#!/bin/bash
# tin key list - List all NAS servers with SSH keys

set -euo pipefail

# Get tinsnip root and source libraries
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
TINSNIP_ROOT="$(dirname "$(dirname "$SCRIPT_DIR")")"
source "$TINSNIP_ROOT/lib/core.sh"
source "$TINSNIP_ROOT/lib/registry.sh"

# List all NAS servers with SSH keys
list_nas_keys() {
    check_tinsnip_station || return 1
    
    log_with_prefix "SSH Keys" "NAS servers with SSH keys:"
    echo
    
    local ssh_keys_dir="$NAS_CREDENTIALS_DIR/ssh-keys"
    local found_keys=false
    
    if [[ ! -d "$ssh_keys_dir" ]]; then
        echo "No SSH keys directory found."
        echo "Generate keys with: tin key generate <nas-server>"
        return 0
    fi
    
    for key_file in "$ssh_keys_dir"/*.key; do
        if [[ -f "$key_file" ]]; then
            local nas_server=$(basename "$key_file" .key)
            local pub_key="${key_file}.pub"
            
            echo "  $nas_server"
            echo "    Private key: $key_file"
            if [[ -f "$pub_key" ]]; then
                echo "    Public key:  $pub_key"
                local fingerprint=$(ssh-keygen -lf "$pub_key" 2>/dev/null | awk '{print $2}' || echo 'invalid')
                echo "    Fingerprint: $fingerprint"
            else
                echo "    Public key:  ❌ MISSING"
            fi
            echo
            found_keys=true
        fi
    done
    
    if [[ "$found_keys" == "false" ]]; then
        echo "No SSH keys found."
        echo "Generate keys with: tin key generate <nas-server>"
    fi
}

# Main execution
list_nas_keys