerName} token is valid."
+                : "{$providerName} token validation failed. Please check the token."
+        );
+
+        auditLog('ui.cloud_token.validated', [
+            'team_id' => currentTeam()->id,
+            'cloud_token_uuid' => $this->cloudProviderToken->uuid,
+            'cloud_token_name' => $this->cloudProviderToken->name,
+            'provider' => $this->cloudProviderToken->provider,
+            'valid' => $isValid,
+        ]);
+    }
+
+    public function delete(): mixed
+    {
+        $this->authorize('delete', $this->cloudProviderToken);
+
+        if ($this->cloudProviderToken->hasServers()) {
+            $serverCount = $this->cloudProviderToken->servers()->count();
+            $this->dispatch('error', "Cannot delete this token. It is currently used by {$serverCount} server(s). Please reassign those servers to a different token first.");
+
+            return null;
+        }
+
+        auditLog('ui.cloud_token.deleted', [
+            'team_id' => currentTeam()->id,
+            'cloud_token_uuid' => $this->cloudProviderToken->uuid,
+            'cloud_token_name' => $this->cloudProviderToken->name,
+            'provider' => $this->cloudProviderToken->provider,
+        ]);
+
+        $this->cloudProviderToken->delete();
+
+        return redirectRoute($this, 'security.cloud-tokens');
+    }
+
+    public function providerName(): string
+    {
+        return match ($this->cloudProviderToken->provider) {
+            'digitalocean' => 'DigitalOcean',
+            'vultr' => 'Vultr',
+            default => 'Hetzner',
+        };
+    }
+
+    private function validateHetznerToken(string $token): bool
+    {
+        try {
+            return Http::withToken($token)
+                ->timeout(10)
+                ->get('https://api.hetzner.cloud/v1/servers?per_page=1')
+                ->successful();
+        } catch (\Throwable) {
+            return false;
+        }
+    }
+
+    private function validateDigitalOceanToken(string $token): bool
+    {
+        try {
+            return Http::withToken($token)
+                ->timeout(10)
+                ->get('https://api.digitalocean.com/v2/account')
+                ->successful();
+        } catch (\Throwable) {
+            return false;
+        }
+    }
+
+    private function validateVultrToken(string $token): bool
+    {
+        try {
+            return Http::withToken($token)
+                ->timeout(10)
+                ->get('https://api.vultr.com/v2/account')
+                ->successful();
+        } catch (\Throwable) {
+            return false;
+        }
+    }
+
+    public function render()
+    {
+        return view('livewire.security.cloud-provider-token.show');
+    }
+}

app/Livewire/Security/CloudProviderTokenForm.php

@@ -22,6 +22,8 @@ class CloudProviderTokenForm extends Component
 
     public string $name = '';
 
+    public ?string $description = null;
+
     public function mount()
     {
         try {
@@ -37,6 +39,7 @@ class CloudProviderTokenForm extends Component
             'provider' => 'required|string|in:hetzner,digitalocean,vultr',
             'token' => 'required|string',
             'name' => 'required|string|max:255',
+            'description' => 'nullable|string|max:1000',
         ];
     }
 
@@ -94,11 +97,14 @@ class CloudProviderTokenForm extends Component
                 return $this->dispatch('error', 'Invalid API token. Please check your token and try again.');
             }
 
+            $description = trim($this->description ?? '');
+
             $savedToken = CloudProviderToken::create([
                 'team_id' => currentTeam()->id,
                 'provider' => $this->provider,
                 'token' => $this->token,
                 'name' => $this->name,
+                'description' => $description === '' ? null : $description,
             ]);
 
             auditLog('ui.cloud_token.created', [
@@ -108,7 +114,7 @@ class CloudProviderTokenForm extends Component
                 'provider' => $savedToken->provider,
             ]);
 
-            $this->reset(['token', 'name']);
+            $this->reset(['token', 'name', 'description']);
 
