feat: Implement public key authentication for server

[inureyes]

Summary

• Implement authentication provider infrastructure for bssh-server
• Add PublicKeyVerifier with OpenSSH authorized_keys file parsing
• Integrate public key authentication with SSH handler
• Add rate limiting for authentication attempts

Changes

New Files

• src/server/auth/mod.rs - Auth module exports
• src/server/auth/provider.rs - AuthProvider trait definition
• src/server/auth/publickey.rs - PublicKeyVerifier implementation

Modified Files

• src/server/mod.rs - Export auth module
• src/server/config.rs - Add auth configuration options
• src/server/handler.rs - Integrate auth provider with auth_publickey

Implementation Details

AuthProvider Trait

• verify_publickey() - Verify public key authentication
• verify_password() - Verify password authentication (placeholder)
• get_user_info() - Get user information after auth
• user_exists() - Check if user exists

PublicKeyVerifier Features

• Parse OpenSSH authorized_keys file format
• Support multiple key types: ed25519, rsa, ecdsa
• Parse key options (no-pty, command, from, etc.)
• Username validation to prevent path traversal
• File permission checks on Unix systems

Configuration Options

Two modes for authorized_keys location:

1. Directory mode: {dir}/{username}/authorized_keys
2. Pattern mode: /home/{user}/.ssh/authorized_keys

Security Features

• Rate limiting for authentication attempts
• Username validation against path traversal
• Logging of auth attempts (success/failure)
• File permission validation

Test plan

• Unit tests for authorized_keys parsing
• Unit tests for key comparison logic
• Unit tests for path traversal prevention
• Unit tests for AuthProvider trait implementations
• All existing tests pass
• Clippy passes with no warnings

Closes #126

[inureyes]

PR Finalization Report

Project Structure Discovered

• Project Type: Rust
• Test Framework: cargo test
• Documentation System: Plain markdown (ARCHITECTURE.md, docs/architecture/)
• Lint Tools: cargo fmt, cargo clippy

Checklist

Tests

• Analyzed existing test structure
• Identified test coverage (16 tests for auth modules)
• All tests passing (809 library tests passed)

Documentation

• Updated ARCHITECTURE.md with comprehensive auth module documentation
  • Added Server Authentication Module section
  • Documented AuthProvider trait interface
  • Documented PublicKeyVerifier implementation details
  • Documented security features (username validation, file permission checks, symlink protection, rate limiting, timing attack mitigation)
• Updated docs/architecture/README.md to reference auth module

Code Quality

• cargo fmt: Applied formatting fixes to publickey.rs
• cargo clippy -- -D warnings: Passed with no warnings

Changes Made

• /home/inureyes/Development/backend.ai/bssh/ARCHITECTURE.md: Added 57 lines documenting the authentication module
• /home/inureyes/Development/backend.ai/bssh/docs/architecture/README.md: Added reference to server authentication
• /home/inureyes/Development/backend.ai/bssh/src/server/auth/publickey.rs: Formatting cleanup (11 line changes)

Test Coverage Summary

The new authentication code has comprehensive test coverage:

publickey.rs (14 tests):

• Key type detection
• Key options parsing (empty, no-pty, multiple options, command)
• Config path resolution (directory, pattern, default)
• Authorized keys parsing (comments, ed25519, with options, invalid)
• Security tests (invalid username via path traversal, empty username)

provider.rs (2 tests):

• RejectAllProvider behavior
• AcceptAllProvider behavior

handler.rs (8 tests):

• Handler creation and configuration
• Allowed methods configuration
• Auth attempts tracking

config.rs (12 tests):

• Default configuration
• Builder pattern
• Timeouts
• Authorized keys configuration

All verification passed. Ready for merge.