#!/usr/bin/env bash
set -euo pipefail

KEY_FILE="${1:?Usage: $0 <gpg-key-file> [user@host]}"
PI_HOST="${2:-admin@192.168.1.100}"

GNUPGHOME=$(mktemp -d)
chmod 700 "$GNUPGHOME"
export GNUPGHOME

cleanup() {
    gpgconf --kill gpg-agent 2>/dev/null || true
    rm -rf "$GNUPGHOME"
}
trap cleanup EXIT

PINENTRY=$(which pinentry-curses 2>/dev/null || which pinentry-tty 2>/dev/null || which pinentry 2>/dev/null)
cat > "$GNUPGHOME/gpg-agent.conf" <<EOF
enable-ssh-support
pinentry-program $PINENTRY
EOF

gpg --import "$KEY_FILE" || true

KEYGRIP=$(gpg --with-keygrip -k 2>/dev/null | awk '
    /\[A\]/ { found=1; next }
    found && /Keygrip = / { print $3; found=0 }
')

if [[ -z "$KEYGRIP" ]]; then
    echo "Error: no authentication subkey [A] found in $KEY_FILE" >&2
    exit 1
fi

echo "$KEYGRIP" > "$GNUPGHOME/sshcontrol"
gpg-connect-agent reloadagent /bye >/dev/null

export SSH_AUTH_SOCK
SSH_AUTH_SOCK=$(gpgconf --list-dirs agent-ssh-socket)

echo "Connecting to $PI_HOST..."
ssh "$PI_HOST"