impl improvements according to greptile

backend/src/db/migrations/20250418003930_ssh-nullable-ca-defaults.ts

@@ -7,19 +7,25 @@ export async function up(knex: Knex): Promise<void> {
   const hasDefaultHostCaCol = await knex.schema.hasColumn(TableName.ProjectSshConfig, "defaultHostSshCaId");
 
   if (hasDefaultUserCaCol && hasDefaultHostCaCol) {
-    await knex.schema.alterTable(TableName.ProjectSshConfig, (t) => {
+    await knex.transaction(async (trx) => {
-      t.dropForeign(["defaultUserSshCaId"]);
+      await trx.schema.alterTable(TableName.ProjectSshConfig, (t) => {
-      t.dropForeign(["defaultHostSshCaId"]);
+        t.dropForeign(["defaultUserSshCaId"]);
-    });
+        t.dropForeign(["defaultHostSshCaId"]);
-
+      });
-    await knex.schema.alterTable(TableName.ProjectSshConfig, (t) => {
+      await trx.schema.alterTable(TableName.ProjectSshConfig, (t) => {
-      // allow nullable (does not wipe existing values)
+        // allow nullable (does not wipe existing values)
-      t.uuid("defaultUserSshCaId").nullable().alter();
+        t.uuid("defaultUserSshCaId").nullable().alter();
-      t.uuid("defaultHostSshCaId").nullable().alter();
+        t.uuid("defaultHostSshCaId").nullable().alter();
-
+        // re-add with SET NULL behavior (previously CASCADE)
-      // re-add with SET NULL behavior (previously CASCADE)
+        t.foreign("defaultUserSshCaId")
-      t.foreign("defaultUserSshCaId").references("id").inTable(TableName.SshCertificateAuthority).onDelete("SET NULL");
+          .references("id")
-      t.foreign("defaultHostSshCaId").references("id").inTable(TableName.SshCertificateAuthority).onDelete("SET NULL");
+          .inTable(TableName.SshCertificateAuthority)
+          .onDelete("SET NULL");
+        t.foreign("defaultHostSshCaId")
+          .references("id")
+          .inTable(TableName.SshCertificateAuthority)
+          .onDelete("SET NULL");
+      });
     });
   }
 

docs/cli/commands/ssh.mdx

@@ -26,12 +26,12 @@ This command enables you to obtain SSH credentials used to access a remote host.
         The login user for the SSH connection. If not provided, you will be prompted to select from available login users.
     </Accordion>
     <Accordion title="--writeHostCaToFile">
-        Whether to write the Host CA public key to ~/.ssh/known_hosts if it doesn't already exist.
+        Whether to write the Host CA public key to `~/.ssh/known_hosts` if it doesn't already exist.
 
         Default value: `true`
     </Accordion>
     <Accordion title="--outFilePath">
-        The path to write the SSH credentials to such as ~/.ssh, ./some_folder, ./some_folder/id_rsa-cert.pub. If not provided, the credentials will be added to the SSH agent and used to establish an interactive SSH connection.
+        The path to write the SSH credentials to such as `~/.ssh`, `./some_folder`, `./some_folder/id_rsa-cert.pub`. If not provided, the credentials will be added to the SSH agent and used to establish an interactive SSH connection.
     </Accordion>
     <Accordion title="--token">
         An authenticated token to use to authenticate with Infisical.

frontend/src/pages/ssh/SettingsPage/components/ProjectSshTab/components/ProjectSshConfigCasSection.tsx

@@ -15,8 +15,8 @@ import {
 
 const schema = z
   .object({
-    defaultUserSshCaId: z.string().optional(),
+    defaultUserSshCaId: z.string(),
-    defaultHostSshCaId: z.string().optional()
+    defaultHostSshCaId: z.string()
   })
   .required();
 
@@ -40,8 +40,8 @@ export const ProjectSshConfigCasSection = () => {
   useEffect(() => {
     if (sshConfig) {
       reset({
-        defaultUserSshCaId: sshConfig.defaultUserSshCaId || undefined,
+        defaultUserSshCaId: sshConfig.defaultUserSshCaId || "",
-        defaultHostSshCaId: sshConfig.defaultHostSshCaId || undefined
+        defaultHostSshCaId: sshConfig.defaultHostSshCaId || ""
       });
     }
   }, [sshConfig]);