From 062509d50b4b0806c0026b77df7b3e59be18fa04 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Sun, 30 Aug 2026 22:52:48 +0000
Subject: [PATCH 1/5] feat: add roll SFTP credentials button
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a confirmation-gated control to regenerate SFTP username and password, plus API client and sync support for the new roll endpoint.

Co-authored-by: François-Xavier Talbot <fetchfern@users.noreply.github.com>
---
 .../src/modules/archon/servers/v1.ts          |  15 ++
 .../api-client/src/modules/archon/types.ts    |  11 ++
 .../ui/src/composables/server-panel-sync.ts   |  19 +++
 .../shared/server-settings/pages/advanced.vue | 132 ++++++++++++++++--
 4 files changed, 163 insertions(+), 14 deletions(-)

diff --git a/packages/api-client/src/modules/archon/servers/v1.ts b/packages/api-client/src/modules/archon/servers/v1.ts
index 9435bf11c7..0aad12eb07 100644
--- a/packages/api-client/src/modules/archon/servers/v1.ts
+++ b/packages/api-client/src/modules/archon/servers/v1.ts
@@ -66,4 +66,19 @@ export class ArchonServersV1Module extends AbstractModule {
 			method: 'POST',
 		})
 	}
+
+	/**
+	 * Roll SFTP credentials for a server
+	 * POST /v1/servers/:server_id/sftp/roll
+	 */
+	public async rollSftp(serverId: string): Promise<Archon.Servers.v1.SftpCredentials> {
+		return this.client.request<Archon.Servers.v1.SftpCredentials>(
+			`/servers/${serverId}/sftp/roll`,
+			{
+				api: 'archon',
+				version: 1,
+				method: 'POST',
+			},
+		)
+	}
 }
diff --git a/packages/api-client/src/modules/archon/types.ts b/packages/api-client/src/modules/archon/types.ts
index 00fb3c7da4..beea64e832 100644
--- a/packages/api-client/src/modules/archon/types.ts
+++ b/packages/api-client/src/modules/archon/types.ts
@@ -746,6 +746,11 @@ export namespace Archon {
 				worlds: WorldFull[]
 			}
 
+			export type SftpCredentials = {
+				sftp_username: string
+				sftp_password: string
+			}
+
 			export type ServerResources = {
 				cpu: number
 				memory_mb: number
@@ -981,6 +986,11 @@ export namespace Archon {
 				type: 'server.network.patch'
 				ports: ServerNetworkPort[]
 			}
+			export type ServerSftpPatchEvent = {
+				type: 'server.sftp.patch'
+				sftp_username: string
+				sftp_password: string
+			}
 			export type ServerTransferEvent = {
 				type: 'server.transfer.start' | 'server.transfer.done'
 				target_node: string
@@ -1094,6 +1104,7 @@ export namespace Archon {
 				| BackupOperationDoneEvent
 				| ServerPatchEvent
 				| ServerNetworkPatchEvent
+				| ServerSftpPatchEvent
 				| ServerTransferEvent
 				| UsersPatchEvent
 				| WorldPatchEvent
diff --git a/packages/ui/src/composables/server-panel-sync.ts b/packages/ui/src/composables/server-panel-sync.ts
index cd4101b096..1b68a6a539 100644
--- a/packages/ui/src/composables/server-panel-sync.ts
+++ b/packages/ui/src/composables/server-panel-sync.ts
@@ -96,6 +96,9 @@ export function useServerPanelSync(options: UseServerPanelSyncOptions) {
 			case 'server.network.patch':
 				handleServerNetworkPatch(serverId, event)
 				break
+			case 'server.sftp.patch':
+				handleServerSftpPatch(serverId, event)
+				break
 			case 'server.transfer.start':
 			case 'server.transfer.done':
 				void invalidateServerDetails(serverId)
@@ -149,6 +152,22 @@ export function useServerPanelSync(options: UseServerPanelSyncOptions) {
 		)
 	}
 
