#!/bin/sh
# kbd_disp_peer — whitelisted peer operations for the kbd_disp automation.
#
# Installed on the PASSIVE host. Invoked via ssh with a command= restriction
# in authorized_keys, so the automation key can run ONLY these two operations
# (least privilege). SSH_ORIGINAL_COMMAND holds the full command string the
# client sent (not just the arguments).
#
#   get        -> print the peer's last dongle departure time (epoch)
#   set <n>    -> store the peer's departure time in peer_detach
#
# State files live in /var/lib/kbd_disp/:
#   last_detach   this host's own last departure (written by kbd_disp_switch)
#   peer_detach   the peer's last departure (written by this wrapper)
case "$SSH_ORIGINAL_COMMAND" in
    *" get")
        cat /var/lib/kbd_disp/last_detach 2>/dev/null
        ;;
    *" set "*)
        val=${SSH_ORIGINAL_COMMAND##* set }
        case "$val" in
            *[!0-9]*) exit 1 ;;
        esac
        printf '%s\n' "$val" > /var/lib/kbd_disp/peer_detach
        ;;
    *)
        exit 1
        ;;
esac