# Buka SSH shell ke Mikrotik RouterOS
# Usage: .\scripts\ssh-mikrotik.ps1
#        .\scripts\ssh-mikrotik.ps1 -Command "/system resource print"
#        .\scripts\ssh-mikrotik.ps1 -UsePassword   # paksa login password (abaikan key lokal)

param(
    [string]$Command = "",
    [string]$KeyFile = "",
    [switch]$UsePassword
)

$HostAddr = "10.100.1.1"
$SshPort = 255
$SshMac = "hmac-sha1"
$SshUser = "admin"

$baseOpts = @(
    "-o", "MACs=$SshMac",
    "-o", "StrictHostKeyChecking=accept-new"
)

if (-not $UsePassword) {
    if (-not $KeyFile) {
        $rsaKey = Join-Path $env:USERPROFILE ".ssh\id_rsa_mikrotik"
        $edKey = Join-Path $env:USERPROFILE ".ssh\id_ed25519"
        if (Test-Path $rsaKey) {
            $KeyFile = $rsaKey
        } elseif (Test-Path $edKey) {
            $KeyFile = $edKey
        } else {
            Write-Error "Key tidak ditemukan. Jalankan .\scripts\setup-ssh-mikrotik.ps1 atau gunakan -UsePassword."
            exit 1
        }
    }

    $baseOpts += @("-o", "IdentitiesOnly=yes", "-i", $KeyFile)
    if ($KeyFile -like "*id_rsa*") {
        $baseOpts += @("-o", "PubkeyAcceptedAlgorithms=rsa-sha2-256,rsa-sha2-512,ssh-rsa")
    }
} else {
    $baseOpts += @(
        "-o", "PreferredAuthentications=password",
        "-o", "PubkeyAuthentication=no"
    )
}

$sshArgs = @("-m", $SshMac, "${SshUser}@${HostAddr}", "-p", $SshPort) + $baseOpts
if ($Command) {
    $sshArgs = @("-o", "BatchMode=yes") + $sshArgs + $Command
}

& ssh @sshArgs