+	function handleServerSftpPatch(serverId: string, event: Archon.Sync.v1.ServerSftpPatchEvent) {
+		applySftpCredentials(serverId, {
+			sftp_username: event.sftp_username,
+			sftp_password: event.sftp_password,
+		})
+	}
+
+	function applySftpCredentials(serverId: string, credentials: Archon.Servers.v1.SftpCredentials) {
+		queryClient.setQueryData<Archon.Servers.v0.Server>(legacyServerDetailKey(serverId), (current) =>
+			current ? { ...current, ...credentials } : current,
+		)
+		queryClient.setQueryData<Archon.Servers.v1.ServerFull>(serverV1DetailKey(serverId), (current) =>
+			current ? { ...current, ...credentials } : current,
+		)
+	}
+
 	function handleServerNetworkPatch(
 		serverId: string,
 		event: Archon.Sync.v1.ServerNetworkPatchEvent,
diff --git a/packages/ui/src/layouts/shared/server-settings/pages/advanced.vue b/packages/ui/src/layouts/shared/server-settings/pages/advanced.vue
index 9a610883f6..e1833e1d42 100644
--- a/packages/ui/src/layouts/shared/server-settings/pages/advanced.vue
+++ b/packages/ui/src/layouts/shared/server-settings/pages/advanced.vue
@@ -1,23 +1,49 @@
 <template>
 	<div class="relative h-full w-full">
+		<Teleport to="body">
+			<div class="relative z-[100]">
+				<ConfirmModal
+					ref="rollSftpModal"
+					:title="formatMessage(messages.rollCredentialsModalTitle)"
+					:description="formatMessage(messages.rollCredentialsModalDescription)"
+					:proceed-label="formatMessage(messages.rollCredentials)"
+					:proceed-icon="RefreshCwIcon"
+					:markdown="false"
+					@proceed="confirmRollSftp"
+				/>
+			</div>
+		</Teleport>
+
 		<div class="flex h-full w-full flex-col gap-4">
 			<div class="flex flex-col gap-6">
 				<!-- SFTP section -->
 				<div class="flex flex-col gap-2">
-					<div class="flex flex-col items-center justify-between gap-0.5 sm:flex-row">
+					<div class="flex flex-col items-center justify-between gap-2 sm:flex-row">
 						<span class="text-lg font-semibold text-contrast">SFTP</span>
-						<ButtonLink
-							v-tooltip="sftpActionTooltip"
-							class="!w-full sm:!w-auto"
-							:class="{ 'opacity-60': !canWriteFiles }"
-							:href="canWriteFiles ? sftpUrl : undefined"
-							:aria-disabled="!canWriteFiles"
-							target="_blank"
-							@click="handleSftpLaunchClick"
-						>
-							<ExternalIcon class="h-5 w-5" />
-							Launch SFTP
-						</ButtonLink>
+						<div class="flex w-full flex-col gap-2 sm:w-auto sm:flex-row">
+							<Button
+								v-tooltip="sftpRollTooltip"
+								class="!w-full sm:!w-auto"
+								:disabled="!canWriteFiles || isRollingSftp"
+								:loading="isRollingSftp"
+								@click="showRollSftpModal"
+							>
+								<RefreshCwIcon class="h-5 w-5" />
+								{{ formatMessage(messages.rollCredentials) }}
+							</Button>
+							<ButtonLink
+								v-tooltip="sftpActionTooltip"
+								class="!w-full sm:!w-auto"
+								:class="{ 'opacity-60': !canWriteFiles }"
+								:href="canWriteFiles ? sftpUrl : undefined"
+								:aria-disabled="!canWriteFiles"
+								target="_blank"
+								@click="handleSftpLaunchClick"
+							>
+								<ExternalIcon class="h-5 w-5" />
+								Launch SFTP
+							</ButtonLink>
+						</div>
 					</div>
 
 					<div class="flex flex-col gap-2.5 rounded-2xl bg-surface-2 p-4">
@@ -211,15 +237,17 @@ import {
 	ExternalIcon,
 	EyeIcon,
 	EyeOffIcon,
+	RefreshCwIcon,
 	SpinnerIcon,
 	UpdatedIcon,
 } from '@modrinth/assets'
 import { useMutation, useQuery, useQueryClient } from '@tanstack/vue-query'
 import { computed, ref, watch } from 'vue'
 
