# Generate a Gitea SSH key-verification signature (official UI challenge).
# Token from /user/settings/keys -> Verify. Never commit the token.
# Matches: echo -n 'TOKEN' | ssh-keygen -Y sign -n gitea -f KEY

param(
    [Parameter(Mandatory = $true)]
    [string]$Token,
    [string]$KeyPath
)

$ErrorActionPreference = 'Stop'
. (Join-Path $PSScriptRoot 'common.ps1')

if ([string]::IsNullOrWhiteSpace($KeyPath)) {
    $gitProfile = Get-GitSkillsProfile
    if ($gitProfile -and $gitProfile.sshKeyPath) {
        $KeyPath = [string]$gitProfile.sshKeyPath
    } else {
        $KeyPath = Join-Path $env:USERPROFILE '.ssh\id_ed25519'
    }
}

$token = $Token.Trim()
if ([string]::IsNullOrWhiteSpace($token)) {
    Write-StatusLine -Key 'status' -Value 'failed'
    Write-StatusLine -Key 'reason' -Value 'token_empty'
    exit 1
}

if (-not (Test-Path -LiteralPath $KeyPath)) {
    $pub = $KeyPath + '.pub'
    if (Test-Path -LiteralPath $pub) {
        $KeyPath = $pub
    } else {
        Write-StatusLine -Key 'status' -Value 'failed'
        Write-StatusLine -Key 'reason' -Value 'key_missing'
        Write-StatusLine -Key 'key_path' -Value $KeyPath
        exit 1
    }
}

$bash = Join-Path $env:ProgramFiles 'Git\bin\bash.exe'
if (-not (Test-Path -LiteralPath $bash)) {
    Write-StatusLine -Key 'status' -Value 'failed'
    Write-StatusLine -Key 'reason' -Value 'git_bash_missing'
    Write-Output 'hint=Install Git for Windows, or run the echo -n | ssh-keygen command from the Gitea page in Git Bash'
    exit 1
}

# Convert Windows path to Git Bash path: C:\Users\... -> /c/Users/...
$full = [System.IO.Path]::GetFullPath($KeyPath)
$drive = $full.Substring(0, 1).ToLower()
$rest = $full.Substring(2) -replace '\\', '/'
$unixKey = "/$drive$rest"

$prevEap = $ErrorActionPreference
$ErrorActionPreference = 'Continue'
try {
    $sigText = Invoke-GitSkillsNativeWithInput -FilePath $bash -ArgumentList @('-lc', "ssh-keygen -Y sign -n gitea -f '$unixKey'") -InputText $token | Out-String
}
finally {
    $ErrorActionPreference = $prevEap
}
if ($sigText -notmatch 'BEGIN SSH SIGNATURE') {
    Write-StatusLine -Key 'status' -Value 'failed'
    Write-StatusLine -Key 'reason' -Value 'sign_failed'
    Write-StatusLine -Key 'key_path' -Value $KeyPath
    exit 1
}

Write-StatusLine -Key 'status' -Value 'ok'
Write-StatusLine -Key 'key_path' -Value $KeyPath
Write-Output '-----BEGIN_SIGNATURE_BODY-----'
$capture = $false
foreach ($line in ($sigText -split "`r?`n")) {
    if ($line -match 'BEGIN SSH SIGNATURE') { $capture = $true }
    if ($capture) { Write-Output $line }
    if ($line -match 'END SSH SIGNATURE') { break }
}
Write-Output '-----END_SIGNATURE_BODY-----'
Write-Output 'Paste the SSH SIGNATURE block into Gitea Verify, then click verify.'