#!/bin/bash

# Hypervisor Support Access Manager
# Version: 1.1
# Description: Securely manage Hypervisor support team SSH access

RED="\e[1;31m"
GREEN="\e[1;32m"
YELLOW="\e[1;33m"
BLUE="\e[1;34m"
ENDCOLOR="\e[0m"

SUPPORT_EMAIL="support@readydedis.com"
KEY_URL="https://packages.hypervisor.io/support_key.pub"
CHECKSUM_URL="https://packages.hypervisor.com/support_key.checksum"
TEMP_DIR="/tmp/hypervisor_support_${RANDOM}"
BACKUP_DIR="$HOME/.ssh/hypervisor_backups"
AUTH_KEYS="$HOME/.ssh/authorized_keys"

help() {
    echo -e "\n${BLUE}Hypervisor Support Access Manager${ENDCOLOR}"
    echo "Usage: hv_support.sh [add|remove|check|backup]"
    echo -e "\nOptions:"
    echo "  add     - Install and verify Hypervisor support key"
    echo "  remove  - Remove Hypervisor support key"
    echo "  check   - Verify if support key exists"
    echo "  backup  - Create backup of authorized_keys"
    echo -e "  help    - Show this help message\n"
    exit 0
}

initialize() {
    mkdir -p "$TEMP_DIR" "$BACKUP_DIR"
    chmod 700 "$TEMP_DIR" "$BACKUP_DIR"
}

cleanup() {
    rm -rf "$TEMP_DIR"
}

create_backup() {
    local timestamp=$(date +%Y%m%d_%H%M%S)
    cp "$AUTH_KEYS" "${BACKUP_DIR}/authorized_keys_${timestamp}"
    echo -e "${GREEN}Backup created: ${BACKUP_DIR}/authorized_keys_${timestamp}${ENDCOLOR}"
}

verify_key() {
    echo -e "${YELLOW}Verifying support key authenticity...${ENDCOLOR}"
    if ! curl -s --fail "$KEY_URL" -o "$TEMP_DIR/support_key.pub"; then
        echo -e "${RED}Error: Could not download support key${ENDCOLOR}"
        return 1
    fi

    if ! curl -s --fail "$CHECKSUM_URL" -o "$TEMP_DIR/support_key.checksum"; then
        echo -e "${RED}Error: Could not download checksum${ENDCOLOR}"
        return 1
    fi

    (cd "$TEMP_DIR" && sha1sum -c support_key.checksum >/dev/null 2>&1)
    return $?
}

add_key() {
    if grep -q "$SUPPORT_EMAIL" "$AUTH_KEYS" 2>/dev/null; then
        echo -e "${YELLOW}Hypervisor support key already exists${ENDCOLOR}"
        return
    fi

    if ! verify_key; then
        echo -e "${RED}Security alert: Key verification failed! Contact Hypervisor support.${ENDCOLOR}"
        exit 1
    fi

    create_backup
    mkdir -p ~/.ssh
    chmod 700 ~/.ssh
    cat "$TEMP_DIR/support_key.pub" >> "$AUTH_KEYS"
    chmod 600 "$AUTH_KEYS"
    echo -e "${GREEN}Hypervisor support key installed successfully${ENDCOLOR}"
}

remove_key() {
    if ! grep -q "$SUPPORT_EMAIL" "$AUTH_KEYS" 2>/dev/null; then
        echo -e "${YELLOW}Hypervisor support key not found${ENDCOLOR}"
        return
    fi

    create_backup
    sed -i "/$SUPPORT_EMAIL/d" "$AUTH_KEYS"
    echo -e "${GREEN}Hypervisor support key removed successfully${ENDCOLOR}"
}

check_key() {
    if grep -q "$SUPPORT_EMAIL" "$AUTH_KEYS" 2>/dev/null; then
        echo -e "${GREEN}Hypervisor support key IS installed${ENDCOLOR}"
        return 0
    else
        echo -e "${YELLOW}Hypervisor support key NOT installed${ENDCOLOR}"
        return 1
    fi
}

# Main execution
case "$1" in
    add|remove|check|backup|help|--help|-h)
        initialize
        case "$1" in
            add) add_key ;;
            remove) remove_key ;;
            check) check_key ;;
            backup) create_backup ;;
            *) help ;;
        esac
        cleanup
        ;;
    *)
        help
        ;;
esac

exit 0