feat: per-host SSH credential management + in-place credential editing (#595)

* feat(credentials): add PATCH /credentials/{id} in-place update

Adds a true partial-update endpoint for SSH credentials, replacing the
frontend's create-then-delete workaround. Omitted secret fields keep the
stored ciphertext (no re-entry needed); narrowing auth_method nulls the
now-unused secret and revalidates the required secret set. Setting
is_default=true on a system credential atomically demotes the prior
default. scope/scope_id remain immutable.

- credential.Update service method (single-tx, FOR UPDATE, auto-demote)
- PatchCredentialByID handler (credential:write, CredentialUpdated audit)
- openapi CredentialUpdateRequest + regenerated Go/TS stubs
- credential.updated audit event
- api-credentials spec v1.2.0: C-06..C-08, AC-16..AC-21 (+6 passing tests)
- fix post-promotion .gitignore: *credential* caught internal/credential/

* feat(settings): in-place Edit credential via PATCH

Replaces the create-then-delete Replace workaround with a real in-place
edit against PATCH /credentials/{id}. The 'no PATCH endpoint' warning
banner and the orphan/two-phase logic are gone. Secret fields left blank
keep the stored ciphertext (labelled 'leave blank to keep current'), so
editing name/username/auth_method no longer forces re-entry of the key
or password.

- ReplaceCredentialModal -> EditCredentialModal (single PATCH call)
- credentialEditSchema makes secrets optional (blank = keep)
- CredentialsPage: Edit labels, EditCredentialModal wiring
- frontend-settings spec v1.9.0 scope bullets

* feat(host-detail): per-host credential management + live Reconnect

Wires the three deferred host-page controls onto the new credential and
discovery endpoints.

- HostCredentialModal: shared per-host credential surface. Reads the
  resolved source (POST /credentials:resolve) and switches a host between
  the system default and a host-specific override using the tier model:
  clone the default (keeps the secret), set a different host credential,
  edit the override in place (PATCH), or revert (DELETE). Mutations gated
  on credential:write; viewers see the source read-only.
- Connectivity card: Auth row now shows the resolved credential name +
  source tag (was a hardcoded 'system_default'); 'Edit credentials' opens
  the modal; 'Reconnect' calls POST /hosts/{id}/discovery:run (synchronous
  OS discovery, bypasses the scan queue, validates the SSH credential; 502
  surfaces a credential failure).
- EditHostModal: adds a 'Manage SSH credential' link into the same modal.
- export shared form pieces from CredentialMutations for reuse.
- frontend-host-detail spec v1.6.0: C-11, C-12, AC-40..AC-42 (+3 tests).

* docs(changelog): note credential editing + host credential management + Reconnect

* style(host-detail): apply prettier formatting

Author: remyluslosius

.gitignore

@@ -604,6 +604,18 @@ cache/
 # applies for genuine build artifacts (dist/, openapi_embed.yaml).
 !app/**
 
+# The Go tree was promoted from app/ to the repo root (2026-06-05), so the
+# !app/** negation above no longer reaches it. The safety-net name patterns
+# (*credential*, *secret*) wrongly catch these Go source package directories —
+# they are source code, not secrets. Genuine build artifacts under internal/
+# are ignored by their own explicit rules further down (internal/server/
+# openapi_embed.yaml, internal/server/spa/), so this negation does not expose
+# them.
+!internal/credential/
+!internal/credential/**
+!internal/secretkey/
+!internal/secretkey/**
+
 # Configuration files that might contain secrets
 *config.local.*
 *settings.local.*

CHANGELOG.md

@@ -10,8 +10,25 @@ Versioning: [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+### Added
+
+- SSH credentials can now be edited in place. The Settings credentials page
+  updates a credential directly instead of deleting and recreating it, so
+  changing a name, username, or authentication method no longer forces you to
+  re-enter the key or password. Leave a secret field blank to keep the stored
+  one.
+- Per-host SSH credential management from the host detail page. A host can be
+  given its own credential, have that credential edited in place, or be reverted
+  to the workspace default, all from the host Edit dialog and the Connectivity
+  card's Edit credentials link.
+- A Reconnect action on the host Connectivity card runs OS discovery
+  immediately, ahead of the scan queue, so you can confirm a host is reachable
+  and its SSH credential works right after changing it.
+
 ### Changed
 