             // Dispatch event with token ID so parent components can react
             $this->dispatch('tokenAdded', tokenId: $savedToken->id);

app/Livewire/Security/PrivateKey/Create.php

@@ -43,22 +43,6 @@ class Create extends Component
         );
     }
 
-    public function generateNewRSAKey()
-    {
-        $this->generateNewKey('rsa');
-    }
-
-    public function generateNewEDKey()
-    {
-        $this->generateNewKey('ed25519');
-    }
-
-    private function generateNewKey($type)
-    {
-        $keyData = PrivateKey::generateNewKeyPair($type);
-        $this->setKeyData($keyData);
-    }
-
     public function updated($property)
     {
         if ($property === 'value') {
@@ -93,14 +77,6 @@ class Create extends Component
         }
     }
 
-    private function setKeyData(array $keyData)
-    {
-        $this->name = $keyData['name'];
-        $this->description = $keyData['description'];
-        $this->value = $keyData['private_key'];
-        $this->publicKey = $keyData['public_key'];
-    }
-
     private function validatePrivateKey()
     {
         $validationResult = PrivateKey::validateAndExtractPublicKey($this->value);

app/Livewire/Security/PrivateKey/Index.php

@@ -10,6 +10,31 @@ class Index extends Component
 {
     use AuthorizesRequests;
 
+    public function generatePrivateKey(string $type)
+    {
+        try {
+            $this->authorize('create', PrivateKey::class);
+
+            if (! in_array($type, ['ed25519', 'rsa'], true)) {
+                $this->dispatch('error', 'Invalid private key type.');
+
+                return;
+            }
+
+            $keyData = PrivateKey::generateNewKeyPair($type);
+            $privateKey = PrivateKey::createAndStore([
+                'name' => $keyData['name'],
+                'description' => $keyData['description'],
+                'private_key' => $keyData['private_key'],
+                'team_id' => currentTeam()->id,
+            ]);
+
+            return redirectRoute($this, 'security.private-key.show', ['private_key_uuid' => $privateKey->uuid]);
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
+    }
+
     public function render()
     {
         $privateKeys = PrivateKey::ownedByCurrentTeam(['name', 'uuid', 'is_git_related', 'description', 'team_id'])->get();

app/Livewire/Server/New/ByDigitalOcean.php

@@ -12,6 +12,7 @@ use App\Rules\ValidCloudInitYaml;
 use App\Rules\ValidHostname;
 use App\Services\DigitalOceanService;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\Http\Client\RequestException;
 use Illuminate\Support\Collection;
 use Livewire\Attributes\Locked;
 use Livewire\Component;
@@ -57,6 +58,8 @@ class ByDigitalOcean extends Component
 
     public bool $loading_data = false;
 
+    public ?string $provider_data_error = null;
+
     public bool $enable_ipv6 = true;
 
     public bool $monitoring = true;
@@ -264,6 +267,7 @@ class ByDigitalOcean extends Component
         }
 
         $this->loading_data = true;
+        $this->provider_data_error = null;
 
         try {
             $digitalOceanService = new DigitalOceanService($token);
@@ -278,10 +282,22 @@ class ByDigitalOcean extends Component
             $this->loading_data = false;
         } catch (\Throwable $e) {
             $this->loading_data = false;
-            throw $e;
+            $this->provider_data_error = $this->providerDataErrorMessage('DigitalOcean', $e, 'message');
+            $this->dispatch('error', $this->provider_data_error);
         }
     }
 
+    private function providerDataErrorMessage(string $providerName, \Throwable $e, string $jsonMessageKey): string
+    {
+        $details = $e->getMessage();
+
+        if ($e instanceof RequestException && $e->response) {
+            $details = data_get($e->response->json(), $jsonMessageKey) ?: $e->response->body() ?: $details;
+        }
+
+        return "{$providerName} API error: {$details}";
+    }
+
     public function getAvailableSizesProperty(): array
     {
         if (! $this->selected_region) {

app/Livewire/Server/New/ByHetzner.php

@@ -12,6 +12,7 @@ use App\Rules\ValidCloudInitYaml;
 use App\Rules\ValidHostname;
 use App\Services\HetznerService;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\Http\Client\RequestException;
 use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\Http;
 use Livewire\Attributes\Locked;
@@ -70,6 +71,8 @@ class ByHetzner extends Component
 
     public bool $loading_data = false;
 