-import { Combobox, Textarea } from '#ui/components'
+import { Combobox, ConfirmModal, Textarea } from '#ui/components'
 import { Button, ButtonLink, IconButton } from '#ui/components/base/buttons'
 import SaveBanner from '#ui/components/servers/SaveBanner.vue'
+import { defineMessages, useVIntl } from '#ui/composables/i18n'
 import { useServerPermissions } from '#ui/composables/server-permissions'
 import {
 	injectModrinthClient,
@@ -231,9 +259,42 @@ const { addNotification } = injectNotificationManager()
 const { server, serverId, worldId } = injectModrinthServerContext()
 const client = injectModrinthClient()
 const queryClient = useQueryClient()
+const { formatMessage } = useVIntl()
 const { canUseAdvancedSettings, canWriteFiles, permissionDeniedMessage } = useServerPermissions()
 
+const messages = defineMessages({
+	rollCredentials: {
+		id: 'servers.settings.advanced.sftp.roll-credentials',
+		defaultMessage: 'Roll credentials',
+	},
+	rollCredentialsModalTitle: {
+		id: 'servers.settings.advanced.sftp.roll-credentials-modal-title',
+		defaultMessage: 'Roll credentials',
+	},
+	rollCredentialsModalDescription: {
+		id: 'servers.settings.advanced.sftp.roll-credentials-modal-description',
+		defaultMessage: 'The previous username and password will stop working.',
+	},
+	rollCredentialsSuccessTitle: {
+		id: 'servers.settings.advanced.sftp.roll-credentials-success-title',
+		defaultMessage: 'SFTP credentials rolled',
+	},
+	rollCredentialsSuccessText: {
+		id: 'servers.settings.advanced.sftp.roll-credentials-success-text',
+		defaultMessage: 'Your SFTP username and password have been regenerated.',
+	},
+	rollCredentialsErrorTitle: {
+		id: 'servers.settings.advanced.sftp.roll-credentials-error-title',
+		defaultMessage: 'Failed to roll SFTP credentials',
+	},
+	rollCredentialsErrorText: {
+		id: 'servers.settings.advanced.sftp.roll-credentials-error-text',
+		defaultMessage: 'Please try again later.',
+	},
+})
+
 const showPassword = ref(false)
+const rollSftpModal = ref<InstanceType<typeof ConfirmModal>>()
 const sftpUrl = computed(() => `sftp://${server.value?.sftp_username}@${server.value?.sftp_host}`)
 const advancedActionTooltip = computed(() =>
 	canUseAdvancedSettings.value ? undefined : permissionDeniedMessage.value,
@@ -243,6 +304,9 @@ const sftpActionTooltip = computed(() =>
 		? 'This button only works with compatible SFTP clients (e.g. WinSCP)'
 		: permissionDeniedMessage.value,
 )
+const sftpRollTooltip = computed(() =>
+	canWriteFiles.value ? undefined : permissionDeniedMessage.value,
+)
 const sftpCopyTooltip = (label: string) =>
 	canWriteFiles.value ? label : permissionDeniedMessage.value
 const passwordVisibilityTooltip = computed(() =>
@@ -258,6 +322,46 @@ function handleSftpLaunchClick(event: MouseEvent) {
 	event.preventDefault()
 }
 
+function applySftpCredentials(credentials: Archon.Servers.v1.SftpCredentials) {
+	queryClient.setQueryData<Archon.Servers.v0.Server>(['servers', 'detail', serverId], (current) =>
+		current ? { ...current, ...credentials } : current,
+	)
+	queryClient.setQueryData<Archon.Servers.v1.ServerFull>(
+		['servers', 'v1', 'detail', serverId],
+		(current) => (current ? { ...current, ...credentials } : current),
+	)
+}
+
+const { mutate: rollSftpMutation, isPending: isRollingSftp } = useMutation({
+	mutationFn: () => client.archon.servers_v1.rollSftp(serverId),
+	onSuccess: (credentials) => {
+		applySftpCredentials(credentials)
+		addNotification({
+			type: 'success',
+			title: formatMessage(messages.rollCredentialsSuccessTitle),
+			text: formatMessage(messages.rollCredentialsSuccessText),
+		})
+	},
+	onError: (error) => {
+		console.error(error)
+		addNotification({
+			type: 'error',
+			title: formatMessage(messages.rollCredentialsErrorTitle),
+			text: formatMessage(messages.rollCredentialsErrorText),
+		})
+	},
+})
+
+function showRollSftpModal() {
+	if (!canWriteFiles.value || isRollingSftp.value) return
+	rollSftpModal.value?.show()
+}
+
+function confirmRollSftp() {
+	if (!canWriteFiles.value) return
+	rollSftpMutation()
+}
+
 const copyToClipboard = (name: string, textToCopy?: string) => {
 	if (!canWriteFiles.value) return
 	navigator.clipboard.writeText(textToCopy || '')

