#!/bin/sh

# rhesus: monkeysphere authorized_keys update script
#
# Written by
# Jameson Rollins <jrollins@fifthhorseman.net>
#
# Copyright 2008, released under the GPL, version 3 or later

##################################################
# load conf file
#. /etc/monkeysphere/monkeysphere.conf
. ~/ms/monkeysphere.conf

#AUTH_KEYS_DIR_BASE=/var/lib/monkeysphere/authorized_keys/
AUTH_KEYS_DIR_BASE=~/ms/authorized_keys

export GNUPGHOME
##################################################

CMD=$(basename $0)

usage() {
cat <<EOF
usage: $CMD USERNAME
EOF
}

failure() {
    echo "$1" >&2
    exit ${2:-'1'}
}

meat() {
    grep -v -e "^[[:space:]]*#" -e '^$' "$1"
}

cutline() {
    head --line="$1" | tail -1
}

### MAIN

if [ -z "$1" ] ; then
    usage
    exit 1
fi

# user name of user to update
USERNAME="$1"
if ! id "$USERNAME" > /dev/null ; then
    failure "User '$USERNAME' does not exist."
fi

AUTH_USER_IDS="$AUTH_USER_IDS_DIR"/"$USERNAME"
if [ ! -e "$AUTH_USER_IDS" ] ; then
    failure "No auth_user_ids file for user '$USERNAME'."
fi

AUTH_KEYS_DIR="$AUTH_KEYS_DIR_BASE"/"$USERNAME"/keys
AUTH_KEYS_FILE="$AUTH_KEYS_DIR_BASE"/authorized_keys

# make sure the gnupg home exists with proper permissions
mkdir -p "$GNUPGHOME"
chmod 0700 "$GNUPGHOME"

# find number of user ids in auth_user_ids file
NLINES=$(meat "$AUTH_USER_IDS" | wc -l)

# clean out keys file and remake keys directory
rm -rf "$AUTH_KEYS_DIR"
mkdir -p "$AUTH_KEYS_DIR"

# loop through all user ids, and generate ssh keys
for (( N=1; N<=$NLINES; N=N+1 )) ; do
    # get user id
    USERID=$(meat "$AUTH_USER_IDS" | cutline "$N" )
    USERID_HASH=$(echo "$USERID" | sha1sum | awk '{ print $1 }')

    KEYFILE="$AUTH_KEYS_DIR"/"$USERID_HASH"

    # search for key on keyserver
    echo -n "ms: finding key for '$USERID'..."
    RETURN=$(echo 1 | gpg --quiet --batch --command-fd 0 --with-colons --keyserver "$KEYSERVER" --search ="$USERID" 2> /dev/null)

    # if the key was found...
    if [ "$RETURN" ] ; then
	echo " found."

	# checking key attributes
	# see /usr/share/doc/gnupg/DETAILS.gz:

	PUB_INFO=$(gpg --fixed-list-mode --with-colons --list-keys --with-fingerprint ="$USERID" | grep '^pub:')

	echo -n "ms: "

# 	# if not an authorization key exit
#  	if echo "$PUB_INFO" | cut -d: -f12 | grep -v -q '[aA]' ; then
#  	   echo "not an authorization key --> SKIPPING"
#  	   continue
# 	fi

	# if key is not fully trusted exit
        # (this includes not revoked or expired)
	# determine trust
	TRUST=$(echo "$PUB_INFO" | cut -d: -f2)
	case "$TRUST" in
	    'i')
		echo -n "invalid" ;;
	    'r')
		echo -n "revoked" ;;
	    'e')
		echo -n "expired" ;;
	    '-'|'q'|'n'|'m')
		echo -n "unacceptable trust" ;;
	    'f'|'u')
		echo -n "fully trusted"
                # convert pgp key to ssh key, and write to cache file
		echo " -> generating ssh key..."
		gpgkey2ssh "$KEYID" | sed -e "s/COMMENT/$USERID/" > "$KEYFILE"
		continue
	    ;;
	    *)
		echo -n "unknown trust" ;;
	esac
	echo " -> SKIPPING"
    fi
done

if [ $(ls "$AUTH_KEYS_DIR") ]  ; then
    echo "ms: writing ms authorized_keys file..."
    cat "$AUTH_KEYS_DIR"/* > "$AUTH_KEYS_FILE"
else
    echo "ms: no gpg keys to add to authorized_keys file."
fi
if [ -s ~"$USERNAME"/.ssh/authorized_keys ] ; then
    echo "ms: adding user authorized_keys..."
    cat ~"$USERNAME"/.ssh/authorized_keys >> "$AUTH_KEYS_FILE"
fi