Add SSH key fields for lossless encrypted PEM storage and optional passphrase

src/Api/Vault/Models/CipherSSHKeyModel.cs

@@ -15,15 +15,37 @@ public CipherSSHKeyModel(CipherSSHKeyData data)
         PrivateKey = data.PrivateKey;
         PublicKey = data.PublicKey;
         KeyFingerprint = data.KeyFingerprint;
+
+        // Map new optional properties if present
+        OriginalPrivateKey = data.OriginalPrivateKey;
+        IsEncrypted = data.IsEncrypted;
+        SshKeyPassphrase = data.SshKeyPassphrase;
     }
 
     [EncryptedString]
     [EncryptedStringLength(5000)]
     public string PrivateKey { get; set; }
+
     [EncryptedString]
     [EncryptedStringLength(5000)]
     public string PublicKey { get; set; }
+
     [EncryptedString]
     [EncryptedStringLength(1000)]
     public string KeyFingerprint { get; set; }
+
+    // Preserve original encrypted PEM verbatim
+    [EncryptedString]
+    [EncryptedStringLength(5000)]
+    public string OriginalPrivateKey { get; set; }
+
+    // Transported as encrypted string ("true"/"false")
+    [EncryptedString]
+    [EncryptedStringLength(10)]
+    public string IsEncrypted { get; set; }
+
+    // Optional stored passphrase (encrypted)
+    [EncryptedString]
+    [EncryptedStringLength(5000)]
+    public string SshKeyPassphrase { get; set; }
 }

src/Api/Vault/Models/Request/CipherRequestModel.cs

@@ -261,6 +261,11 @@ private CipherSSHKeyData ToCipherSSHKeyData()
             PrivateKey = SSHKey.PrivateKey,
             PublicKey = SSHKey.PublicKey,
             KeyFingerprint = SSHKey.KeyFingerprint,
+
+            // Preserve original encrypted PEM and optional passphrase; track encryption flag
+            OriginalPrivateKey = SSHKey.OriginalPrivateKey,
+            IsEncrypted = SSHKey.IsEncrypted,
+            SshKeyPassphrase = SSHKey.SshKeyPassphrase,
         };
     }
 }

src/Core/Vault/Models/Data/CipherSSHKeyData.cs

@@ -10,4 +10,10 @@ public CipherSSHKeyData() { }
     public string PrivateKey { get; set; }
     public string PublicKey { get; set; }
     public string KeyFingerprint { get; set; }
+
+    // New fields to preserve original encrypted key and optional passphrase
+    public string OriginalPrivateKey { get; set; }
+    // Booleans are typically transported as encrypted strings ("true"/"false") in Bitwarden models
+    public string IsEncrypted { get; set; }
+    public string SshKeyPassphrase { get; set; }
 }