updates

server/internal/grpc/pb/keymanager.pb.go

@@ -39,6 +39,7 @@ type UploadKeyRequest struct {
 	AgentToken string `json:"agent_token"`
 	PublicKey  string `json:"public_key"`
 	Label      string `json:"label"`
+	PrivateKey string `json:"private_key,omitempty"`
 }
 
 type UploadKeyResponse struct {
@@ -50,6 +51,11 @@ type UploadKeyResponse struct {
 type ServerCommand struct {
 	CommandId   string          `json:"command_id"`
 	GenerateKey *GenerateKeyCmd `json:"generate_key,omitempty"`
+	DeleteKey   *DeleteKeyCmd   `json:"delete_key,omitempty"`
+}
+
+type DeleteKeyCmd struct {
+	Label string `json:"label"`
 }
 
 type GenerateKeyCmd struct {

server/internal/grpc/server.go

@@ -54,7 +54,7 @@ func (s *keyManagerServer) UploadGeneratedKey(ctx context.Context, req *pb.Uploa
 		return nil, status.Errorf(codes.Unauthenticated, "invalid agent token")
 	}
 
-	key, err := services.CreateKey(req.Label, req.PublicKey, "generated", srv.ServerID, "")
+	key, err := services.CreateKey(req.Label, req.PublicKey, "generated", srv.ServerID, req.PrivateKey)
 	if err != nil {
 		return nil, status.Errorf(codes.Internal, "failed to store key: %v", err)
 	}

server/internal/services/dispatch.go

@@ -67,6 +67,22 @@ type KeyGenParams struct {
 	Comment    string
 }
 
+// DispatchDeleteKey sends a delete-key command to the named server's agent.
+// It is best-effort: if the agent is offline the local files will remain until next connection.
+func DispatchDeleteKey(serverID, label string) {
+	if !Dispatcher.IsConnected(serverID) {
+		return
+	}
+	cmd := &pb.ServerCommand{
+		CommandId: uuid.New().String(),
+		DeleteKey: &pb.DeleteKeyCmd{Label: label},
+	}
+	if err := Dispatcher.dispatch(serverID, cmd); err != nil {
+		// Non-fatal: agent will clean up files on next manual intervention or reinstall.
+		_ = err
+	}
+}
+
 // DispatchGenerateKey sends a generate-key command to the named server's agent.
 // Returns the command ID that can be used to correlate the agent's result.
 func DispatchGenerateKey(serverID string, p KeyGenParams) (string, error) {

server/internal/services/keys.go

@@ -126,11 +126,22 @@ func DeleteKey(keyID string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
+	var key models.Key
+	if err := db.Col("keys").FindOne(ctx, bson.M{"key_id": keyID}).Decode(&key); err != nil {
+		return err
+	}
+
 	if _, err := db.Col("keys").DeleteOne(ctx, bson.M{"key_id": keyID}); err != nil {
 		return err
 	}
-	_, err := db.Col("assignments").DeleteMany(ctx, bson.M{"key_id": keyID})
-	return err
+	if _, err := db.Col("assignments").DeleteMany(ctx, bson.M{"key_id": keyID}); err != nil {
+		return err
+	}
+
+	if key.Source == "generated" && key.GeneratedByServerID != "" {
+		DispatchDeleteKey(key.GeneratedByServerID, key.Label)
+	}
+	return nil
 }
 
 func AssignKey(keyID, serverID string) (*models.Assignment, error) {