From e8ec2df23798d1d1b76c716ca0ef6130a3b0c901 Mon Sep 17 00:00:00 2001
From: Kaede Akino <i@akinokae.de>
Date: Sat, 3 Oct 2026 14:36:40 +0800
Subject: [PATCH] fix(keychain): refine key actions and encrypted-key
 passphrase controls

---
 Frameworks/Resources/Localizable.xcstrings    |  8 ++--
 .../TermindPresentation/KeyExportForm.swift   |  1 +
 Scripts/check-zh-localization.sh              |  3 ++
 .../FeatureModels/MobileKeyEditorModel.swift  |  6 ++-
 .../Keychain/MobileCredentialsView.swift      |  4 +-
 TFI/Features/Keychain/MobileKeyEditor.swift   | 12 +++--
 .../Keychain/MobileKeyExportDetailView.swift  |  6 ++-
 TFITests/MobileKeyExportRenderingTests.swift  |  2 +
 TFITests/MobileKeyExportTests.swift           | 46 +++++++++++++++++--
 TFM/Features/Keychain/KeychainPageView.swift  | 24 ++++++----
 10 files changed, 85 insertions(+), 27 deletions(-)

diff --git a/Frameworks/Resources/Localizable.xcstrings b/Frameworks/Resources/Localizable.xcstrings
index a1d32391..10540bc2 100644
--- a/Frameworks/Resources/Localizable.xcstrings
+++ b/Frameworks/Resources/Localizable.xcstrings
@@ -32244,13 +32244,13 @@
         "zh-Hans" : {
           "stringUnit" : {
             "state" : "translated",
-            "value" : "类型：%@"
+            "value" : "类型 %@"
           }
         },
         "zh-Hant" : {
           "stringUnit" : {
             "state" : "translated",
-            "value" : "類型：%@"
+            "value" : "類型 %@"
           }
         }
       }
@@ -32267,13 +32267,13 @@
         "zh-Hans" : {
           "stringUnit" : {
             "state" : "translated",
-            "value" : "类型未知"
+            "value" : "类型 未知"
           }
         },
         "zh-Hant" : {
           "stringUnit" : {
             "state" : "translated",
-            "value" : "類型未知"
+            "value" : "類型 未知"
           }
         }
       }
diff --git a/Frameworks/TermindPresentation/KeyExportForm.swift b/Frameworks/TermindPresentation/KeyExportForm.swift
index 405df5d0..f0513c62 100644
--- a/Frameworks/TermindPresentation/KeyExportForm.swift
+++ b/Frameworks/TermindPresentation/KeyExportForm.swift
@@ -63,6 +63,7 @@ public struct KeyExportForm: View {
                 if model.needsExportPassphrase {
                     Section {
                         RevealableSecretField(AppStrings.Keychain.passphrase, text: $model.exportPassphrase)
+                            .multilineTextAlignment(.leading)
                         Toggle(AppStrings.Keychain.savePassphrase.swiftUIKey, isOn: $model.saveExportPassphrase)
                         if let error = model.passphraseError { Text(error).font(.caption).foregroundStyle(.red) }
                     } footer: {
diff --git a/Scripts/check-zh-localization.sh b/Scripts/check-zh-localization.sh
index 1abde55b..ef844333 100755
--- a/Scripts/check-zh-localization.sh
+++ b/Scripts/check-zh-localization.sh
@@ -64,6 +64,9 @@ for language in zh-Hans zh-Hant; do
       ]
     | .[]
     | select(
+        # Key-card type subtitles intentionally separate the label and value.
+        (if $entry.key == "Type %@" then sub("^(?<label>类型|類型) (?=%@)"; "\(.label)") else . end)
+        |
         test("\\p{Han}")
         and (
           test("\\p{Han}[ \\t]+[A-Za-z0-9%@`]|[A-Za-z0-9%@`][ \\t]+\\p{Han}")
diff --git a/TFI/Application/FeatureModels/MobileKeyEditorModel.swift b/TFI/Application/FeatureModels/MobileKeyEditorModel.swift
index 33476413..4a586a5b 100644
--- a/TFI/Application/FeatureModels/MobileKeyEditorModel.swift
+++ b/TFI/Application/FeatureModels/MobileKeyEditorModel.swift
@@ -167,6 +167,9 @@ final class MobileKeyEditorModel: Identifiable {
         }
     }
     var fingerprint: String? { (try? SSHKeyMaterial.publicMaterial(publicKey))?.fingerprint }
+    var privateKeyRequiresPassphrase: Bool {
+        (try? SSHKeyMaterial.privateKeyMetadata(privateKey).isEncrypted) == true
+    }
     var isEnclave: Bool { original?.storage == .secureEnclave }
     var canSelectThisDevice: Bool { original?.storage != .iCloud }
     var canUseEnclave: Bool { SecureEnclaveKey.isAvailable }
@@ -239,7 +242,8 @@ final class MobileKeyEditorModel: Identifiable {
             nil
     ) async throws {
         guard canSave else { throw CocoaError(.coderInvalidValue) }
-        let savesPassphrase = savePassphrase && !passphrase.isEmpty
+        let savesPassphrase =
+            savePassphrase && !passphrase.isEmpty && (mode == .generate || privateKeyRequiresPassphrase)
         if usesWebAuthn {
             var credential: SecurityKeyCredential
             if mode == .generate, let registerSecurityKey {
diff --git a/TFI/Features/Keychain/MobileCredentialsView.swift b/TFI/Features/Keychain/MobileCredentialsView.swift
index 625b44eb..e748c2a8 100644
