#!/bin/bash
# Restricted command wrapper for the wp-agent deploy key (Pro Import project only).
# Installed via `command=` in /home/wp-agent/.ssh/authorized_keys so that even if this
# key leaks, it can only run the exact deploy operations telegram_pro_import's
# .github/workflows/deploy.yml uses — nothing else on this shared host.
#
# No heredoc/stdin-script execution is allowed: every operation must arrive as an
# explicit $SSH_ORIGINAL_COMMAND that matches one of the patterns below.

CMD="$SSH_ORIGINAL_COMMAND"

# 1. scp file transfer (legacy protocol, `scp -O`) — only into /tmp. Either a full
#    filename (scp -t /tmp/file.html) or a bare directory (scp -t /tmp/, when deploy.yml
#    doesn't rename the file and scp keeps the source basename) — both confined to /tmp.
if [[ "$CMD" =~ ^scp\ -t\ /tmp/([A-Za-z0-9._-]+)?$ ]]; then
  exec $CMD
fi

# 2. publish-article <wp_slug> <tmp_html_path> — wraps the wp post list/update/create logic
if [[ "$CMD" =~ ^publish-article\ [A-Za-z0-9_-]+\ /tmp/[A-Za-z0-9._-]+\.html$ ]]; then
  exec /usr/local/bin/publish-article ${CMD#publish-article }
fi

# 3. mkdir -p into the uploads dir (already also enforced by sudoers, belt-and-suspenders)
if [[ "$CMD" =~ ^sudo\ -u\ www-data\ mkdir\ -p\ \"/var/www/proimport-shop\.ru/wp-content/uploads/[A-Za-z0-9/_-]+\"$ ]]; then
  exec bash -c "$CMD"
fi

# 4. cp from /tmp into uploads, then rm the /tmp copy — the exact pattern deploy.yml sends
if [[ "$CMD" =~ ^sudo\ -u\ www-data\ cp\ \"/tmp/[A-Za-z0-9._-]+\"\ \"/var/www/proimport-shop\.ru/wp-content/uploads/[A-Za-z0-9/_.-]+\"\ \&\&\ rm\ -f\ /tmp/[A-Za-z0-9._-]+$ ]]; then
  exec bash -c "$CMD"
fi

# 5. cp dzen-feed.xml variant (no quotes, fixed filename)
if [[ "$CMD" == "sudo -u www-data cp /tmp/dzen-feed.xml /var/www/proimport-shop.ru/wp-content/uploads/dzen-feed.xml && rm -f /tmp/dzen-feed.xml" ]]; then
  exec bash -c "$CMD"
fi

# 6. set-article-seo <wp_slug> <tmp_json_path> — writes real post_title + Yoast SEO
#    meta (description, focus keyword, og:image) from a JSON file scp'd into /tmp,
#    so social previews and search snippets reflect the article instead of the
#    bare slug. Title/description text never travels through the SSH command line
#    (only the slug does) — it lives in the JSON file content, sidestepping any
#    Cyrillic/quoting issues in this regex.
if [[ "$CMD" =~ ^set-article-seo\ [A-Za-z0-9_-]+\ /tmp/[A-Za-z0-9._-]+\.seo\.json$ ]]; then
  exec /usr/local/bin/set-article-seo ${CMD#set-article-seo }
fi

# 7. overwrite llms.txt from the /tmp copy already allowed by branch 1 — fixed,
#    non-parameterized command (no sudo/www-data needed, the file is already
#    owned by wp-agent). Lets deploy.yml ship the git-tracked llms.txt on every
#    push that changes it, instead of hand-editing it over root SSH.
if [[ "$CMD" == "cat /tmp/llms.txt > /var/www/proimport-shop.ru/llms.txt && rm -f /tmp/llms.txt" ]]; then
  exec bash -c "$CMD"
fi

echo "wp-agent wrapper: command rejected: $CMD" >&2
exit 1