#!/usr/bin/env bash
set -euo pipefail

HOST="89.117.79.202"
USER="foster_bridge"
KEY="${MICHEL_SSH_KEY:-$HOME/.ssh/michel_windows_ed25519}"
EXPECTED_FP="SHA256:fRtAPoPhusxctqlacXUlrMLO7H+K66/nimb8ZPamShw"
LOCAL_PORT="18644"
HERE="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
CONFIG_DIR="$HOME/.config/foster-ask-michel"
BIN_DIR="$HOME/.local/bin"
UNIT_DIR="$HOME/.config/systemd/user"
KNOWN_HOSTS="$HOME/.ssh/known_hosts"
SECRET="$CONFIG_DIR/secret"

[[ -f "$KEY" ]] || { echo "Missing SSH key: $KEY" >&2; exit 1; }
chmod 600 "$KEY"
mkdir -p "$HOME/.ssh" "$CONFIG_DIR" "$BIN_DIR" "$UNIT_DIR"
chmod 700 "$HOME/.ssh" "$CONFIG_DIR"
touch "$KNOWN_HOSTS"
chmod 600 "$KNOWN_HOSTS"

scan="$(mktemp)"
trap 'rm -f "$scan"' EXIT
ssh-keyscan -T 8 -t ed25519 "$HOST" > "$scan" 2>/dev/null
actual_fp="$(ssh-keygen -lf "$scan" -E sha256 | awk 'NR==1 {print $2}')"
if [[ "$actual_fp" != "$EXPECTED_FP" ]]; then
  echo "HOST KEY MISMATCH: expected $EXPECTED_FP, got $actual_fp" >&2
  exit 1
fi
ssh-keygen -R "$HOST" -f "$KNOWN_HOSTS" >/dev/null 2>&1 || true
cat "$scan" >> "$KNOWN_HOSTS"

batch="$(mktemp)"
printf 'get ask-michel-route-secret.txt %s\n-rm ask-michel-route-secret.txt\n' "$SECRET" > "$batch"
sftp -q -b "$batch" -i "$KEY" -o IdentitiesOnly=yes -o BatchMode=yes -o StrictHostKeyChecking=yes "$USER@$HOST"
rm -f "$batch"
[[ -s "$SECRET" ]] || { echo "Secret retrieval failed" >&2; exit 1; }
chmod 600 "$SECRET"
install -m 700 "$HERE/ask-michel" "$BIN_DIR/ask-michel"

cat > "$UNIT_DIR/foster-michel-tunnel.service" <<EOF
[Unit]
Description=Foster to Michel signed webhook SSH tunnel
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
ExecStart=/usr/bin/ssh -NT -i $KEY -o IdentitiesOnly=yes -o BatchMode=yes -o StrictHostKeyChecking=yes -o ExitOnForwardFailure=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=3 -L 127.0.0.1:$LOCAL_PORT:127.0.0.1:8644 $USER@$HOST
Restart=always
RestartSec=5

[Install]
WantedBy=default.target
EOF
chmod 600 "$UNIT_DIR/foster-michel-tunnel.service"
systemctl --user daemon-reload
systemctl --user enable --now foster-michel-tunnel.service

for _ in $(seq 1 20); do
  if curl -fsS --max-time 2 "http://127.0.0.1:$LOCAL_PORT/health" >/dev/null; then
    break
  fi
  sleep 1
done
health="$(curl -fsS --max-time 5 "http://127.0.0.1:$LOCAL_PORT/health")"
printf 'Tunnel health: %s\n' "$health"
"$BIN_DIR/ask-michel" "Linux Foster end-to-end test. Michel, reply BRIDGE VERIFIED." --context "Sal Phase 2 installation verification."
printf 'SAL_PHASE2_STATUS=SUCCESS\n'