#!/usr/bin/env bash
# Operator-side: SSH/SFTP to forwarded port on bastion (run on BE or jump host).
set -euo pipefail

RPORT="${1:-}"
USER="${2:-}"
MODE="${3:-shell}"

if [ -z "$RPORT" ] || [ -z "$USER" ]; then
  echo "usage: $0 REMOTE_BIND_PORT RA_USERNAME [shell|sftp]" >&2
  exit 1
fi

case "$MODE" in
  shell)
    exec ssh -p "$RPORT" -o StrictHostKeyChecking=no "${USER}@127.0.0.1"
    ;;
  sftp)
    exec sftp -P "$RPORT" -o StrictHostKeyChecking=no "${USER}@127.0.0.1"
    ;;
  *)
    echo "unknown mode: $MODE" >&2
    exit 1
    ;;
esac
