ssh

type Command struct {
	Run func(env map[string]string, args []string, in io.Reader, out io.WriteCloser, err io.WriteCloser)
}

type ContextDialer interface {
	// Dial with a context based on tls package - 'once successfully
	// connected, any expiration of the context will not affect the
	// connection'.
	DialContext(ctx context.Context, net, addr string) (net.Conn, error)
}

type Exec struct {
	// Host of VM where this command will be executed. It will create a
	// SSH or https connection or reuse existing client mux for remote
	// connections, or use a command to enter the VM.
	Host string

	Args []string
	Env  map[string]string
	WD   string

	In  io.Reader
	Out io.WriteCloser // will be a ssh.Channel for ssh

}

type KV struct {
	Key, Value string
}

type Pty struct {
	Term   string
	Window Window
}

type RemoteExec struct {
	ssh.Channel
	// contains filtered or unexported fields
}

type SSHCMux struct {
	// LastSeen    time.Time
	ConnectTime time.Time `json:"-"`

	User string `json:"user,omitempty"`

	// network stream
	// May be an original con with net.Conn with remote/local addr
	NetConn io.ReadWriteCloser `json:"-"`

	// Dependency to the transport (doesn't have to be listenining)
	*SSHMesh `json:"-"`

	// If set, a persistent connection will be maintained and
	// - mux reverseForwards registered for 22, 80, 443
	// - accept streams and trust auth
	Waypoint bool

	Address string `json:"address,omitempty"`

	// TODO: CIDR/Networks
	ReverseForwards map[string]string

	LastConnected time.Time `json:"-"`

	// The SSH Conn, client and internal objects
	SSHClient *ssh.Client `json:"-"`
	SSHConn   ssh.Conn    `json:"-"`

	// Last received remote key (should be a Certificate)
	RemoteKey ssh.PublicKey `json:"-"`
	// contains filtered or unexported fields
}

type SSHMesh struct {
	// Address to listen on as SSH. Will default to 14022 for regular nodes and
	// 15022 for gateways.
	Address string `json:"addr,omitempty"`

	KeepAlive map[string]*SSHCMux `json:"connect,omitempty"`

	CertClient string `json:"id_ecdsa_cert.pub,omitempty"`
	CertHost   string `json:"cert_host.pub,omitempty"`

	// Primary key - in PEM format (also used for mTLS)
	Key string `json:"tls.key,omitempty"`

	// AuthorizedKeys is the same as authorized_keys file.
	// The keys are used as 'trusted sources' for authentication. Any user key can be used for shell/debug access.
	// The CA keys are allowed to connect - but can get a shell only if 'role=admin' is present in the cert.
	//
	// If empty, the SSH_AUTHORIZED_KEYS env is used, falling back to authorized_keys in $HOME/.ssh (if FromEnv is called)
	AuthorizedKeys string `json:"authorized_keys,omitempty"`

	// User is in email format, as expected by the SSH client certificates.
	//
	User   string `json:"id,omitempty"`
	Domain string `json:"namespace,omitempty"`

	// Can be set to a custom dialer, for example for mesh protocol tunneling.
	Dialer ContextDialer `json:"-"`

	// Can be set to a custom dialer, for example for mesh protocol tunneling.
	H2Dialer ContextDialer `json:"-"`

	Listener net.Listener `json:"-"`

	CertChecker *ssh.CertChecker `json:"-"`

	ConnectErrors atomic.Int64 `json:"-"`

	// Map of public key to user ID.
	// Key is the marshalled public key (from authorized_keys), value is the user ID (comment)
	UsersKeys map[string]string `json:"-"`

	// Signer is the 'workload identity' signer. It is using the main workload
	// private key (workload key), but with a host certificate.
	Signer ssh.Signer `json:"-"`

	// SignerClient is a client workload identity - using the SA cert when
	// a CA is used. Otherwise, same as Signer.
	SignerClient ssh.Signer `json:"-"`
	SignerHost   ssh.Signer `json:"-"`

	// Forward is a function that will proxy a stream to a destination.
	// If missing, it will be dialed.
	// Used on a server for all client forwarding - except locally connected clients.
	Forward func(context.Context, string, io.ReadWriteCloser) `json:"-"`

	// WIP: Internally defined commands.
	InternalCommands map[string]*Command `json:"-"`

	// Root CA keys - will be authorized to connect and create tunnels, not get shell.
	AuthorizedCA []ssh.PublicKey `json:"-"`

	// WIP: Custom channel handlers.
	ChannelHandlers map[string]func(ctx context.Context, sconn *SSHSMux, newChannel ssh.NewChannel) `json:"-"`

	// TokenChecker will verify the password field - as a JWT or other forms.
	TokenChecker TokenChecker `json:"-"`
	// TokenSource will provide passwords or tokens.
	// Normally SSH is cert based - but in some cases all we get is a token. For example K8S, Cloudrun, etc.
	TokenSource TokenSource `json:"-"`

	sync.Mutex `json:"-"`

	Logger *slog.Logger
	// contains filtered or unexported fields
}

type SSHSMux struct {
	// Includes the private key of this node
	SSHServer *SSHMesh `json:"-"`

	// LastSeen    time.Time
	ConnectTime time.Time

	// network stream
	// May be an original con with net.Conn with remote/local addr
	NetConn net.Conn `json:"-"`

	// ServerConn - also has Permission
	ServerConn *ssh.ServerConn `json:"-"`

	RemoteKey ssh.PublicKey `json:"-"`
	//RemoteHostname string
	//RemoteAddr     net.Addr
	FQDN string
}

type SSHSession struct {
	Channel ssh.Channel

	// Window keeps getting update during execution.
	PTY *Pty

	Env []*KV

	Cmd *exec.Cmd
	// contains filtered or unexported fields
}

type Stream struct {
	ssh.Channel
	// contains filtered or unexported fields
}

type TokenChecker interface {
	Check(token string) (claims map[string]string, e error)
}

type TokenSource interface {
	// GetToken for a given audience.
	GetToken(context.Context, string) (string, error)
}

type Window struct {
	Width  int
	Height int
}