--- a/TFI/Features/Keychain/MobileCredentialsView.swift
+++ b/TFI/Features/Keychain/MobileCredentialsView.swift
@@ -45,11 +45,11 @@ struct MobileCredentialsView: View {
                                 }
                                 Divider()
                                 Menu(AppStrings.Common.copy.swiftUIKey, systemImage: "doc.on.doc") {
-                                    Button(AppStrings.Keychain.publicKey.swiftUIKey, systemImage: "doc.on.doc") {
+                                    Button(AppStrings.Keychain.publicKey.swiftUIKey, systemImage: "key") {
                                         UIPasteboard.general.string = key.publicKey
                                     }
                                     .disabled(key.publicKey.isEmpty)
-                                    Button(AppStrings.KnownHosts.fingerprint.swiftUIKey, systemImage: "doc.on.doc") {
+                                    Button(AppStrings.KnownHosts.fingerprint.swiftUIKey, systemImage: "touchid") {
                                         UIPasteboard.general.string = key.fingerprint
                                     }
                                     .disabled(key.publicKey.isEmpty || key.fingerprint.isEmpty)
diff --git a/TFI/Features/Keychain/MobileKeyEditor.swift b/TFI/Features/Keychain/MobileKeyEditor.swift
index 52fdf3ee..2eebb155 100644
--- a/TFI/Features/Keychain/MobileKeyEditor.swift
+++ b/TFI/Features/Keychain/MobileKeyEditor.swift
@@ -140,11 +140,13 @@ struct MobileKeyEditor: View {
                                 .font(.caption)
                                 .foregroundStyle(.orange)
                             }
-                            RevealableSecretField(AppStrings.Keychain.passphrase, text: $model.passphrase)
-                                .multilineTextAlignment(.leading)
-                                .disabled(!model.canEditPrivateKey)
-                            Toggle(AppStrings.Keychain.savePassphrase.swiftUIKey, isOn: $model.savePassphrase)
-                                .disabled(!model.canEditPrivateKey)
+                            if model.privateKeyRequiresPassphrase {
+                                RevealableSecretField(AppStrings.Keychain.passphrase, text: $model.passphrase)
+                                    .multilineTextAlignment(.leading)
+                                    .disabled(!model.canEditPrivateKey)
+                                Toggle(AppStrings.Keychain.savePassphrase.swiftUIKey, isOn: $model.savePassphrase)
+                                    .disabled(!model.canEditPrivateKey)
+                            }
                         }
                     }
                 } else {
diff --git a/TFI/Features/Keychain/MobileKeyExportDetailView.swift b/TFI/Features/Keychain/MobileKeyExportDetailView.swift
index 6a17288f..2c728cbe 100644
--- a/TFI/Features/Keychain/MobileKeyExportDetailView.swift
+++ b/TFI/Features/Keychain/MobileKeyExportDetailView.swift
@@ -17,18 +17,20 @@ struct MobileKeyExportDetailView: View {
         }
         .navigationTitle(AppStrings.Keychain.exportToHost.swiftUIKey)
         .toolbar {
-            ToolbarItem(placement: .primaryAction) {
+            ToolbarItem(placement: .confirmationAction) {
                 if model.didExport {
                     Button(AppStrings.Common.done.swiftUIKey) { dismiss() }
                 } else if case .failed = model.phase, model.journey.isPresented {
                     Button(AppStrings.Common.edit.swiftUIKey) { model.editOptions() }
                 } else if !model.journey.isPresented {
-                    Button(AppStrings.KeyExport.exportAndAttach.swiftUIKey) { model.start() }
+                    Button(AppStrings.KeyExport.exportAndAttach.swiftUIKey, systemImage: "checkmark") { model.start() }
+                        .labelStyle(.iconOnly)
                         .disabled(!model.canStart)
                 } else if model.phase == .exporting {
                     ProgressView().accessibilityLabel(AppStrings.KeyExport.exporting.swiftUIKey)
                 }
             }
+            .mobileProminentAction()
         }
         .onDisappear { model.cancel() }
     }
diff --git a/TFITests/MobileKeyExportRenderingTests.swift b/TFITests/MobileKeyExportRenderingTests.swift
index 37565e9b..7b92ff24 100644
--- a/TFITests/MobileKeyExportRenderingTests.swift
+++ b/TFITests/MobileKeyExportRenderingTests.swift
@@ -47,6 +47,8 @@ struct MobileKeyExportRenderingTests {
             window.endEditing(true)
             model.exportPassphrase = "secret"
             #expect(model.canStart)
+            try await Task.sleep(for: .milliseconds(400))
+            try capture(window, language: language, state: "ready")
         }
     }
 
