Merge branch 'feat/files-sftp' into feat/notify-creds

# Conflicts:
#	cmd/agentbbs/main.go

internal/forgejo/forgejo_test.go

@@ -174,3 +174,65 @@ func TestEnsureUserNoOpWhenExists(t *testing.T) {
 		t.Fatal("must not POST when the user already exists")
 	}
 }
+
+const aliceKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAITESTKEY alice@bbs"
+
+func TestEnsureKeyAddsWhenMissing(t *testing.T) {
+	var posted map[string]any
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case r.Method == http.MethodGet && r.URL.Path == "/api/v1/users/alice/keys":
+			_, _ = w.Write([]byte(`[]`))
+		case r.Method == http.MethodPost && r.URL.Path == "/api/v1/admin/users/alice/keys":
+			_ = json.NewDecoder(r.Body).Decode(&posted)
+			w.WriteHeader(http.StatusCreated)
+			_, _ = w.Write([]byte(`{"id":1}`))
+		default:
+			t.Errorf("unexpected %s %s", r.Method, r.URL.Path)
+		}
+	}))
+	defer srv.Close()
+
+	c := Config{BaseURL: srv.URL, Token: "secret"}
+	added, err := c.EnsureKey("alice", "agentbbs", aliceKey)
+	if err != nil {
+		t.Fatalf("EnsureKey: %v", err)
+	}
+	if !added {
+		t.Fatal("expected added=true")
+	}
+	if posted["key"] != aliceKey {
+		t.Errorf("posted key = %v", posted["key"])
+	}
+}
+
+func TestEnsureKeyIdempotentIgnoringComment(t *testing.T) {
+	posted := false
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == http.MethodPost {
+			posted = true
+		}
+		// Same key material, different comment — must be treated as already present.
+		_, _ = w.Write([]byte(`[{"key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAITESTKEY different-comment"}]`))
+	}))
+	defer srv.Close()
+
+	c := Config{BaseURL: srv.URL, Token: "secret"}
+	added, err := c.EnsureKey("alice", "agentbbs", aliceKey)
+	if err != nil {
+		t.Fatalf("EnsureKey: %v", err)
+	}
+	if added {
+		t.Fatal("expected added=false when key material already present")
+	}
+	if posted {
+		t.Fatal("must not POST when the key already exists")
+	}
+}
+
+func TestEnsureKeyBlankIsNoOp(t *testing.T) {
+	c := Config{BaseURL: "https://git.example.com", Token: "t"}
+	if added, err := c.EnsureKey("alice", "agentbbs", "  "); err != nil || added {
+		t.Fatalf("blank key should be a silent no-op, got added=%v err=%v", added, err)
+	}
+}