feat: save to remote can be authed by Kerberos

internal/domain/config.go

@@ -33,9 +33,18 @@ type S3Config struct {
 // Field design notes:
 //   - Host / Port form the destination endpoint. Port defaults to 22 when 0.
 //   - User is the SSH login name.
+//   - AuthMethod selects how the connection authenticates:
+//       "" / "builtin" → password / ssh-agent / ~/.ssh/id_* via the
+//                         in-process golang.org/x/crypto/ssh client.
+//       "kerberos"     → delegate to the system /usr/bin/ssh binary so the
+//                         existing Kerberos (GSSAPI) credential cache from
+//                         `kinit` is reused. Native GSSAPI is required here
+//                         because macOS stores tickets in an API: ccache
+//                         that pure-Go SSH libraries cannot read.
 //   - Password is optional; when empty the implementation falls back to the
 //     local SSH agent or ~/.ssh/id_* keys (i.e. the user is responsible for
 //     having password-less access already configured on this machine).
+//     It is ignored entirely when AuthMethod is "kerberos".
 //   - PathPrefix is interpreted *relative to the remote user's $HOME*. The
 //     UI presents it as "~/<PathPrefix>" so the user cannot escape the home
 //     directory by writing absolute paths. Leading "/" or "~" markers are
@@ -51,6 +60,7 @@ type SSHConfig struct {
 	Host               string `json:"host"`
 	Port               int    `json:"port"`
 	User               string `json:"user"`
+	AuthMethod         string `json:"authMethod"`
 	Password           string `json:"password"`
 	PathPrefix         string `json:"pathPrefix"`
 	StrictHostKey      bool   `json:"strictHostKey"`
@@ -58,6 +68,21 @@ type SSHConfig struct {
 	ConnectTimeoutSecs int    `json:"connectTimeoutSecs"`
 }
 
+// SSH authentication method identifiers stored in SSHConfig.AuthMethod.
+const (
+	// SSHAuthBuiltin uses the in-process Go SSH client (password / agent /
+	// key files). This is the zero-value default.
+	SSHAuthBuiltin = "builtin"
+	// SSHAuthKerberos delegates to the system ssh binary so an existing
+	// Kerberos credential cache (populated by `kinit`) is reused via GSSAPI.
+	SSHAuthKerberos = "kerberos"
+)
+
+// IsKerberos reports whether this config requests Kerberos/GSSAPI auth.
+func (c SSHConfig) IsKerberos() bool {
+	return c.AuthMethod == SSHAuthKerberos
+}
+
 // AppConfig is the top-level on-disk configuration document.
 //
 // We keep S3 / SSH nested so that adding more providers later (e.g. AliyunOSS,