#!/bin/bash
# Create a Linux system user for SSH access and sudo, and install their
# authorized SSH public key. Run this before harden-ssh.sh so that
# key-based access is in place before password authentication is disabled.
#
# Idempotent - safe to re-run. Run as root on the PVE host.
#
# Usage:
#   ./setup-linux-admin-user.sh <username> <ssh-public-key>
#   ./setup-linux-admin-user.sh <username> --key-file <path-to-.pub>
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck source=lib/common.sh
source "${SCRIPT_DIR}/lib/common.sh"
require_root

USERNAME="${1:-}"
if [ -z "$USERNAME" ]; then
    echo "Usage: $0 <username> <ssh-public-key>" >&2
    echo "       $0 <username> --key-file <path-to-.pub>" >&2
    exit 1
fi

shift
SSH_KEY=""
if [ "${1:-}" = "--key-file" ]; then
    KEY_FILE="${2:-}"
    [ -z "$KEY_FILE" ] && { echo "ERROR: --key-file requires a path." >&2; exit 1; }
    [ -f "$KEY_FILE" ] || { echo "ERROR: key file not found: $KEY_FILE" >&2; exit 1; }
    SSH_KEY="$(cat "$KEY_FILE")"
else
    SSH_KEY="${1:-}"
fi

if [ -z "$SSH_KEY" ]; then
    echo "ERROR: an SSH public key is required (key string or --key-file <path>)." >&2
    exit 1
fi

if ! echo "$SSH_KEY" | grep -qE '^(ssh-rsa|ssh-ed25519|ecdsa-sha2-nistp[0-9]+) [A-Za-z0-9+/=]'; then
    echo "ERROR: argument doesn't look like a valid SSH public key." >&2
    exit 1
fi

# --- create Linux user if missing ---
if id "$USERNAME" >/dev/null 2>&1; then
    echo "User '${USERNAME}' already exists - skipping useradd."
else
    useradd --create-home --shell /bin/bash "$USERNAME"
    echo "Created Linux user '${USERNAME}'."
fi

# --- sudo group membership ---
if id -nG "$USERNAME" | grep -qw sudo; then
    echo "User '${USERNAME}' is already in the sudo group."
else
    usermod --append --groups sudo "$USERNAME"
    echo "Added '${USERNAME}' to the sudo group."
fi

# --- install authorized SSH key ---
HOME_DIR="$(getent passwd "$USERNAME" | cut -d: -f6)"
SSH_DIR="${HOME_DIR}/.ssh"
AUTH_FILE="${SSH_DIR}/authorized_keys"

mkdir -p "$SSH_DIR"
chmod 700 "$SSH_DIR"
touch "$AUTH_FILE"
chmod 600 "$AUTH_FILE"
chown -R "${USERNAME}:${USERNAME}" "$SSH_DIR"

if grep -qF "$SSH_KEY" "$AUTH_FILE" 2>/dev/null; then
    echo "SSH key is already present in ${AUTH_FILE}."
else
    echo "$SSH_KEY" >> "$AUTH_FILE"
    echo "Installed SSH key in ${AUTH_FILE}."
fi

echo
echo "Linux user '${USERNAME}' is ready for SSH key-based login with sudo access."
echo "Next: run setup-admin-sudo.sh ${USERNAME} to grant NOPASSWD for pvesh/qm/pct."