#!/bin/bash

set -xeo pipefail

function main() {
    cd /tmp
    rm -rf /tmp/keys || true
    git clone --quiet https://code.liz.coffee/keys.git/
    cd keys
    echo "+ Cloned keys"

    echo "DC4323D1738F27358793D6E87BB52F7036FA7C18:6:" | gpg --quiet --import-ownertrust && gpg --update-trustdb --quiet || return 1
    echo "+ Trusting key"

    gpg --status-fd 1 --verify authorized_keys.sig 2>/dev/null | grep VALIDSIG | grep -q "DC4323D1738F27358793D6E87BB52F7036FA7C18" || return 1
    echo "+ Validated"
    gpg --output authorized_keys --decrypt authorized_keys.sig 2>/dev/null || return 1
    echo "+ Decrypted"

    sed -i '/emprespresso/d' ~/.ssh/authorized_keys && grep -qv "emprespresso" ~/.ssh/authorized_keys  || mkdir -p ~/.ssh && touch ~/.ssh/authorized_keys
    echo "+ Removed emprespresso keys"
    cat authorized_keys >> ~/.ssh/authorized_keys
    echo "+ Appended emprespresso keys"

    cd /tmp
    rm -rf keys
    echo "+ Done"
}

function handle_error() {
    curl -d "ERROR IN UPDATING KEYS: $(cat /etc/hostname)" ntfy.sh/emprespresso-liz-dot-coffee
}

main || handle_error