# Fix SSH key — upload LF scripts via SCP (no CRLF pipe issues)

$ErrorActionPreference = 'Stop'
$hostIp = '10.100.1.28'
$key = Join-Path $env:USERPROFILE '.ssh\id_ed25519_mailcow'
$pub = "$key.pub"
$remoteSh = Join-Path $PSScriptRoot 'remote-reset-authorized-keys.sh'

# Perketat ACL private key (Windows OpenSSH)
Write-Host "Fixing private key ACL..."
icacls $key /inheritance:r 2>$null | Out-Null
icacls $key /grant:r "${env:USERNAME}:(R)" 2>$null | Out-Null

# Pub key LF-only
$tempPub = Join-Path $env:TEMP 'geonet_mailcow_key.pub'
$keyLine = (Get-Content $pub -Raw).Trim() -replace "`r", ""
[System.IO.File]::WriteAllText($tempPub, $keyLine + "`n")

# Remote script LF-only
$shContent = (Get-Content $remoteSh -Raw) -replace "`r", ""
$tempSh = Join-Path $env:TEMP 'remote-reset-authorized-keys.sh'
[System.IO.File]::WriteAllText($tempSh, $shContent)

Write-Host "Upload + reset on root@${hostIp} (password 2x: scp + ssh)..."
scp -o PreferredAuthentications=password -o PubkeyAuthentication=no $tempPub "root@${hostIp}:/tmp/geonet_mailcow_key.pub"
scp -o PreferredAuthentications=password -o PubkeyAuthentication=no $tempSh "root@${hostIp}:/tmp/remote-reset-authorized-keys.sh"
ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no "root@${hostIp}" 'chmod +x /tmp/remote-reset-authorized-keys.sh && bash /tmp/remote-reset-authorized-keys.sh && rm -f /tmp/remote-reset-authorized-keys.sh'

Remove-Item $tempPub, $tempSh -Force -ErrorAction SilentlyContinue

Write-Host ""
Write-Host "Test key-only..."
ssh -i $key -o BatchMode=yes -o IdentitiesOnly=yes -o PreferredAuthentications=publickey "root@${hostIp}" "echo KEY_AUTH_OK"

if ($LASTEXITCODE -ne 0) {
    Write-Host ""
    Write-Host "Masih gagal — ambil auth.log (password sekali):"
    Write-Host "  ssh root@$hostIp `"grep sshd /var/log/auth.log | tail -20`""
    exit 1
}
Write-Host "Success. Login: ssh mailcow"