From 0f2c00b06b3b69ebf3f9263105ee2b9d4277028a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fran=C3=A7ois-X=2E=20T=2E?= <fetch@ferrous.ch>
Date: Mon, 31 Aug 2026 14:37:17 -0400
Subject: [PATCH 2/5] fix lint

---
 packages/ui/src/composables/server-panel-sync.ts | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/packages/ui/src/composables/server-panel-sync.ts b/packages/ui/src/composables/server-panel-sync.ts
index 1b68a6a539..30541a240e 100644
--- a/packages/ui/src/composables/server-panel-sync.ts
+++ b/packages/ui/src/composables/server-panel-sync.ts
@@ -160,11 +160,13 @@ export function useServerPanelSync(options: UseServerPanelSyncOptions) {
 	}
 
 	function applySftpCredentials(serverId: string, credentials: Archon.Servers.v1.SftpCredentials) {
-		queryClient.setQueryData<Archon.Servers.v0.Server>(legacyServerDetailKey(serverId), (current) =>
-			current ? { ...current, ...credentials } : current,
+		queryClient.setQueryData<Archon.Servers.v0.Server>(
+			legacyServerDetailKey(serverId),
+			(current) => (current ? { ...current, ...credentials } : current),
 		)
-		queryClient.setQueryData<Archon.Servers.v1.ServerFull>(serverV1DetailKey(serverId), (current) =>
-			current ? { ...current, ...credentials } : current,
+		queryClient.setQueryData<Archon.Servers.v1.ServerFull>(
+			serverV1DetailKey(serverId),
+			(current) => (current ? { ...current, ...credentials } : current),
 		)
 	}
 

From 0db12457975dca197b6a1c741eaa30fbeea5863e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fran=C3=A7ois-X=2E=20T=2E?= <fetch@ferrous.ch>
Date: Mon, 31 Aug 2026 14:42:04 -0400
Subject: [PATCH 3/5] chore: switch copy to Rotate

---
 .../src/layouts/shared/server-settings/pages/advanced.vue | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/packages/ui/src/layouts/shared/server-settings/pages/advanced.vue b/packages/ui/src/layouts/shared/server-settings/pages/advanced.vue
index e1833e1d42..0ee87747b8 100644
--- a/packages/ui/src/layouts/shared/server-settings/pages/advanced.vue
+++ b/packages/ui/src/layouts/shared/server-settings/pages/advanced.vue
@@ -265,11 +265,11 @@ const { canUseAdvancedSettings, canWriteFiles, permissionDeniedMessage } = useSe
 const messages = defineMessages({
 	rollCredentials: {
 		id: 'servers.settings.advanced.sftp.roll-credentials',
-		defaultMessage: 'Roll credentials',
+		defaultMessage: 'Rotate credentials',
 	},
 	rollCredentialsModalTitle: {
 		id: 'servers.settings.advanced.sftp.roll-credentials-modal-title',
-		defaultMessage: 'Roll credentials',
+		defaultMessage: 'Rotate credentials',
 	},
 	rollCredentialsModalDescription: {
 		id: 'servers.settings.advanced.sftp.roll-credentials-modal-description',
@@ -277,7 +277,7 @@ const messages = defineMessages({
 	},
 	rollCredentialsSuccessTitle: {
 		id: 'servers.settings.advanced.sftp.roll-credentials-success-title',
-		defaultMessage: 'SFTP credentials rolled',
+		defaultMessage: 'SFTP credentials rotated',
 	},
 	rollCredentialsSuccessText: {
 		id: 'servers.settings.advanced.sftp.roll-credentials-success-text',
@@ -285,7 +285,7 @@ const messages = defineMessages({
 	},
 	rollCredentialsErrorTitle: {
 		id: 'servers.settings.advanced.sftp.roll-credentials-error-title',
-		defaultMessage: 'Failed to roll SFTP credentials',
+		defaultMessage: 'Failed to rotate SFTP credentials',
 	},
 	rollCredentialsErrorText: {
 		id: 'servers.settings.advanced.sftp.roll-credentials-error-text',

