#!/usr/bin/env bash
# ------------------------------------------------------------------------------
# Copyright (c) 2013-2026 Geoffray Levasseur <fatalerrors@geoffray-levasseur.org>
# Protected by the BSD3 license. Please read bellow for details.
#
# * Redistribution and use in source and binary forms,
# * with or without modification, are permitted provided
# * that the following conditions are met:
# *
# *   Redistributions of source code must retain the above
# *   copyright notice, this list of conditions and the
# *   following disclaimer.
# *
# *   Redistributions in binary form must reproduce the above
# *   copyright notice, this list of conditions and the following
# *   disclaimer in the documentation and/or other materials
# *   provided with the distribution.
# *
# *   Neither the name of the copyright holder nor the names
# *   of any other contributors may be used to endorse or
# *   promote products derived from this software without
# *   specific prior written permission.
# *
# * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND
# * CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
# * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
# * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
# * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
# * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
# * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
# * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
# * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
# * OF SUCH DAMAGE.
# ------------------------------------------------------------------------------

# Private helpers of profile.d/ssh.sh, loaded by the module itself.

# Internal helper: remove <key> (a name or an IP, in known_hosts notation, so
# also "[host]:port") from the known_hosts file <file> with ssh-keygen -R.
# ssh-keygen writes a new file: run by root on another user's file (--all-users)
# it would leave it owned by root with mode 0644, which keeps that user's ssh
# from adding host keys, or exposes a private file. The owner and mode of the
# file, and of its ".old" backup, are therefore put back.
# Returns ssh-keygen's status (non-zero when the key was not found).
# Usage: _rmhost_remove <key> <file>
_rmhost_remove()
{
    local key="$1" file="$2" owner="" mode="" rc=0
    if [[ ${EUID:-$(id -u)} -eq 0 ]]; then
        owner=$(stat -c '%u:%g' -- "$file" 2>/dev/null)
        mode=$(stat -c '%a' -- "$file" 2>/dev/null)
    fi

    ssh-keygen -R "$key" -f "$file" </dev/null >/dev/null 2>&1 || rc=$?

    if [[ -n $owner && -n $mode ]]; then
        chown "$owner" -- "$file" "${file}.old" 2>/dev/null
        chmod "$mode" -- "$file" "${file}.old" 2>/dev/null
    fi
    return "$rc"
}
export -f _rmhost_remove