#!/usr/bin/env bash
# Generate deploy SSH key and print instructions for Windows OpenSSH.

set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck source=common.sh
source "${SCRIPT_DIR}/common.sh"

setup_ssh_key() {
  local key_dir pub_file

  load_config
  key_dir="$(dirname "${SSH_KEY_PATH}")"
  pub_file="${SSH_KEY_PATH}.pub"

  mkdir -p "${key_dir}"
  chmod 700 "${key_dir}"

  if [[ -f "${SSH_KEY_PATH}" ]]; then
    warn "Key already exists: ${SSH_KEY_PATH}"
  else
    log "Generating ED25519 deploy key..."
    ssh-keygen -t ed25519 -f "${SSH_KEY_PATH}" -N "" -C "deploy@$(hostname)-$(date +%Y%m%d)"
    chmod 600 "${SSH_KEY_PATH}"
    chmod 644 "${pub_file}"
    log "Created ${SSH_KEY_PATH}"
  fi

  echo ""
  if [[ "${DEPLOY_PLATFORM:-windows}" == "linux" ]]; then
    echo "================================================================"
    echo " Add this public key to Listara (root authorized_keys)"
    echo "================================================================"
    echo ""
    cat "${pub_file}"
    echo ""
    echo "On Listara (once):"
    echo ""
    echo "  mkdir -p ~/.ssh && chmod 700 ~/.ssh"
    echo "  echo 'PASTE_PUBLIC_KEY' >> ~/.ssh/authorized_keys"
    echo "  chmod 600 ~/.ssh/authorized_keys"
    echo ""
    echo "  # Trust host fingerprint (from local Ubuntu):"
    echo "  ssh-keyscan -p ${DEPLOY_PORT:-22} ${DEPLOY_HOST:-listara.online} >> ${SSH_KNOWN_HOSTS}"
    echo ""
    echo "  # Test:"
    echo "  DEPLOY_CONFIG=deploy/deploy.conf.listara ./deploy.sh test-ssh"
    echo ""
  else
    echo "================================================================"
    echo " Add this public key to the Windows production server"
    echo "================================================================"
    echo ""
    cat "${pub_file}"
    echo ""
    echo "On Windows (PowerShell as Administrator):"
    echo ""
    echo "  # 1. Ensure OpenSSH Server is installed and running"
    echo "  Get-WindowsCapability -Online | Where-Object Name -like 'OpenSSH.Server*'"
    echo "  Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0"
    echo "  Start-Service sshd; Set-Service sshd -StartupType Automatic"
    echo ""
    echo "  # 2. Install rsync (required for deploy) — pick one:"
    echo "  choco install rsync -y"
    echo "  # or use Git for Windows / cwRsync in PATH"
    echo ""
    echo "  # 3. Add deploy key for user: ${DEPLOY_USER:-deploy}"
    echo "  \$auth = \"\$env:PROGRAMDATA\\ssh\\administrators_authorized_keys\""
    echo "  # For standard user, use: \$env:USERPROFILE\\.ssh\\authorized_keys"
    echo ""
    echo "  # 4. Trust host fingerprint (run once from Ubuntu after deploy.conf is set):"
    echo "  ssh-keyscan -p ${DEPLOY_PORT:-22} ${DEPLOY_HOST:-YOUR_HOST} >> ${SSH_KNOWN_HOSTS}"
    echo ""
  fi
  echo "================================================================"
}

test_ssh_connection() {
  load_config
  [[ -f "${SSH_KEY_PATH}" ]] || die "SSH key missing. Run: ./deploy.sh setup-ssh"
  log "Testing SSH to ${DEPLOY_USER}@${DEPLOY_HOST}:${DEPLOY_PORT}..."
  if [[ "${DEPLOY_PLATFORM:-windows}" == "linux" ]]; then
    ssh_cmd "echo SSH_OK && rsync --version | head -1"
  else
    ssh_cmd "echo SSH_OK && (rsync --version 2>nul | findstr /i \"rsync version\" || echo RSYNC_MISSING)"
  fi
}

if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
  case "${1:-setup}" in
    test) test_ssh_connection ;;
    *)    setup_ssh_key ;;
  esac
fi