From 5d5e98aa5bf59c1a9aaf2cc0a8bba97114598239 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fran=C3=A7ois-X=2E=20T=2E?= <fetch@ferrous.ch>
Date: Mon, 31 Aug 2026 14:43:45 -0400
Subject: [PATCH 4/5] chore: remove redundant teleport

---
 .../shared/server-settings/pages/advanced.vue | 22 ++++++++-----------
 1 file changed, 9 insertions(+), 13 deletions(-)

diff --git a/packages/ui/src/layouts/shared/server-settings/pages/advanced.vue b/packages/ui/src/layouts/shared/server-settings/pages/advanced.vue
index 0ee87747b8..ba14261e7e 100644
--- a/packages/ui/src/layouts/shared/server-settings/pages/advanced.vue
+++ b/packages/ui/src/layouts/shared/server-settings/pages/advanced.vue
@@ -1,18 +1,14 @@
 <template>
 	<div class="relative h-full w-full">
-		<Teleport to="body">
-			<div class="relative z-[100]">
-				<ConfirmModal
-					ref="rollSftpModal"
-					:title="formatMessage(messages.rollCredentialsModalTitle)"
-					:description="formatMessage(messages.rollCredentialsModalDescription)"
-					:proceed-label="formatMessage(messages.rollCredentials)"
-					:proceed-icon="RefreshCwIcon"
-					:markdown="false"
-					@proceed="confirmRollSftp"
-				/>
-			</div>
-		</Teleport>
+		<ConfirmModal
+			ref="rollSftpModal"
+			:title="formatMessage(messages.rollCredentialsModalTitle)"
+			:description="formatMessage(messages.rollCredentialsModalDescription)"
+			:proceed-label="formatMessage(messages.rollCredentials)"
+			:proceed-icon="RefreshCwIcon"
+			:markdown="false"
+			@proceed="confirmRollSftp"
+		/>
 
 		<div class="flex h-full w-full flex-col gap-4">
 			<div class="flex flex-col gap-6">

From 804d18bdff08ea7f30bbfbfc7ddba5a2abeb9d70 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fran=C3=A7ois-X=2E=20T=2E?= <fetch@ferrous.ch>
Date: Mon, 31 Aug 2026 14:47:44 -0400
Subject: [PATCH 5/5] chore: intl:extract

---
 packages/ui/src/locales/en-US/index.json | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/packages/ui/src/locales/en-US/index.json b/packages/ui/src/locales/en-US/index.json
index 6ee59db802..d306cdda7c 100644
--- a/packages/ui/src/locales/en-US/index.json
+++ b/packages/ui/src/locales/en-US/index.json
@@ -5648,6 +5648,27 @@
   "servers.remove-access-modal.what-happens-label": {
     "defaultMessage": "What happens?"
   },
+  "servers.settings.advanced.sftp.roll-credentials": {
+    "defaultMessage": "Rotate credentials"
+  },
+  "servers.settings.advanced.sftp.roll-credentials-error-text": {
+    "defaultMessage": "Please try again later."
+  },
+  "servers.settings.advanced.sftp.roll-credentials-error-title": {
+    "defaultMessage": "Failed to rotate SFTP credentials"
+  },
+  "servers.settings.advanced.sftp.roll-credentials-modal-description": {
+    "defaultMessage": "The previous username and password will stop working."
+  },
+  "servers.settings.advanced.sftp.roll-credentials-modal-title": {
+    "defaultMessage": "Rotate credentials"
+  },
+  "servers.settings.advanced.sftp.roll-credentials-success-text": {
+    "defaultMessage": "Your SFTP username and password have been regenerated."
+  },
+  "servers.settings.advanced.sftp.roll-credentials-success-title": {
+    "defaultMessage": "SFTP credentials rotated"
+  },
   "servers.setup.onboarding.installation-failed.text": {
     "defaultMessage": "An unexpected error occurred while installing. Please try again later."
   },