#!/usr/bin/php
<?php
// This is called by SSH daemon to lookup a fingerprint
// Called by AuthorizedKeysCommand in sshd_config
error_reporting(E_ALL);
ini_set('track_errors', 'On');
set_time_limit(30);

$_s = microtime(TRUE);

require_once('/etc/rocketgit/config.php');

$INC = $rg_scripts . '/inc';
require_once($INC . '/init.inc.php');
require_once($INC . '/log.inc.php');
require_once($INC . '/sql.inc.php');
require_once($INC . '/struct.inc.php');
require_once($INC . '/cache.inc.php');
require_once($INC . '/prof.inc.php');
require_once($INC . '/keys.inc.php');
require_once($INC . '/user.inc.php');
require_once($INC . '/fixes.inc.php');


rg_prof_start('MAIN');

rg_log_set_file($rg_log_dir . '/authorize.log');
rg_log_set_sid('000000'); // to spread the logs

rg_sql_app('rg_authorize-' . $rg_log_sid);
$db = rg_sql_open($rg_sql);
if ($db === FALSE) {
	rg_log('Cannot connect to db!');
	exit(1);
}

if ($_SERVER['argc'] < 2) {
	rg_log('Invalid number of parameters (' . $_SERVER['argc'] . ')!');
	rg_log_ml('argv: ' . print_r($_SERVER['argv'], TRUE));
	exit(1);
}

$fp = trim($_SERVER['argv'][1]);
if (strncmp($fp, 'SHA256:', 7) != 0) {
	rg_log('Invalid fingerprint type: ' . $fp . '!');
	exit(1);
}
$fp = substr($fp, 7);
$fp = rtrim($fp, '=');

$r = rg_keys_search_by_fingerprint($db, $fp);
if ($r['ok'] !== 1) {
	rg_log('Cannot lookup by fingerprint: ' . rg_keys_error());
	exit(1);
}
rg_log('DEBUG: Found ' . count($r['list']) . ' key(s)');

$global_flags = rg_keys_global_flags($db);

foreach ($r['list'] as $i) {
	// Ignore invalid keys
	$ki = rg_keys_info($i['key']);
	if ($ki['ok'] != 1)
		continue;

	// Ignore weak keys
	$r = rg_keys_weak($db, $ki);
	if ($r['ok'] != 1)
		continue;
	if ($r['weak'] != 0)
		continue;

	rg_log('Sending key ' . $i['key_id'] . ' ' . $ki['fingerprint_sha256']);
	echo rg_keys_output_line($i, $global_flags);
}

rg_prof_end('MAIN');
rg_prof_log();