+- The host Connectivity card now shows the credential the host actually uses
+  (its own override or the workspace default) instead of a fixed label.
 - Updated the bundled Kensa scan engine and rule corpus to v0.5.0. v0.5.0 adds
   native sudo-with-password support for hosts where passwordless sudo is
   disallowed (a common CIS/STIG control); the change is backward-compatible and

api/openapi.yaml

@@ -658,6 +658,47 @@ paths:
           content:
             application/json:
               schema: {$ref: '#/components/schemas/ErrorEnvelope'}
+    patch:
+      operationId: patchCredentialByID
+      summary: Update a credential in place
+      description: >
+        Partial update of an existing active credential. Only the fields
+        present in the body change; omitted fields are left untouched.
+        Secret material (password, private_key, private_key_passphrase)
+        is re-encrypted only when a non-empty value is supplied — omitting
+        a secret keeps the stored ciphertext, so metadata can be edited
+        without re-entering the key or password. scope and scope_id are
+        immutable. Setting is_default=true on a system credential atomically
+        demotes the previous system default.
+      x-required-permission: credential:write
+      parameters:
+        - {name: id, in: path, required: true, schema: {type: string, format: uuid}}
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: {$ref: '#/components/schemas/CredentialUpdateRequest'}
+      responses:
+        '200':
+          description: Updated credential metadata
+          content:
+            application/json:
+              schema: {$ref: '#/components/schemas/CredentialResponse'}
+        '400':
+          description: Validation failure (unknown auth_method, missing required secret)
+          content:
+            application/json:
+              schema: {$ref: '#/components/schemas/ErrorEnvelope'}
+        '404':
+          description: Credential not found or already soft-deleted
+          content:
+            application/json:
+              schema: {$ref: '#/components/schemas/ErrorEnvelope'}
+        '409':
+          description: is_default=true collides with an existing system default
+          content:
+            application/json:
+              schema: {$ref: '#/components/schemas/ErrorEnvelope'}
     delete:
       operationId: deleteCredentialByID
       summary: Soft-delete a credential
@@ -4030,6 +4071,23 @@ components:
         private_key_passphrase: {type: string}
         is_default:             {type: boolean}
 
+    # Partial update shape. Every field is optional; only the fields
+    # present are changed. Omitting a secret keeps the stored ciphertext,
+    # so metadata can be edited without re-entering the key or password.
+    # scope and scope_id are intentionally absent — a credential's scope
+    # is immutable.
+    CredentialUpdateRequest:
+      type: object
+      properties:
+        name:                   {type: string, minLength: 1, maxLength: 256}
+        description:            {type: string, maxLength: 1024}
+        username:               {type: string, minLength: 1, maxLength: 256}
+        auth_method:            {type: string, enum: [ssh_key, password, both]}
+        password:               {type: string, description: "Re-encrypts and replaces the stored password when non-empty; omit to keep the current secret"}
+        private_key:            {type: string, description: "Re-encrypts and replaces the stored key when non-empty; omit to keep the current secret"}
+        private_key_passphrase: {type: string, description: "Re-encrypts and replaces the stored passphrase when non-empty; omit to keep the current secret"}
+        is_default:             {type: boolean, description: "Setting true on a system credential atomically demotes the previous system default"}
+
     # Clone target shape. The source credential's secret material is
     # inherited verbatim (no plaintext crosses the wire); only the new
     # scope, scope_id, name, and is_default are operator-controlled.

audit/events.yaml

@@ -455,6 +455,16 @@ events:
         scope: {type: string, enum: [system, host]}
         auth_method: {type: string, enum: [ssh_key, password, both]}
 
