#!/usr/bin/env bash
# Local OpenSSH test server (no Docker). Listens on 127.0.0.1:2222 with pubkey auth
# for your current login user. Ctrl+C stops the server.
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
RUNTIME_DIR="${OPENSSH_TEST_RUNTIME:-$SCRIPT_DIR/runtime}"
PORT="${OPENSSH_TEST_PORT:-2222}"
LISTEN="${OPENSSH_TEST_LISTEN:-127.0.0.1}"

mkdir -p "$RUNTIME_DIR"
RUNTIME_DIR="$(cd "$RUNTIME_DIR" && pwd)"

find_sshd() {
  if [[ -n "${SSHD_BINARY:-}" && -x "$SSHD_BINARY" ]]; then
    echo "$SSHD_BINARY"
    return
  fi
  for c in /usr/sbin/sshd /usr/lib/ssh/sshd /usr/libexec/sshd /sbin/sshd; do
    if [[ -x "$c" ]]; then
      echo "$c"
      return
    fi
  done
  if command -v sshd &>/dev/null; then
    command -v sshd
    return
  fi
  echo "sshd not found. Install OpenSSH server (macOS: System Settings → General → Sharing → Remote Login, or use Homebrew openssh)." >&2
  exit 1
}

SSHD_BIN="$(find_sshd)"
TEST_USER="$(id -un)"

HOST_KEY="$RUNTIME_DIR/ssh_host_ed25519_key"
CLIENT_KEY="$RUNTIME_DIR/client_ed25519"
AUTH_KEYS="$RUNTIME_DIR/authorized_keys"
CONFIG="$RUNTIME_DIR/sshd_config"
PID_FILE="$RUNTIME_DIR/sshd.pid"

if [[ ! -f "$HOST_KEY" ]]; then
  echo "Generating host key..."
  ssh-keygen -t ed25519 -f "$HOST_KEY" -N "" -q
fi
chmod 600 "$HOST_KEY" 2>/dev/null || true

if [[ ! -f "$CLIENT_KEY" ]]; then
  echo "Generating client key (for ssh / bare-ssh2 tests)..."
  ssh-keygen -t ed25519 -f "$CLIENT_KEY" -N "" -q
fi
chmod 600 "$CLIENT_KEY" 2>/dev/null || true

cp "${CLIENT_KEY}.pub" "$AUTH_KEYS"
chmod 644 "$AUTH_KEYS"

# internal-sftp avoids hunting for sftp-server binary paths
cat >"$CONFIG" <<EOF
# Generated by bare-ssh2 scripts/openssh-test-server/run.sh — do not edit by hand
Port $PORT
ListenAddress $LISTEN
HostKey $HOST_KEY
PidFile $PID_FILE
UseDNS no
PermitEmptyPasswords no
PasswordAuthentication no
KbdInteractiveAuthentication no
ChallengeResponseAuthentication no
PubkeyAuthentication yes
AuthorizedKeysFile $AUTH_KEYS
PermitRootLogin no
StrictModes no
Subsystem sftp internal-sftp
LogLevel INFO
UsePAM no
EOF

cleanup() {
  rm -f "$PID_FILE"
}
trap cleanup EXIT

echo ""
echo "OpenSSH test server"
echo "  sshd:     $SSHD_BIN"
echo "  listen:   $LISTEN port $PORT"
echo "  user:     $TEST_USER (your OS login — pubkey only)"
echo "  identity: $CLIENT_KEY"
echo ""
echo "Quick test (OpenSSH client):"
echo "  ssh -i \"$CLIENT_KEY\" -p $PORT -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ${TEST_USER}@${LISTEN} echo ok"
echo ""
echo "SFTP:"
echo "  sftp -i \"$CLIENT_KEY\" -P $PORT -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ${TEST_USER}@${LISTEN}"
echo ""
echo "Starting sshd in foreground (Ctrl+C to stop)..."
echo ""

exec "$SSHD_BIN" -D -e -f "$CONFIG"