35 lines
1.1 KiB
Go
35 lines
1.1 KiB
Go
package ui
|
|
|
|
import (
|
|
"fmt"
|
|
|
|
"ssh-access-tui/internal/model"
|
|
"ssh-access-tui/internal/sysadm"
|
|
)
|
|
|
|
// resyncUsernames rewrites authorized_keys permitopen= restrictions for each
|
|
// named user (skipping anyone without a key yet or not active), reflecting
|
|
// whatever their current AllowedForwards computes to. This is the one place
|
|
// server-side enforcement gets updated whenever group membership, a group's
|
|
// referenced hosts, or a host's services change.
|
|
func resyncUsernames(st *model.State, usernames []string) error {
|
|
for _, uname := range usernames {
|
|
u := st.FindUser(uname)
|
|
if u == nil || u.PublicKey == "" || u.Status != model.StatusActive {
|
|
continue
|
|
}
|
|
if err := sysadm.WriteAuthorizedKeys(u.Username, u.PublicKey, st.AllowedForwards(u)); err != nil {
|
|
return fmt.Errorf("resync %s: %w", u.Username, err)
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func resyncGroupUsers(st *model.State, groupName string) error {
|
|
return resyncUsernames(st, st.UsernamesInGroup(groupName))
|
|
}
|
|
|
|
func resyncHostUsers(st *model.State, hostName string) error {
|
|
return resyncUsernames(st, st.UsernamesUsingHost(hostName))
|
|
}
|