fix: allow members to use SSH keys for deployments without full access#4168
Merged
Siumauricio merged 1 commit intocanaryfrom Apr 6, 2026
Merged
fix: allow members to use SSH keys for deployments without full access#4168Siumauricio merged 1 commit intocanaryfrom
Siumauricio merged 1 commit intocanaryfrom
Conversation
…ey access Add allForApps endpoint that returns only sshKeyId and name using protectedProcedure instead of withPermission, so members can select SSH keys in the git provider dropdown without needing access to the SSH Keys management panel. closes #4069
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What is this PR about?
Members couldn't use admin-managed SSH keys for git-based deployments without having
Access to SSH Keyspermission, which also exposed the SSH Keys management panel. This was a regression introduced in v0.28.7 with the new RBAC system.Added a new
allForAppsendpoint in the SSH key router that usesprotectedProcedure(authenticated only, no permission check) and returns onlysshKeyIdandname. The git provider dropdowns now use this endpoint instead ofall, so members can select SSH keys for their apps without needing access to the SSH Keys management panel.Checklist
canarybranch.Issues related (if applicable)
closes #4069
Screenshots (if applicable)
N/A
Greptile Summary
Adds a new
allForAppstRPC endpoint on the SSH key router usingprotectedProcedure(authentication only, no permission check) that returns onlysshKeyIdandname, scoped to the caller's active organization. Both git-provider dropdowns switch fromsshKey.alltosshKey.allForApps, restoring the ability for members to select SSH keys for deployments without the SSH Keys management permission.Confidence Score: 5/5
This PR is safe to merge — the fix is minimal, correct, and does not expose any sensitive SSH key material.
The new endpoint is properly scoped by organizationId (matching the existing
allendpoint pattern), returns only non-sensitive fields (id and name, no private key material), and requires authentication via protectedProcedure. No P0 or P1 issues found.No files require special attention.
Reviews (1): Last reviewed commit: "fix: allow members to use SSH keys for d..." | Re-trigger Greptile