+    public ?string $provider_data_error = null;
+
     public bool $enable_ipv4 = true;
 
     public bool $enable_ipv6 = true;
@@ -310,6 +313,7 @@ class ByHetzner extends Component
         }
 
         $this->loading_data = true;
+        $this->provider_data_error = null;
         $this->selectedHetznerSshKeyIds = [];
         $this->selectedHetznerFirewallIds = [];
         $this->selectedHetznerNetworkIds = [];
@@ -353,10 +357,22 @@ class ByHetzner extends Component
             $this->loading_data = false;
         } catch (\Throwable $e) {
             $this->loading_data = false;
-            throw $e;
+            $this->provider_data_error = $this->providerDataErrorMessage('Hetzner', $e, 'error.message');
+            $this->dispatch('error', $this->provider_data_error);
         }
     }
 
+    private function providerDataErrorMessage(string $providerName, \Throwable $e, string $jsonMessageKey): string
+    {
+        $details = $e->getMessage();
+
+        if ($e instanceof RequestException && $e->response) {
+            $details = data_get($e->response->json(), $jsonMessageKey) ?: $e->response->body() ?: $details;
+        }
+
+        return "{$providerName} API error: {$details}";
+    }
+
     private function getCpuVendorInfo(array $serverType): ?string
     {
         $name = strtolower($serverType['name'] ?? '');

app/Livewire/Server/New/ByVultr.php

@@ -12,6 +12,7 @@ use App\Rules\ValidCloudInitYaml;
 use App\Rules\ValidHostname;
 use App\Services\VultrService;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\Http\Client\RequestException;
 use Illuminate\Support\Collection;
 use Livewire\Attributes\Locked;
 use Livewire\Component;
@@ -57,6 +58,8 @@ class ByVultr extends Component
 
     public bool $loading_data = false;
 
+    public ?string $provider_data_error = null;
+
     public bool $enable_ipv6 = true;
 
     public bool $disable_public_ipv4 = false;
@@ -334,6 +337,7 @@ class ByVultr extends Component
         }
 
         $this->loading_data = true;
+        $this->provider_data_error = null;
 
         try {
             $vultrService = new VultrService($token);
@@ -357,10 +361,22 @@ class ByVultr extends Component
             $this->loading_data = false;
         } catch (\Throwable $e) {
             $this->loading_data = false;
-            throw $e;
+            $this->provider_data_error = $this->providerDataErrorMessage('Vultr', $e, 'error');
+            $this->dispatch('error', $this->provider_data_error);
         }
     }
 
+    private function providerDataErrorMessage(string $providerName, \Throwable $e, string $jsonMessageKey): string
+    {
+        $details = $e->getMessage();
+
+        if ($e instanceof RequestException && $e->response) {
+            $details = data_get($e->response->json(), $jsonMessageKey) ?: $e->response->body() ?: $details;
+        }
+
+        return "{$providerName} API error: {$details}";
+    }
+
     private function createVultrServer(string $token): array
     {
         $vultrService = new VultrService($token);

app/Models/CloudInitScript.php

@@ -2,9 +2,7 @@
 
 namespace App\Models;
 
-use Illuminate\Database\Eloquent\Model;
-
-class CloudInitScript extends Model
+class CloudInitScript extends BaseModel
 {
     protected $fillable = [
         'team_id',

app/Models/CloudProviderToken.php

@@ -13,6 +13,7 @@ class CloudProviderToken extends BaseModel
         'provider',
         'token',
         'name',
+        'description',
     ];
 
     protected $hidden = [

app/Models/PrivateKey.php

@@ -291,7 +291,7 @@ class PrivateKey extends BaseModel
 
     public function getKeyLocation()
     {
-        return "/var/www/html/storage/app/ssh/keys/ssh_key@{$this->uuid}";
+        return Storage::disk('ssh-keys')->path("ssh_key@{$this->uuid}");
     }
 
     public function updatePrivateKey(array $data)