Bring back ssh host read permission

backend/src/ee/routes/v1/ssh-host-router.ts

@@ -412,7 +412,7 @@ export const registerSshHostRouter = async (server: FastifyZodProvider) => {
         sshHostId: z.string().trim().describe(SSH_HOSTS.GET_USER_CA_PUBLIC_KEY.sshHostId)
       }),
       response: {
-        200: z.string()
+        200: z.string().describe(SSH_HOSTS.GET_USER_CA_PUBLIC_KEY.publicKey)
       }
     },
     handler: async (req) => {
@@ -433,7 +433,7 @@ export const registerSshHostRouter = async (server: FastifyZodProvider) => {
         sshHostId: z.string().trim().describe(SSH_HOSTS.GET_HOST_CA_PUBLIC_KEY.sshHostId)
       }),
       response: {
-        200: z.string()
+        200: z.string().describe(SSH_HOSTS.GET_HOST_CA_PUBLIC_KEY.publicKey)
       }
     },
     handler: async (req) => {

backend/src/ee/services/permission/project-permission.ts

@@ -68,6 +68,7 @@ export enum ProjectPermissionGroupActions {
 }
 
 export enum ProjectPermissionSshHostActions {
+  Read = "read",
   Create = "create",
   Edit = "edit",
   Delete = "delete",
@@ -657,6 +658,7 @@ const buildAdminPermissionRules = () => {
   can(
     [
       ProjectPermissionSshHostActions.Edit,
+      ProjectPermissionSshHostActions.Read,
       ProjectPermissionSshHostActions.Create,
       ProjectPermissionSshHostActions.Delete,
       ProjectPermissionSshHostActions.IssueHostCert
@@ -924,6 +926,8 @@ const buildMemberPermissionRules = () => {
   can([ProjectPermissionActions.Create], ProjectPermissionSub.SshCertificates);
   can([ProjectPermissionActions.Read], ProjectPermissionSub.SshCertificateTemplates);
 
+  can([ProjectPermissionSshHostActions.Read], ProjectPermissionSub.SshHosts);
+
   can(
     [
       ProjectPermissionCmekActions.Create,

backend/src/ee/services/ssh-host/ssh-host-service.ts

@@ -415,7 +415,7 @@ export const sshHostServiceFactory = ({
       });
     }
 
-    await permissionService.getProjectPermission({
+    const { permission } = await permissionService.getProjectPermission({
       actor,
       actorId,
       projectId: host.projectId,
@@ -424,6 +424,13 @@ export const sshHostServiceFactory = ({
       actionProjectType: ActionProjectType.SSH
     });
 
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionSshHostActions.Read,
+      subject(ProjectPermissionSub.SshHosts, {
+        hostname: host.hostname
+      })
+    );
+
     return host;
   };
 

backend/src/ee/services/ssh/ssh-certificate-authority-fns.ts

@@ -430,7 +430,8 @@ export const validateExternalSshCaKeyPair = async (publicKey: string, privateKey
 
   if (publicKey.trim() !== derivedPublicKey.trim()) {
     throw new BadRequestError({
-      message: "Failed to validate matching SSH key pair."
+      message:
+        "Failed to validate matching SSH key pair: The provided public key does not match the public key derived from the private key."
     });
   }