+  - code: credential.updated
+    severity: info
+    detail_schema:
+      type: object
+      properties:
+        credential_id: {type: string}
+        scope: {type: string, enum: [system, host]}
+        auth_method: {type: string, enum: [ssh_key, password, both]}
+        secret_rotated: {type: boolean}
+
   - code: credential.deleted
     severity: warning
     detail_schema:

frontend/src/api/schema.d.ts

@@ -518,7 +518,11 @@ export interface paths {
         delete: operations["deleteCredentialByID"];
         options?: never;
         head?: never;
-        patch?: never;
+        /**
+         * Update a credential in place
+         * @description Partial update of an existing active credential. Only the fields present in the body change; omitted fields are left untouched. Secret material (password, private_key, private_key_passphrase) is re-encrypted only when a non-empty value is supplied — omitting a secret keeps the stored ciphertext, so metadata can be edited without re-entering the key or password. scope and scope_id are immutable. Setting is_default=true on a system credential atomically demotes the previous system default.
+         */
+        patch: operations["patchCredentialByID"];
         trace?: never;
     };
     "/api/v1/credentials/{id}:clone": {
@@ -2715,6 +2719,21 @@ export interface components {
             private_key_passphrase?: string;
             is_default?: boolean;
         };
+        CredentialUpdateRequest: {
+            name?: string;
+            description?: string;
+            username?: string;
+            /** @enum {string} */
+            auth_method?: "ssh_key" | "password" | "both";
+            /** @description Re-encrypts and replaces the stored password when non-empty; omit to keep the current secret */
+            password?: string;
+            /** @description Re-encrypts and replaces the stored key when non-empty; omit to keep the current secret */
+            private_key?: string;
+            /** @description Re-encrypts and replaces the stored passphrase when non-empty; omit to keep the current secret */
+            private_key_passphrase?: string;
+            /** @description Setting true on a system credential atomically demotes the previous system default */
+            is_default?: boolean;
+        };
         CredentialCloneRequest: {
             /** @enum {string} */
             scope: "system" | "host";
@@ -4631,6 +4650,59 @@ export interface operations {
             };
         };
     };
+    patchCredentialByID: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CredentialUpdateRequest"];
+            };
+        };
+        responses: {
+            /** @description Updated credential metadata */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["CredentialResponse"];
+                };
+            };
+            /** @description Validation failure (unknown auth_method, missing required secret) */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description Credential not found or already soft-deleted */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+            /** @description is_default=true collides with an existing system default */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
     postCredentialClone: {
         parameters: {
             query?: never;

frontend/src/components/hosts/EditHostModal.tsx

@@ -53,6 +53,13 @@ interface Props {
   open: boolean;
   onClose: () => void;
   host: EditableHost;
+  /**
+   * When provided, renders a "Manage SSH credential" link that hands off
+   * to the per-host credential modal. The host record itself stores no
+   * credential (api-credentials uses a scope/scope_id tier model), so
+   * credential editing lives in its own modal.
+   */
+  onManageCredential?: () => void;
 }
 
 function splitTags(csv: string | undefined): string[] {
@@ -63,7 +70,7 @@ function splitTags(csv: string | undefined): string[] {
     .filter((t) => t.length > 0);
 }
 
-export function EditHostModal({ open, onClose, host }: Props) {
+export function EditHostModal({ open, onClose, host, onManageCredential }: Props) {
   const queryClient = useQueryClient();
   const [serverError, setServerError] = useState<string | null>(null);
   const { register, handleSubmit, formState, reset } = useForm<EditForm>({
@@ -197,6 +204,26 @@ export function EditHostModal({ open, onClose, host }: Props) {
           <input type="text" {...register('username')} style={inputStyle} />
         </FormField>
 
+        {onManageCredential && (
+          <div style={{ margin: '-4px 0 14px' }}>
+            <button
+              type="button"
+              onClick={onManageCredential}
+              disabled={submitting}
+              style={{
+                background: 'transparent',
+                border: 0,
+                padding: 0,
+                color: 'var(--ow-info)',
+                fontSize: 12,
+                cursor: submitting ? 'default' : 'pointer',
+              }}
+            >
+              Manage SSH credential (key or password) →
+            </button>
+          </div>
+        )}
+
         <FormField
           label="Tags"
           hint="Comma-separated. Leave blank to clear all tags."