# 只读排查：同事公钥是否在 authorized_keys、本机防火墙/SSH 相关线索
# 不改任何配置，不输出私钥。

$ErrorActionPreference = 'Continue'
Write-Output '=== host ==='
whoami
hostname

$ak = Join-Path $env:USERPROFILE '.ssh\authorized_keys'
Write-Output "=== authorized_keys: $ak ==="
if (-not (Test-Path $ak)) {
  Write-Output 'NO_AUTHORIZED_KEYS_FILE'
  exit 0
}

$lines = Get-Content $ak | Where-Object { $_ -and $_.Trim() -notmatch '^#' }
Write-Output ("key_lines=" + $lines.Count)

$needle = 'IFBmb3YG1ZOJ3kaj8z3H55GXmv+hPIbYgN298VKorgFv'
$commentNeedle = 'ytd-external-developer'
$hit = $false
foreach ($line in $lines) {
  if ($line -like "*$needle*") {
    Write-Output 'PUBKEY_FOUND=yes'
    Write-Output ("PUBKEY_LINE_PREFIX=" + $line.Substring(0, [Math]::Min(60, $line.Length)))
    $hit = $true
  }
  if ($line -like "*$commentNeedle*") {
    Write-Output 'COMMENT_FOUND=yes'
  }
}
if (-not $hit) {
  Write-Output 'PUBKEY_FOUND=no'
  Write-Output 'PUBKEY_NOT_IN_AUTHORIZED_KEYS'
}

Write-Output '=== key comments (safe) ==='
foreach ($line in $lines) {
  if ($line -match '^ssh-\S+\s+\S+\s+(.+)$') {
    Write-Output ("comment=" + $Matches[1])
  } elseif ($line -match '^ssh-\S+\s+\S+$') {
    Write-Output 'comment=(none)'
  } else {
    Write-Output 'line=(unparsed-or-options)'
  }
}

Write-Output '=== OpenSSH firewall rules (OpenSSH/22) ==='
try {
  Get-NetFirewallRule -ErrorAction SilentlyContinue |
    Where-Object { $_.DisplayName -match 'OpenSSH|SSH' -or $_.Name -match 'OpenSSH|SSH' } |
    Select-Object -First 20 DisplayName, Enabled, Direction, Action, Profile |
    Format-Table -AutoSize | Out-String | Write-Output
} catch {
  Write-Output ("firewall_query_err=" + $_.Exception.Message)
}

Write-Output '=== firewall rules mentioning 38.175.103.103 ==='
try {
  $addrRules = Get-NetFirewallAddressFilter -ErrorAction SilentlyContinue |
    Where-Object { $_.RemoteAddress -match '38\.175\.103\.103' -or ($_.RemoteAddress -is [array] -and ($_.RemoteAddress -contains '38.175.103.103')) }
  if ($addrRules) {
    foreach ($af in $addrRules) {
      $rule = Get-NetFirewallRule -AssociatedNetFirewallAddressFilter $af -ErrorAction SilentlyContinue
      if ($rule) {
        Write-Output ("rule=" + $rule.DisplayName + "; enabled=" + $rule.Enabled + "; action=" + $rule.Action + "; dir=" + $rule.Direction + "; remote=" + ($af.RemoteAddress -join ','))
      }
    }
  } else {
    Write-Output 'NO_FIREWALL_RULE_WITH_THAT_IP'
  }
} catch {
  Write-Output ("addr_filter_err=" + $_.Exception.Message)
}

Write-Output '=== inbound allow rules on local port 22 (if any) ==='
try {
  Get-NetFirewallPortFilter -Protocol TCP -ErrorAction SilentlyContinue |
    Where-Object { $_.LocalPort -eq 22 -or $_.LocalPort -eq '22' } |
    ForEach-Object {
      $rule = Get-NetFirewallRule -AssociatedNetFirewallPortFilter $_ -ErrorAction SilentlyContinue
      if ($rule) {
        $af = Get-NetFirewallAddressFilter -AssociatedNetFirewallRule $rule -ErrorAction SilentlyContinue
        Write-Output ("rule=" + $rule.DisplayName + "; enabled=" + $rule.Enabled + "; action=" + $rule.Action + "; remote=" + (($af.RemoteAddress) -join ','))
      }
    }
} catch {
  Write-Output ("port22_err=" + $_.Exception.Message)
}

Write-Output '=== sshd service ==='
try {
  Get-Service sshd -ErrorAction SilentlyContinue | Format-List Name, Status, StartType | Out-String | Write-Output
} catch {
  Write-Output ("sshd_err=" + $_.Exception.Message)
}

Write-Output 'DONE'