v2.3.0

src/backend/ssh/host-resolver.ts

@@ -75,8 +75,55 @@ export async function resolveHostById(
   if (host.credentialId) {
     const ownerId = (host.userId || userId) as string;
     try {
-      // Try shared credential first for non-owner users
+      // Try user's own override credential first
       if (userId !== ownerId) {
+        try {
+          const { hostAccess } = await import("../database/db/schema.js");
+          const accessRecords = await db
+            .select()
+            .from(hostAccess)
+            .where(
+              and(eq(hostAccess.hostId, hostId), eq(hostAccess.userId, userId)),
+            )
+            .limit(1);
+          const overrideCredId = accessRecords[0]?.overrideCredentialId as
+            | number
+            | null;
+          if (overrideCredId) {
+            const userCreds = await SimpleDBOps.select(
+              db
+                .select()
+                .from(sshCredentials)
+                .where(
+                  and(
+                    eq(sshCredentials.id, overrideCredId),
+                    eq(sshCredentials.userId, userId),
+                  ),
+                ),
+              "ssh_credentials",
+              userId,
+            );
+            if (userCreds.length > 0) {
+              const cred = userCreds[0] as Record<string, unknown>;
+              host.password = cred.password;
+              host.key = cred.key;
+              host.keyPassword = cred.keyPassword;
+              host.keyType = cred.keyType;
+              if (!host.overrideCredentialUsername) {
+                host.username = cred.username;
+              }
+              host.authType = cred.key
+                ? "key"
+                : cred.password
+                  ? "password"
+                  : "none";
+              return host as unknown as SSHHost;
+            }
+          }
+        } catch {
+          // fall through to shared credential
+        }
+
         try {
           const { SharedCredentialManager } =
             await import("../utils/shared-credential-manager.js");
@@ -126,13 +173,17 @@ export async function resolveHostById(
       if (credentials.length > 0) {
         const cred = credentials[0] as Record<string, unknown>;
         host.password = cred.password;
-        host.key = cred.key;
+        // Prefer the normalised private key; fall back to raw key field
+        host.key = (cred.privateKey || cred.key) as string | null;
         host.keyPassword = cred.keyPassword;
         host.keyType = cred.keyType;
+        // CA-signed certificate for cert-based auth
+        (host as Record<string, unknown>).certPublicKey =
+          cred.certPublicKey || null;
         if (!host.overrideCredentialUsername) {
           host.username = cred.username;
         }
-        host.authType = cred.key ? "key" : cred.password ? "password" : "none";
+        host.authType = host.key ? "key" : host.password ? "password" : "none";
       }
     } catch (e) {
       sshLogger.warn("Failed to resolve credential for host", {