feat(access): add SSH key provisioning and rotation

client_test.go

@@ -71,6 +71,65 @@ func TestClientSendsAuthAndStableIdempotencyOnRetry(t *testing.T) {
 	}
 }
 
+func TestProvisionAndRotateSSHKeyRequests(t *testing.T) {
+	tests := []struct {
+		path string
+		call func(*Client) (*Operation, error)
+		want map[string]string
+	}{
+		{path: "/api/sdk/v1/regions/us-east-1/instances/instance-1/ssh-keys/provision", call: func(client *Client) (*Operation, error) {
+			return client.Access.ProvisionSSHKey(context.Background(), "us-east-1", "instance-1", ProvisionSSHKeyRequest{Name: "uploaded", PublicKey: "ssh-ed25519 AAAA", Username: "ec2-user"}, WithIdempotencyKey("add-key"))
+		}, want: map[string]string{"name": "uploaded", "public_key": "ssh-ed25519 AAAA", "username": "ec2-user"}},
+		{path: "/api/sdk/v1/regions/us-east-1/instances/instance-1/ssh-keys/rotate", call: func(client *Client) (*Operation, error) {
+			return client.Access.RotateSSHKey(context.Background(), "us-east-1", "instance-1", RotateSSHKeyRequest{Username: "ec2-user", ReplaceKeyID: "old-key"}, WithIdempotencyKey("rotate-key"))
+		}, want: map[string]string{"username": "ec2-user", "replace_key_id": "old-key"}},
+	}
+	for _, test := range tests {
+		t.Run(test.path, func(t *testing.T) {
+			client, _ := testClient(t, func(w http.ResponseWriter, r *http.Request) {
+				if r.Method != http.MethodPost || r.URL.Path != test.path {
+					t.Fatalf("request = %s %s", r.Method, r.URL.Path)
+				}
+				var body map[string]string
+				if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+					t.Fatal(err)
+				}
+				for key, value := range test.want {
+					if body[key] != value {
+						t.Fatalf("body[%s] = %q, want %q", key, body[key], value)
+					}
+				}
+				w.Header().Set("Content-Type", "application/json")
+				_, _ = w.Write([]byte(`{"code":202,"message":"Accepted","data":{"command_id":"command-1","status":"queued"}}`))
+			})
+			operation, err := test.call(client)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if operation.TaskID != "command-1" {
+				t.Fatalf("task ID = %q", operation.TaskID)
+			}
+		})
+	}
+}
+
+func TestRevealSSHKeyRequestAndSecret(t *testing.T) {
+	client, _ := testClient(t, func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPost || r.URL.Path != "/api/sdk/v1/regions/us-east-1/instances/instance-1/ssh-keys/key-1/reveal" {
+			t.Fatalf("request = %s %s", r.Method, r.URL.Path)
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"code":200,"message":"Success","data":{"key_id":"key-1","key_name":"generated","username":"ec2-user","private_key":"secret-pem"}}`))
+	})
+	key, err := client.Access.RevealSSHKey(context.Background(), "us-east-1", "instance-1", "key-1")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if key.KeyID != "key-1" || key.PrivateKey.Reveal() != "secret-pem" || key.PrivateKey.String() != "[REDACTED]" {
+		t.Fatalf("unexpected private key response: %#v", key)
+	}
+}
+
 func TestAPIErrorAndHelpers(t *testing.T) {
 	client, _ := testClient(t, func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Content-Type", "application/json")