package ui

import (
	"fmt"

	"ssh-access-tui/internal/model"
	"ssh-access-tui/internal/sysadm"
)

// resyncUsernames rewrites authorized_keys permitopen= restrictions for each
// named user (skipping anyone without a key yet or not active), reflecting
// whatever their current AllowedForwards computes to. This is the one place
// server-side enforcement gets updated whenever group membership, a group's
// referenced hosts, or a host's services change.
func resyncUsernames(st *model.State, usernames []string) error {
	for _, uname := range usernames {
		u := st.FindUser(uname)
		if u == nil || u.PublicKey == "" || u.Status != model.StatusActive {
			continue
		}
		if err := sysadm.WriteAuthorizedKeys(u.Username, u.PublicKey, st.AllowedForwards(u)); err != nil {
			return fmt.Errorf("resync %s: %w", u.Username, err)
		}
	}
	return nil
}

func resyncGroupUsers(st *model.State, groupName string) error {
	return resyncUsernames(st, st.UsernamesInGroup(groupName))
}

func resyncHostUsers(st *model.State, hostName string) error {
	return resyncUsernames(st, st.UsernamesUsingHost(hostName))
}