#!/usr/bin/env bash
# Phase 7a (AUD-115): the SSH trigger key for the 6:00am n8n workflow.
#
# The n8n container mounts ~/.ssh read-only at /home/node/.ssh (see the n8n
# compose file). This script creates a dedicated key there and prints the exact
# `authorized_keys` line that restricts it to one command. Nothing else can use
# the key: no shell, no port forwarding, no agent.
#
# This writes under $HOME/.ssh, which is OUTSIDE this repository. Run it only
# after the change is approved. Default run is a dry run and prints the plan.
#
# Usage:
#   deploy/setup-n8n-scan-key.sh            # dry run, print the plan
#   deploy/setup-n8n-scan-key.sh --apply    # create the key + authorize it
#
# Environment overrides:
#   KEY        private key path   (default ~/.ssh/id_ed25519_school_scan)
#   SCAN_CMD   forced command     (default the morning brief on the host)
set -euo pipefail

KEY="${KEY:-$HOME/.ssh/id_ed25519_school_scan}"
SCAN_CMD="${SCAN_CMD:-cd /home/sam/paseo/projects/compass_teams_nhs && ./scripts/morning-brief.sh}"
AUTH="${AUTH:-$HOME/.ssh/authorized_keys}"
COMMENT="n8n-school-scan"

APPLY=0
case "${1:-}" in
  --apply) APPLY=1 ;;
  -h|--help) sed -n '2,20p' "$0"; exit 0 ;;
  '') ;;
  *) echo "unknown argument: $1" >&2; exit 2 ;;
esac

if [[ "$APPLY" -eq 0 ]]; then
  echo "DRY RUN — no files are written. Re-run with --apply."
fi

if [[ ! -f "$KEY" ]]; then
  if [[ "$APPLY" -eq 1 ]]; then
    echo "creating $KEY"
    ssh-keygen -t ed25519 -N '' -C "$COMMENT" -f "$KEY" >/dev/null
  else
    echo "would create key : $KEY ($COMMENT)"
  fi
fi

PUB="$(cat "$KEY.pub" 2>/dev/null || echo '<key not created yet>')"
LINE="restrict,command=\"$SCAN_CMD\" $PUB"

echo "key             : $KEY"
echo "forced command  : $SCAN_CMD"
echo "authorized_keys : $AUTH"
echo
echo "line to add:"
echo "  $LINE"

if [[ "$APPLY" -eq 1 ]]; then
  if grep -qF "$PUB" "$AUTH"; then
    echo
    echo "public key already present in $AUTH — nothing to add"
  else
    printf '%s\n' "$LINE" >> "$AUTH"
    chmod 600 "$AUTH"
    echo
    echo "added the restricted key to $AUTH"
  fi
  echo
  echo "the n8n container now sees it at: /home/node/.ssh/$(basename "$KEY")"
fi