diff --git a/TFITests/MobileKeyExportTests.swift b/TFITests/MobileKeyExportTests.swift
index 46c0295f..9c1e5b40 100644
--- a/TFITests/MobileKeyExportTests.swift
+++ b/TFITests/MobileKeyExportTests.swift
@@ -14,6 +14,7 @@ struct MobileKeyExportTests {
         let editor = MobileKeyEditorModel(mode: .importKey, credentials: CredentialLibraryModel(library: library))
         editor.privateKey = material.privateKey
         #expect(editor.canSave && editor.savePassphrase)
+        #expect(editor.privateKeyRequiresPassphrase && editor.passphrase.isEmpty)
         try await editor.save()
         #expect(!editor.savePassphrase)
         let key = try #require(library.keys.first)
@@ -75,14 +76,51 @@ struct MobileKeyExportTests {
         #expect(cleared.publicKey.isEmpty && cleared.fingerprint.isEmpty && cleared.hasPassphrase)
     }
 
-    @Test func typedPassphraseDoesNotMakeAnUnencryptedKeyEncrypted() async throws {
+    @Test(arguments: [false, true])
+    func passphraseControlsFollowPrivateKeyEncryptionWhileReplacingKeys(editExisting: Bool) async throws {
+        let fixture = try MobileExportFixture(encrypted: true)
+        let credentials = CredentialLibraryModel(library: fixture.library)
+        let editor = MobileKeyEditorModel(
+            mode: editExisting ? .edit : .importKey, credentials: credentials,
+            key: editExisting ? fixture.key : nil)
+        let encrypted = try #require(try credentials.keyCredential(for: fixture.key))
+        guard case .software(let secret) = encrypted else {
+            Issue.record("Expected software key")
+            return
+        }
+        if editExisting {
+            await editor.loadPrivateKey()
+        } else {
+            #expect(!editor.privateKeyRequiresPassphrase)
+            editor.privateKey = secret.privateKey
+        }
+        #expect(editor.privateKeyRequiresPassphrase && editor.passphrase.isEmpty)
+        let unencrypted = try SSHKeyMaterial.generate(.ed25519, comment: "", passphrase: nil)
+        editor.privateKey = unencrypted.privateKey
+        #expect(!editor.privateKeyRequiresPassphrase)
+        editor.privateKey = secret.privateKey
+        editor.publicKey = "invalid public key"
+        #expect(editor.privateKeyRequiresPassphrase)
+        editor.privateKey = "-----BEGIN OPENSSH PRIVATE KEY-----"
+        #expect(!editor.privateKeyRequiresPassphrase)
+        editor.privateKey = ""
+        #expect(!editor.privateKeyRequiresPassphrase)
+    }
+
+    @Test func replacingEncryptedPrivateKeyDoesNotSaveHiddenPassphrase() async throws {
         let library = HostLibraryModel()
+        let credentials = CredentialLibraryModel(library: library)
+        let encrypted = try SSHKeyMaterial.generate(.ed25519, comment: "", passphrase: "secret")
         let material = try SSHKeyMaterial.generate(.ed25519, comment: "", passphrase: nil)
-        let editor = MobileKeyEditorModel(mode: .importKey, credentials: CredentialLibraryModel(library: library))
+        let editor = MobileKeyEditorModel(mode: .importKey, credentials: credentials)
+        editor.privateKey = encrypted.privateKey
+        editor.passphrase = "secret"
         editor.privateKey = material.privateKey
-        editor.passphrase = "not-encryption"
+        #expect(!editor.privateKeyRequiresPassphrase)
         try await editor.save()
-        #expect(library.keys.first?.hasPassphrase == false)
+        let key = try #require(library.keys.first)
+        #expect(!key.hasPassphrase && !editor.savePassphrase)
+        #expect(!credentials.hasSavedPassphrase(for: key))
     }
 
