#!/usr/bin/env python

# -*- coding: utf-8 -*-

"""

 (c) 2014-2018 - Copyright Red Hat Inc

 Authors:

   Patrick Uiterwijk <puiterwijk@redhat.com></puiterwijk@redhat.com>

"""

from __future__ import unicode_literals, print_function

import sys

import os

# Since this is run by sshd, we don't have a way to set environment

# variables ahead of time

if "PAGURE_CONFIG" not in os.environ and os.path.exists(

    "/etc/pagure/pagure.cfg"

):

    os.environ["PAGURE_CONFIG"] = "/etc/pagure/pagure.cfg"

# Here starts the code

import pagure

import pagure.lib

from pagure.config import config as pagure_config

from pagure.lib.model import User, DeployKey

# Get the arguments

# Expect sshd config:

# AuthorizedKeysCommand: <scriptpath> "%u" "%h" "%t" "%f"</scriptpath>

# <us> <username> <homedir> <keytype> <fingerprint></fingerprint></keytype></homedir></username></us>

# At this moment, we ignore the homedir and fingerprint, since looking

# up a key by fingerprint would require some model changes (ssh keys would

#   need to be stored in a fashion like DeployKeys).

# But to not break installations in the future, we should ask installations

# to set up sshd in a way that it will work if we use them in the future.

if len(sys.argv) < 5:

    print("Invalid call, too few arguments", file=sys.stderr)

    sys.exit(1)

username, userhome, keytype, fingerprint = sys.argv[1:5]

username_lookup = pagure_config["SSH_KEYS_USERNAME_LOOKUP"]

expect_username = pagure_config["SSH_KEYS_USERNAME_EXPECT"]

if username in pagure_config["SSH_KEYS_USERNAME_FORBIDDEN"]:

    print("User is forbidden for keyhelper.", file=sys.stderr)

    sys.exit(1)

if not username_lookup:

    if not expect_username:

        print("Pagure keyhelper configured incorrectly", file=sys.stderr)

        sys.exit(1)

    if username != expect_username:

        # Nothing to look up, this user is not git-related

        sys.exit(0)

session = pagure.lib.create_session(pagure_config["DB_URL"])

if not session:

    print("Unable to get database access")

    sys.exit(1)

# First try to figure out if this is a deploykey.

# We can look those up very quickly, since those are already

# indexed by key fingerprint.

query = session.query(DeployKey).filter(

    DeployKey.ssh_search_key == fingerprint

)

for dkey in query.all():

    keyenv = {

        "username": "deploykey_%s_%s"

        % (werkzeug.secure_filename(dkey.project.fullname), dkey.id)

    }

    print(

        "%s %s"

        % (pagure_config["SSH_KEYS_OPTIONS"] % keyenv, dkey.public_ssh_key)

    )

    sys.exit(0)

# Now look if it's a normal user

query = session.query(User)

if username_lookup:

    query = query.filter(User.user == username)

for user in query.all():

    for key in user.public_ssh_key.split("\n"):

        # Make slightly more sane

        key = key.strip()

        # Check if this could even be a valid key

        key = key.split(" ")

        # Should be at the very least ["<keytype>", "</keytype>

        if len(key) < 2:

            continue

        # If the keytype doesn't match, just ignore the key

        if key[0] != keytype:

            continue

        # Build up some variables to use in the ssh key options

        keyenv = {"username": user.username}

        # This is a possible key, print it

        print(

            "%s %s %s"

            % (pagure_config["SSH_KEYS_OPTIONS"] % keyenv, key[0], key[1])

        )