# Setup SSH-Key fuer Cursor-Agent Zugang zum KI-Server
# Muss in ADMIN-PowerShell laufen!

$ErrorActionPreference = 'Stop'

Write-Host '== Pruefe Admin-Rechte ==' -ForegroundColor Cyan
$isAdmin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]'Administrator')
if (-not $isAdmin) { Write-Host 'FEHLER: Bitte PowerShell als Administrator starten!' -ForegroundColor Red; exit 1 }
Write-Host 'OK: Admin-Rechte vorhanden' -ForegroundColor Green

Write-Host '== Hole Cursor-Public-Key vom Forgejo ==' -ForegroundColor Cyan
$key = (Invoke-WebRequest -UseBasicParsing 'https://git.orbitalo.net/orbitalo/homelab-brain/raw/branch/main/tmp/pve-hetzner-cursor.pub').Content.Trim()
Write-Host "Key geholt: $($key.Substring(0,40))..."

$path = 'C:\ProgramData\ssh\administrators_authorized_keys'
Write-Host "== Pruefe ob Key bereits eingetragen in $path ==" -ForegroundColor Cyan
if (Test-Path $path) {
  $existing = Get-Content $path -Raw
  if ($existing -match [regex]::Escape($key.Substring(0,80))) {
    Write-Host 'Key ist BEREITS eingetragen, ueberspringe Append' -ForegroundColor Yellow
  } else {
    Add-Content -Path $path -Value $key
    Write-Host 'Key wurde angehaengt' -ForegroundColor Green
  }
} else {
  Set-Content -Path $path -Value $key
  Write-Host 'Datei neu erstellt mit Key' -ForegroundColor Green
}

Write-Host '== Setze Permissions (nur Administrators + SYSTEM) ==' -ForegroundColor Cyan
icacls $path /inheritance:r /grant '*S-1-5-32-544:F' '*S-1-5-18:F' | Out-Null
Write-Host 'OK: Permissions gesetzt' -ForegroundColor Green

Write-Host '== Verifikation: Inhalt der Datei ==' -ForegroundColor Cyan
Get-Content $path | ForEach-Object { Write-Host "  $_" }

Write-Host ''
Write-Host '=== FERTIG ===' -ForegroundColor Green
Write-Host 'Sag dem Cursor-Agent Bescheid, dann testet er.' -ForegroundColor Green