add ProxyJump function

internal/ui/app.go

@@ -116,6 +116,7 @@ type Model struct {
 	userNewGroupsOrder   []string
 	userNewCursor        int
 	userGroupsEditTarget string // non-empty: editing this existing user's groups instead of creating a new user
+	userNewProxyJump     bool   // ProxyJump vs LocalForward client config mode, toggled alongside groups on the same screen
 
 	// catalog: hosts and their services, shared across groups
 	catalogHostsList      list.Model

internal/ui/configupdate.go

@@ -125,7 +125,7 @@ func (m Model) runConfigUpdate(usernames []string) (tea.Model, tea.Cmd) {
 			continue
 		}
 		forwards := st.AllowedForwards(u)
-		res, err := keymgr.BuildConfigOnlyArchive(m.cfg.ScratchDir, m.cfg.ExportDir, m.cfg.JumpHost, m.cfg.JumpPort, username, password, forwards)
+		res, err := keymgr.BuildConfigOnlyArchive(m.cfg.ScratchDir, m.cfg.ExportDir, m.cfg.JumpHost, m.cfg.JumpPort, username, password, forwards, u.ProxyJump)
 		if err != nil {
 			failures = append(failures, username+": "+err.Error())
 			continue

internal/ui/export.go

@@ -118,7 +118,7 @@ func (m Model) runExport(usernames []string) (tea.Model, tea.Cmd) {
 			continue
 		}
 		forwards := st.AllowedForwards(u)
-		res, err := keymgr.BuildUserArchive(m.cfg.ScratchDir, m.cfg.ExportDir, m.cfg.JumpHost, m.cfg.JumpPort, username, password, forwards)
+		res, err := keymgr.BuildUserArchive(m.cfg.ScratchDir, m.cfg.ExportDir, m.cfg.JumpHost, m.cfg.JumpPort, username, password, forwards, u.ProxyJump)
 		if err != nil {
 			failures = append(failures, username+": "+err.Error())
 			continue

internal/ui/users.go

@@ -65,6 +65,7 @@ func (m Model) updateUsers(msg tea.Msg) (tea.Model, tea.Cmd) {
 			}
 			m.userNewCursor = 0
 			m.userGroupsEditTarget = sel.id
+			m.userNewProxyJump = u.ProxyJump
 			m.err, m.status = "", ""
 			m.screen = scrUserNewGroups
 			return m, nil
@@ -173,6 +174,7 @@ func (m Model) updateUserNew(msg tea.Msg) (tea.Model, tea.Cmd) {
 				m.userNewGroupsOrder = append(m.userNewGroupsOrder, g.Name)
 			}
 			m.userNewCursor = 0
+			m.userNewProxyJump = false
 			m.screen = scrUserNewGroups
 			return m, nil
 		}
@@ -225,12 +227,16 @@ func (m Model) updateUserNewGroups(msg tea.Msg) (tea.Model, tea.Cmd) {
 			}
 			return m, nil
 		case "down", "j":
-			if m.userNewCursor < len(m.userNewGroupsOrder)-1 {
+			// +1 for the trailing ProxyJump toggle row, always present after
+			// the group checkboxes (see viewUserNewGroups).
+			if m.userNewCursor < len(m.userNewGroupsOrder) {
 				m.userNewCursor++
 			}
 			return m, nil
 		case " ":
-			if len(m.userNewGroupsOrder) > 0 {
+			if m.userNewCursor == len(m.userNewGroupsOrder) {
+				m.userNewProxyJump = !m.userNewProxyJump
+			} else if len(m.userNewGroupsOrder) > 0 {
 				g := m.userNewGroupsOrder[m.userNewCursor]
 				m.userNewGroupsSel[g] = !m.userNewGroupsSel[g]
 			}
@@ -245,12 +251,14 @@ func (m Model) updateUserNewGroups(msg tea.Msg) (tea.Model, tea.Cmd) {
 
 			if m.userGroupsEditTarget != "" {
 				username := m.userGroupsEditTarget
+				proxyJump := m.userNewProxyJump
 				m.mutate("изменены группы пользователя "+username, func(st *model.State) error {
 					u := st.FindUser(username)
 					if u == nil {
 						return fmt.Errorf("user %s not found in state", username)
 					}
 					u.Groups = groups
+					u.ProxyJump = proxyJump
 					if u.PublicKey != "" && u.Status == model.StatusActive {
 						if err := sysadm.WriteAuthorizedKeys(username, u.PublicKey, st.AllowedForwards(u)); err != nil {
 							return err
@@ -260,6 +268,9 @@ func (m Model) updateUserNewGroups(msg tea.Msg) (tea.Model, tea.Cmd) {
 				})
 				m.logAudit(username, "admin", "groups changed to "+fmt.Sprint(groups))
 				m.userGroupsEditTarget = ""
+				if m.err == "" {
+					m.status = "готово. Если менялся режим ProxyJump/LocalForward или доступ — выдайте пользователю новый конфиг в «Обновить конфиги»."
+				}
 				m.screen = scrUsers
 				m.refreshUsersList()
 				return m, nil
@@ -279,6 +290,7 @@ func (m Model) updateUserNewGroups(msg tea.Msg) (tea.Model, tea.Cmd) {
 					Groups:    groups,
 					Status:    model.StatusActive,
 					Comment:   comment,
+					ProxyJump: m.userNewProxyJump,
 					CreatedAt: time.Now(),
 				})
 				return nil
@@ -315,6 +327,17 @@ func (m Model) viewUserNewGroups() string {
 		}
 		body += fmt.Sprintf("%s%s %s\n", cursor, check, g)
 	}
+
+	proxyCursor := "  "
+	if m.userNewCursor == len(m.userNewGroupsOrder) {
+		proxyCursor = "> "
+	}
+	proxyCheck := "[ ]"
+	if m.userNewProxyJump {
+		proxyCheck = "[x]"
+	}
+	body += fmt.Sprintf("\n%s%s ProxyJump вместо LocalForward (отдельная команда ssh на каждый сервис, без локальных портов)\n", proxyCursor, proxyCheck)
+
 	body += fmt.Sprintf("\n[space] отметить  [enter] %s  [esc] назад", confirmHint)
 	return borderStyle.Render(body)
 }