#!/usr/bin/env python3
"""SSH exec on RB4011 Nkoabang via VPS WireGuard (10.88.0.4). Does not use Tailscale."""
from __future__ import annotations

import sys

import paramiko

JUMP = ("83.147.38.107", "otantik", "demopass")
MK = ("10.88.0.4", "admin", "demopass")


def connect_mk() -> tuple[paramiko.SSHClient, paramiko.SSHClient]:
    jump = paramiko.SSHClient()
    jump.set_missing_host_key_policy(paramiko.AutoAddPolicy())
    jump.connect(
        JUMP[0],
        username=JUMP[1],
        password=JUMP[2],
        timeout=25,
        banner_timeout=30,
        allow_agent=False,
        look_for_keys=False,
    )
    chan = jump.get_transport().open_channel("direct-tcpip", (MK[0], 22), ("127.0.0.1", 0))
    mk = paramiko.SSHClient()
    mk.set_missing_host_key_policy(paramiko.AutoAddPolicy())
    mk.connect(
        MK[0],
        username=MK[1],
        password=MK[2],
        sock=chan,
        timeout=25,
        banner_timeout=30,
        allow_agent=False,
        look_for_keys=False,
    )
    return jump, mk


def run(cmd: str, timeout: int = 60) -> str:
    jump, mk = connect_mk()
    try:
        stdin, stdout, stderr = mk.exec_command(cmd, timeout=timeout)
        out = stdout.read().decode("utf-8", "replace")
        err = stderr.read().decode("utf-8", "replace")
        return (out + ("\n" + err if err.strip() else "")).strip()
    finally:
        mk.close()
        jump.close()


def import_rsc(name: str, content: str, timeout: int = 120) -> str:
    jump, mk = connect_mk()
    try:
        sftp = mk.open_sftp()
        with sftp.file(name, "w") as f:
            f.write(content)
        sftp.close()
        stdin, stdout, stderr = mk.exec_command("/import file-name=" + name, timeout=timeout)
        out = stdout.read().decode("utf-8", "replace")
        err = stderr.read().decode("utf-8", "replace")
        return (out + ("\n" + err if err.strip() else "")).strip()
    finally:
        mk.close()
        jump.close()


if __name__ == "__main__":
    cmd = sys.argv[1] if len(sys.argv) > 1 else "/system identity print"
    print(run(cmd, timeout=int(sys.argv[2]) if len(sys.argv) > 2 else 60))