rc

internal/ui/confirm.go

@@ -175,7 +175,8 @@ func (m Model) doDeleteHost(hostName string) (tea.Model, tea.Cmd) {
 	return m, nil
 }
 
-// doDeleteService removes a service from m.selectedHost, then resyncs
+// doDeleteService removes a service from m.selectedHost, drops it from
+// every group that referenced this exact service, and resyncs
 // authorized_keys for every user that lost access as a result.
 func (m Model) doDeleteService(serviceName string) (tea.Model, tea.Cmd) {
 	hostName := m.selectedHost
@@ -184,13 +185,15 @@ func (m Model) doDeleteService(serviceName string) (tea.Model, tea.Cmd) {
 		if h == nil {
 			return fmt.Errorf("host %s not found", hostName)
 		}
+		affected := st.UsernamesUsingService(hostName, serviceName)
 		for i := range h.Services {
 			if h.Services[i].Name == serviceName {
 				h.Services = append(h.Services[:i], h.Services[i+1:]...)
 				break
 			}
 		}
-		return resyncUsernames(st, st.UsernamesUsingHost(hostName))
+		st.RemoveServiceRefs(hostName, serviceName)
+		return resyncUsernames(st, affected)
 	})
 	m.screen = scrCatalogServices
 	m.refreshCatalogServicesList()