#! /usr/bin/env perl
# vim: set filetype=perl ts=4 sw=4 sts=4 et:
use common::sense;

use File::Basename;
use lib dirname(__FILE__) . '/../../../lib/perl';
use OVH::Result;
use OVH::Bastion;
use OVH::Bastion::Plugin qw( :DEFAULT help );

my $remainingOptions = OVH::Bastion::Plugin::begin(
    argv    => \@ARGV,
    header  => "revoking access to a restricted osh command from an account",
    options => {
        "account=s" => \my $account,
        "command=s" => \my $command,
    },
    helptext => <<'EOF',
Revoke access to a restricted command

Usage: --osh SCRIPT_NAME --account ACCOUNT --command COMMAND

  --account ACCOUNT  Bastion account to work on
  --command COMMAND  The name of the OSH plugin to revoke access to (omit to get the list)
EOF
);

my $fnret;

if (!$command) {
    $fnret = OVH::Bastion::get_plugin_list(restrictedOnly => 1);
    help();
    if ($fnret) {
        my @plugins = keys %{$fnret->value};
        push @plugins, 'auditor';
        osh_info "\nList of possible commands to revoke: " . join(" ", sort @plugins);
    }
    osh_exit 'ERR_MISSING_PARAMETER', "Missing mandatory parameter 'command'";
}

if (!$account) {
    help();
    osh_exit 'ERR_MISSING_PARAMETER', "Missing mandatory parameter 'account'";
}

$fnret = OVH::Bastion::is_bastion_account_valid_and_existing(account => $account, localOnly => 1);
$fnret or osh_exit $fnret;
$account = $fnret->value->{'account'};

my @command = qw{ sudo -n -u root -- /usr/bin/env perl -T };
push @command, $OVH::Bastion::BASEPATH . '/bin/helper/osh-accountModifyCommand';
push @command, '--action', 'revoke';
push @command, '--command', $command;
push @command, '--account', $account;

osh_exit OVH::Bastion::helper(cmd => \@command);