add edit and all in one menu for hosts and services

internal/ui/sync.go

@@ -0,0 +1,34 @@
+package ui
+
+import (
+	"fmt"
+
+	"ssh-access-tui/internal/model"
+	"ssh-access-tui/internal/sysadm"
+)
+
+// resyncUsernames rewrites authorized_keys permitopen= restrictions for each
+// named user (skipping anyone without a key yet or not active), reflecting
+// whatever their current AllowedForwards computes to. This is the one place
+// server-side enforcement gets updated whenever group membership, a group's
+// referenced hosts, or a host's services change.
+func resyncUsernames(st *model.State, usernames []string) error {
+	for _, uname := range usernames {
+		u := st.FindUser(uname)
+		if u == nil || u.PublicKey == "" || u.Status != model.StatusActive {
+			continue
+		}
+		if err := sysadm.WriteAuthorizedKeys(u.Username, u.PublicKey, st.AllowedForwards(u)); err != nil {
+			return fmt.Errorf("resync %s: %w", u.Username, err)
+		}
+	}
+	return nil
+}
+
+func resyncGroupUsers(st *model.State, groupName string) error {
+	return resyncUsernames(st, st.UsernamesInGroup(groupName))
+}
+
+func resyncHostUsers(st *model.State, hostName string) error {
+	return resyncUsernames(st, st.UsernamesUsingHost(hostName))
+}