     @Test func replacingPrivateKeyPreservesANewManuallyEnteredPublicKey() async throws {
diff --git a/TFM/Features/Keychain/KeychainPageView.swift b/TFM/Features/Keychain/KeychainPageView.swift
index 45a2a2ad..3985dc21 100644
--- a/TFM/Features/Keychain/KeychainPageView.swift
+++ b/TFM/Features/Keychain/KeychainPageView.swift
@@ -601,13 +601,15 @@ private struct SoftwareKeyEditor: View {
                                 .font(.caption)
                                 .foregroundStyle(.orange)
                             }
-                            RevealableSecretField(
-                                AppStrings.Keychain.passphrase, text: $passphrase,
-                                prompt: Text(AppStrings.Common.optional)
-                            )
-                            .disabled(!canEditPrivateKey)
-                            Toggle(AppStrings.Keychain.savePassphrase.swiftUIKey, isOn: $savePassphrase)
+                            if privateKeyRequiresPassphrase {
+                                RevealableSecretField(
+                                    AppStrings.Keychain.passphrase, text: $passphrase,
+                                    prompt: Text(AppStrings.Common.optional)
+                                )
                                 .disabled(!canEditPrivateKey)
+                                Toggle(AppStrings.Keychain.savePassphrase.swiftUIKey, isOn: $savePassphrase)
+                                    .disabled(!canEditPrivateKey)
+                            }
                         }
                     } header: {
                         fileSectionHeader(
@@ -836,7 +838,7 @@ private struct SoftwareKeyEditor: View {
                 isWorking = false
                 return true
             }
-            let passphrase = passphrase.isEmpty ? nil : passphrase
+            let passphrase = privateKeyRequiresPassphrase && !passphrase.isEmpty ? passphrase : nil
             let savesPassphrase = savePassphrase && passphrase != nil
             let inspected = try SSHKeyMaterial.imported(privateKey: privateKey, publicKey: publicKey)
             if !normalizedCertificate.isEmpty {
@@ -869,6 +871,10 @@ private struct SoftwareKeyEditor: View {
 
     private var validationToken: String { privateKey + "\u{0}" + publicKey }
 
+    private var privateKeyRequiresPassphrase: Bool {
+        (try? SSHKeyMaterial.privateKeyMetadata(privateKey).isEncrypted) == true
+    }
+
     private var defaultName: String {
         if usesWebAuthn { return String(localized: AppStrings.SecurityKey.title) }
         let algorithm =
@@ -1525,11 +1531,11 @@ struct KeyObjectActions: View {
         Button(AppStrings.Keychain.exportToHost.swiftUIKey, systemImage: MenuSymbol.export, action: export)
         Divider()
         Menu(AppStrings.Common.copy.swiftUIKey, systemImage: MenuSymbol.copy) {
-            Button(AppStrings.Keychain.publicKey.swiftUIKey, systemImage: MenuSymbol.copy) {
+            Button(AppStrings.Keychain.publicKey.swiftUIKey, systemImage: "key") {
                 copyToPasteboard(key.publicKey)
             }
             .disabled(key.publicKey.isEmpty)
-            Button(AppStrings.KnownHosts.fingerprint.swiftUIKey, systemImage: MenuSymbol.copy) {
+            Button(AppStrings.KnownHosts.fingerprint.swiftUIKey, systemImage: "touchid") {
                 copyToPasteboard(key.fingerprint)
             }
             .disabled(key.publicKey.isEmpty || key.fingerprint.isEmpty)