#!/bin/bash
set -e

export PATH="/usr/bin:/bin:/usr/sbin:/sbin"

dest=/var/run/foodoor-keys
temp_outfile=$dest.tmp

if [ ! -e "$dest/.git/config" ]; then
    #echo "Repo does not exist, trying to clone..."
    git -C "$dest" clone --quiet --single-branch --depth=1 ssh://git.chaospott.de/Keyverwaltung/foodoor-keys.git "$dest"
else
    #echo "Repo exists, updating..."
    git -C "$dest" fetch --quiet && git -C "$dest" merge --quiet origin/master master
fi

rm -f "$temp_outfile"
find "$dest/keys" -type f -name '*.pub' | sort |
    while read -r keyfile; do
        if ssh-keygen -l -f "$keyfile" &> /dev/null; then
            keyinfo=$(ssh-keygen -l -f "$keyfile")             # The whole key information
            crypto=$(echo "$keyinfo" | sed 's/.*(\(.*\))/\1/') # Looks like "RSA" or "ED25519"
            key_length=$(echo "$keyinfo" | cut -d" " -f1)

            if [ "$crypto" == "RSA" ]; then
                if [ "$key_length" -lt 4096 ]; then
                    echo "Key size of key $keyfile less than 4096. Not adding it to key database." >&2
                    continue
                fi
                # valid
            elif [ "$crypto" == "ED25519" ]; then
                : # valid
            else
                continue
            fi

            echo "command=\"/usr/sbin/foodoor \$action \",no-port-forwarding,no-X11-forwarding,no-agent-forwarding $(sed 's/\r//g' "$keyfile") $keyfile" >> $temp_outfile
        fi
    done

for appendix in open close door; do
    action=$appendix
    if [ "$appendix" = "door" ]; then
        action=""
    fi
    export action

    outfile=$dest/authorized_keys.$appendix
    envsubst < "$temp_outfile" > "$outfile"

    # Oben und unten
    install -d -o "$appendix" -g nogroup -m 0700 "/var/lib/foodoor/$appendix/.ssh"
    install -b -S .last -o "$appendix" -g nogroup -m 0600 "$outfile" "/var/lib/foodoor/$appendix/.ssh/authorized_keys"
done