#! /usr/bin/env perl
# vim: set filetype=perl ts=4 sw=4 sts=4 et:
use common::sense;

use File::Basename;
use lib dirname(__FILE__) . '/../../../lib/perl';
use OVH::Result;
use OVH::Bastion;
use OVH::Bastion::Plugin qw( :DEFAULT help );
use OVH::Bastion::Plugin::groupSetRole;
use OVH::Bastion::Plugin::ACL;

my $remainingOptions = OVH::Bastion::Plugin::begin(
    argv    => \@ARGV,
    header  => "remove access from one server of a group from an account",
    options => {
        "group=s"   => \my $group,
        "account=s" => \my $account,
        "user-any"  => \my $userAny,
        "port-any"  => \my $portAny,
        "scpup"     => \my $scpUp,
        "scpdown"   => \my $scpDown,
        "sftp"      => \my $sftp,
    },
    helptext => <<'EOF',
Remove a specific group server access from an account

Usage: --osh SCRIPT_NAME --group GROUP --account ACCOUNT [OPTIONS]

  --group GROUP     group to remove guest access from
  --account ACCOUNT name of the other bastion account to remove access from
  --host HOST|IP    remove access from this HOST (which must belong to the GROUP)
  --user USER       allow connecting to HOST only with remote login USER
  --user-any        allow connecting to HOST with any remote login
  --port PORT       allow connecting to HOST only to remote port PORT
  --port-any        allow connecting to HOST with any remote port
  --scpup           allow SCP upload, you--bastion-->server (omit --user in this case)
  --scpdown         allow SCP download, you<--bastion--server (omit --user in this case)
  --sftp            allow usage of the SFTP subsystem, you<--bastion-->server (omit --user in this case)

This command removes, from an existing bastion account, access to a given server, using the
egress keys of the group. The list of such servers is given by ``groupListGuestAccesses``

If you want to remove member access from an account to all the present and future servers
of the group, using the group key, please use ``groupDelMember`` instead.

If you want to remove access from an account from a group server but using his personal bastion
key instead of the group key, please use ``accountDelPersonalAccess`` instead.

This command is the opposite of ``groupAddGuestAccess``.
EOF
);

my $fnret;

if (not $ip and $host) {
    osh_exit 'ERR_INVALID_HOST',
      "Specified host ($host) didn't resolve correctly, fix your DNS or specify the IP instead";
}

$fnret = OVH::Bastion::Plugin::ACL::check(
    user    => $user,
    userAny => $userAny,
    port    => $port,
    portAny => $portAny,
    scpUp   => $scpUp,
    scpDown => $scpDown,
    sftp    => $sftp
);
if (!$fnret) {
    help();
    osh_exit($fnret);
}
$user = $fnret->value->{'user'};

$fnret = OVH::Bastion::Plugin::groupSetRole::act(
    account        => $account,
    group          => $group,
    action         => 'del',
    type           => 'guest',
    user           => $user,
    userAny        => $userAny,
    port           => $port,
    portAny        => $portAny,
    host           => ($ip || $host),
    sudo           => 0,
    silentoverride => 0,
    self           => $self,
    scriptName     => $scriptName,
    savedArgs      => $savedArgs
);
help() if not $fnret;
osh_exit($fnret);