$ErrorActionPreference = 'Stop'

$publicKey = (
    ssh.exe miket@192.168.50.100 `
        'cat /home/miket/.ssh/id_ed25519.pub'
).Trim()

if ($LASTEXITCODE -ne 0 -or $publicKey -notmatch '^ssh-ed25519\s+\S+') {
    throw 'Nie udało się poprawnie pobrać klucza publicznego z devbox.'
}

$isAdminMember = [bool](
    whoami.exe /groups | Select-String 'S-1-5-32-544'
)

if ($isAdminMember) {
    $authorizedKeys = Join-Path $env:ProgramData `
        'ssh\administrators_authorized_keys'
} else {
    $sshDirectory = Join-Path $env:USERPROFILE '.ssh'
    New-Item -ItemType Directory -Force -Path $sshDirectory | Out-Null
    $authorizedKeys = Join-Path $sshDirectory 'authorized_keys'
}

$existingKeys = @(
    if (Test-Path $authorizedKeys) {
        Get-Content $authorizedKeys
    }
)

if ($existingKeys -notcontains $publicKey) {
    $publicKey | Out-File `
        -FilePath $authorizedKeys `
        -Encoding ascii `
        -Append
}

if ($isAdminMember) {
    icacls.exe $authorizedKeys /inheritance:r | Out-Null
    icacls.exe $authorizedKeys `
        /grant:r '*S-1-5-32-544:F' '*S-1-5-18:F' | Out-Null

    if ($LASTEXITCODE -ne 0) {
        throw 'Nie udało się ustawić ACL administrators_authorized_keys.'
    }
}

Write-Host "READY user=$env:USERNAME file=$authorizedKeys"