From 92fc243755f2733f041f19b23be69354c53c06e9 Mon Sep 17 00:00:00 2001
From: Tom DNetto <tom@tailscale.com>
Date: Wed, 8 Mar 2023 14:06:29 -0800
Subject: [PATCH] cmd/tailscale: annotate tailnet-lock keys which wrap pre-auth
 keys

Signed-off-by: Tom DNetto <tom@tailscale.com>
---
 cmd/tailscale/cli/network-lock.go | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/cmd/tailscale/cli/network-lock.go b/cmd/tailscale/cli/network-lock.go
index ffa868d8a..8d21d4062 100644
--- a/cmd/tailscale/cli/network-lock.go
+++ b/cmd/tailscale/cli/network-lock.go
@@ -232,6 +232,15 @@ func runNetworkLockStatus(ctx context.Context, args []string) error {
 			if k.Key == st.PublicKey {
 				line.WriteString("(self)")
 			}
+			if k.Metadata["purpose"] == "pre-auth key" {
+				if preauthKeyID := k.Metadata["authkey_stableid"]; preauthKeyID != "" {
+					line.WriteString("(pre-auth key ")
+					line.WriteString(preauthKeyID)
+					line.WriteString(")")
+				} else {
+					line.WriteString("(pre-auth key)")
+				}
+			}
 			fmt.Println(line.String())
 		}
 	}