fix: Split SSH gateway key into separate host and user keys

[minhtule]

Related Tickets & Documents

• Issue: Split SSH gateway key into separate host and user keys #350

Changes

• Generate separate host and user keypairs instead of one shared gateway key

[codecov]

Codecov Report

❌ Patch coverage is 81.81818% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 85.94%. Comparing base (ae1a656) to head (7d8c199).
⚠️ Report is 1 commits behind head on master.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
internal/sshhandler/config.go	80.95%	3 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #351      +/-   ##
==========================================
- Coverage   86.07%   85.94%   -0.14%     
==========================================
  Files          40       40              
  Lines        2830     2832       +2     
==========================================
- Hits         2436     2434       -2     
- Misses        269      272       +3     
- Partials      125      126       +1     

Flag	Coverage Δ
integration	54.89% <72.72%> (+0.03%)	⬆️
unit	78.42% <81.81%> (-0.13%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
internal/sshhandler/keys.go	80.64% <100.00%> (ø)
internal/sshhandler/config.go	79.68% <80.95%> (-1.27%)	⬇️

... and 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

This PR addresses Issue #350 by reducing key-compromise blast radius in the SSH gateway: it replaces the single shared gateway keypair with two distinct keypairs—one for host certificates (downstream) and one for user certificates (upstream).

Changes:

• Split the gateway keypair into separate host and user signers/public keys in Config.
• Generate independent host/user keypairs during config initialization.
• Extend NewConfig unit test coverage to assert the two keys are distinct.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
internal/sshhandler/config.go	Replaces shared gateway key material with separate host/user keys and wires them into downstream/upstream certificate flows.
internal/sshhandler/config_test.go	Adds assertions ensuring host and user keys are both generated and distinct.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

[minhtule]

There is an existing bug that is also fixed with this change: the old code constructs keyConfig instance directly instead of using the constructor newKeyConfig. As such, key type in SSH format like ssh-ed25519 is treated as error.

[minhtule]

Move this default to newKeyConfig constructor because it's more appropriate and also testable.

[clement0010]

LGTM 👍🏻