access

type Entry struct {
	// User is the label identifying whose key this is (e.g. a teammate's
	// name), not necessarily a Unix account — grant/revoke key entries by
	// this label, independent of which OS account authorized_keys belongs to.
	User string
	Key  PublicKey

	// Sudo and Docker record the intended privilege level for this grant.
	// They are audit/inventory metadata only: this package does not itself
	// modify OS group membership. See the access wiki page for the reasoning.
	Sudo   bool
	Docker bool

	Expires *time.Time
	Granted time.Time
}

type GrantRequest struct {
	User    string
	Key     PublicKey
	Sudo    bool
	Docker  bool
	Expires *time.Time
	DryRun  bool
}

type GrantResult struct {
	AlreadyGranted bool
	Fingerprint    string
	BackupPath     string
	Diff           string
}

type ListResult struct {
	Entries      []Entry
	ForeignCount int
}

type LocalFileTransport struct {
	Path string
	// contains filtered or unexported fields
}

type PublicKey struct {
	Type string
	Data string // base64, undecoded
}

type RevokeRequest struct {
	User   string
	Force  bool
	DryRun bool
}

type RevokeResult struct {
	Fingerprint string
	BackupPath  string
	Diff        string
}

type SSHTransport struct {
	// Host is "[user@]host" — the ssh connection target, e.g. "root@5.75.235.42".
	Host string

	// IdentityPath is the local private key used to authenticate the SSH
	// connection (the operator's own key, distinct from any key being
	// granted or revoked).
	IdentityPath string

	// RemotePath is the authorized_keys path on the remote host. Defaults to
	// "~/.ssh/authorized_keys" (relative to whichever account Host connects
	// as) when empty.
	RemotePath string
}

type Transport interface {
	// Describe returns a short human-readable label for error messages and
	// audit lines, e.g. "root@5.75.235.42" or a fixture's file path.
	Describe() string

	// Read returns the current authorized_keys content, or (nil, nil) if the
	// file does not exist yet — a fresh host with no managed keys is not an
	// error.
	Read(ctx context.Context) ([]byte, error)

	// Backup copies the current file to a timestamped sibling before any
	// mutation and returns its path. If the file does not exist yet, Backup
	// is a no-op that returns "".
	Backup(ctx context.Context) (string, error)

	// Write replaces the authorized_keys content and ensures the result is
	// readable only by its owner (0600), matching the CLI's env-file
	// permission rule.
	Write(ctx context.Context, content []byte) error
}