package keymgr

import (
	"fmt"
	"strings"

	"ssh-access-tui/internal/model"
)

// RenderClientConfig produces an OpenSSH client config (works identically on
// Windows' built-in OpenSSH client, macOS, and Linux) that gives the user a
// "jump" alias plus one alias per host they're allowed to reach.
//
// This file is convenience only, not a security boundary: nothing stops a
// user from editing it or invoking ssh by hand. The actual restriction to
// these hosts is enforced server-side via authorized_keys permitopen=
// (see internal/sysadm/authorizedkeys.go) independent of what this file says.
func RenderClientConfig(jumpHost string, jumpPort int, username, keyFileName string, hosts []model.Host) string {
	var b strings.Builder
	fmt.Fprintf(&b, "# ssh-access-tui client config for %s\n", username)
	fmt.Fprintf(&b, "# Generated %s. Regenerated whenever your allowed host list changes.\n\n", genTimestamp())

	fmt.Fprintf(&b, "Host jump\n")
	fmt.Fprintf(&b, "    HostName %s\n", jumpHost)
	fmt.Fprintf(&b, "    Port %d\n", jumpPort)
	fmt.Fprintf(&b, "    User %s\n", username)
	fmt.Fprintf(&b, "    IdentityFile ~/.ssh/%s\n", keyFileName)
	fmt.Fprintf(&b, "    IdentitiesOnly yes\n\n")

	for _, h := range hosts {
		fmt.Fprintf(&b, "Host %s\n", h.Name)
		fmt.Fprintf(&b, "    HostName %s\n", h.Address)
		fmt.Fprintf(&b, "    Port %d\n", h.Port)
		fmt.Fprintf(&b, "    User %s\n", username)
		fmt.Fprintf(&b, "    ProxyJump jump\n")
		fmt.Fprintf(&b, "    IdentityFile ~/.ssh/%s\n", keyFileName)
		fmt.Fprintf(&b, "    IdentitiesOnly yes\n")
		if h.Description != "" {
			fmt.Fprintf(&b, "    # %s\n", h.Description)
		}
		b.WriteString("\n")
	}
	return b.String()
}