//! SSH key management commands.

//!

//! The SSH daemon uses these to look up and authorise incoming

//! connections; the automation CLI uses them to add / list / remove

//! keys for a user. Keeping them all server-side means both surfaces

//! share one source of truth and one set of SQL queries.

use chrono::{DateTime, Utc};

use serde::Serialize;

use sqlx::Connection;

use sqlx::types::Uuid;

use std::fmt::Debug;

use supp_macro::command;

use super::{CmdError, CmdResult};

use crate::{config::ConfigError, db::get_connection};

// Adding a key flips `ssh_enabled` back to TRUE, so a switched-off account must

// not reach this write. Gating at the write rather than in the daemon covers

// ssh-copy-id, the TUI's `CliSshKeyAdd`/`CliSshKeyRemove` and the web page

// alike. Locks the row, so it must run inside the writing transaction.

    {

    }

/// Wire-format record of an SSH public key. Lives in

/// `server::command` so consumers don't reach into the DB layer

/// directly.

#[derive(Debug, Clone, Serialize)]

pub struct SshKeyRecord {

    pub id: Uuid,

    pub user_id: Uuid,

    pub key_type: String,

    pub key_blob: Vec<u8>,

    pub fingerprint: String,

    pub annotation: String,

    pub created_at: DateTime<Utc>,

    pub last_used_at: Option<DateTime<Utc>>,

}

// Add a key for `user_id`. Idempotent on `(user_id, fingerprint)`:

// re-adding the same key updates its annotation and leaves the

// original creation timestamp intact. Flips `users.ssh_enabled` to

// `TRUE` as a side effect so a fresh key immediately permits SSH

// login.

command! {

    AddSshKey {

        #[required]

        user_id: Uuid,

        #[required]

        key_type: String,

        #[required]

        key_blob: Vec<u8>,

        #[required]

        fingerprint: String,

        #[optional]

        annotation: String,

    } => {

        let mut tx = conn.begin().await?;

        require_verified(&mut tx, user_id).await?;

        let annotation = annotation.unwrap_or_default();

        let row = sqlx::query_file!(

            "sql/insert/ssh_keys/add.sql",

            user_id,

            key_type,

            key_blob,

            fingerprint,

            annotation,

        )

        .fetch_one(&mut *tx)

        .await

        .map_err(refuse_a_key_held_elsewhere)?;

        sqlx::query_file!("sql/update/users/set_ssh_enabled.sql", user_id, true)

            .execute(&mut *tx)

            .await?;

        tx.commit().await?;

        Ok(Some(CmdResult::Uuid(row.id)))

    }

// List all keys for `user_id`, sorted by creation time (oldest

// first).

/// A public key names exactly one account, so adding one that another account

/// already holds is the caller's mistake, not a database fault.

    {

        return CmdError::Args(

        );

command! {

    ListSshKeys {

        #[required]

        user_id: Uuid,

    } => {

        let rows = sqlx::query_file!(

            "sql/select/ssh_keys/list_for_user.sql",

            user_id

        )

        .fetch_all(&mut *conn)

        .await?;

        let keys = rows

            .into_iter()

            .map(|r| SshKeyRecord {

            .collect();

        Ok(Some(CmdResult::SshKeys(keys)))

    }

// Remove a key by `(user_id, fingerprint)`. When the user has no

// remaining keys, flips `ssh_enabled` back to `FALSE` so the account

// doesn't retain the password-auth bypass left over from adding a

// key.

command! {

    RemoveSshKey {

        #[required]

        user_id: Uuid,

        #[required]

        fingerprint: String,

    } => {

        let mut tx = conn.begin().await?;

        require_verified(&mut tx, user_id).await?;

        sqlx::query_file!(

            "sql/delete/ssh_keys/by_fingerprint.sql",

            user_id,

            fingerprint

        )

        .execute(&mut *tx)

        .await?;

        let remaining = sqlx::query_file!(

            "sql/select/ssh_keys/count_for_user.sql",

            user_id

        )

        .fetch_one(&mut *tx)

        .await?

        .count

        .unwrap_or(0);

        if remaining == 0 {

            sqlx::query_file!("sql/update/users/set_ssh_enabled.sql", user_id, false)

                .execute(&mut *tx)

                .await?;

        }

        tx.commit().await?;

        Ok(Some(CmdResult::Bool(true)))

    }

// Returns `Bool(true)` when `user_id` has at least one registered

// public key. Drives the password-once gate at the SSH daemon: once

// any key is on file, password auth for that user is permanently

// rejected.

command! {

    UserHasSshKey {

        #[required]

        user_id: Uuid,

    } => {

        let count = sqlx::query_file!(

            "sql/select/ssh_keys/count_for_user.sql",

            user_id

        )

        .fetch_one(&mut *conn)

        .await?

        .count

        .unwrap_or(0);

        Ok(Some(CmdResult::Bool(count > 0)))

    }

// Resolve a fingerprint to a user id. Returns `None` when the

// fingerprint is unknown or the user has `ssh_enabled = FALSE`.

// Used by the SSH daemon's publickey auth callback. Stamps

// `last_used_at` on success so operators can spot unused keys.

command! {

    LookupUserBySshKey {

        #[required]

        fingerprint: String,

    } => {

        // The fingerprint is unique (migration 0007), so this is at most one row.

        let Some(row) = sqlx::query_file!(

            "sql/select/ssh_keys/lookup_user.sql",

            fingerprint

        )

        .fetch_optional(&mut *conn)

        .await?

        else {

            return Ok(None);

        };

        if !row.ssh_enabled || !row.verified {

            return Ok(None);

        }

        sqlx::query_file!(

            "sql/update/ssh_keys/touch_last_used.sql",

            fingerprint,

            row.user_id

        )

            .execute(&mut *conn)

            .await?;

        Ok(Some(CmdResult::Uuid(row.user_id)))

    }

#[cfg(test)]

mod command_tests;