Add remote sync removal flow

appstate/remote_binding.go

@@ -115,6 +115,22 @@ func ConfigureRemoteBinding(model *vault.Model, input RemoteBindingInput) (Remot
 	}, nil
 }
 
+func RemoveRemoteBinding(model *vault.Model, binding RemoteBinding) error {
+	if model == nil {
+		return fmt.Errorf("model is required")
+	}
+	if strings.TrimSpace(binding.RemoteProfileID) == "" {
+		return fmt.Errorf("remote profile id is required")
+	}
+	if strings.TrimSpace(binding.CredentialEntryID) == "" {
+		return fmt.Errorf("credential entry id is required")
+	}
+
+	model.RemoveRemoteProfileByID(binding.RemoteProfileID)
+	model.RemoveEntryByID(binding.CredentialEntryID)
+	return nil
+}
+
 func normalizeSyncMode(mode SyncMode) SyncMode {
 	switch mode {
 	case SyncModeAutomaticOnOpenSave:

appstate/remote_binding_test.go

@@ -212,3 +212,39 @@ func TestConfigureRemoteBindingRejectsIncompleteInput(t *testing.T) {
 		})
 	}
 }
+
+func TestRemoveRemoteBindingRemovesProfileAndCredentialsFromVault(t *testing.T) {
+	t.Parallel()
+
+	model := vault.Model{
+		Entries: []vault.Entry{{
+			ID:       "remote-creds-1",
+			Title:    "WebDAV Sign-In",
+			Username: "tjulian",
+			Password: "token-1",
+		}},
+		RemoteProfiles: []vault.RemoteProfile{{
+			ID:      "family-webdav",
+			Name:    "Family Vault",
+			Backend: vault.RemoteBackendWebDAV,
+			BaseURL: "https://dav.example.invalid/remote.php/dav",
+			Path:    "files/family/keepass.kdbx",
+		}},
+	}
+
+	err := RemoveRemoteBinding(&model, RemoteBinding{
+		LocalVaultPath:    "/tmp/family.kdbx",
+		RemoteProfileID:   "family-webdav",
+		CredentialEntryID: "remote-creds-1",
+	})
+	if err != nil {
+		t.Fatalf("RemoveRemoteBinding() error = %v", err)
+	}
+
+	if got := len(model.RemoteProfiles); got != 0 {
+		t.Fatalf("len(RemoteProfiles) = %d, want 0", got)
+	}
+	if _, err := model.EntryByID("remote-creds-1"); !errors.Is(err, vault.ErrEntryNotFound) {
+		t.Fatalf("EntryByID(remote-creds-1) error = %v, want ErrEntryNotFound", err)
+	}
+}

appstate/state.go

@@ -920,6 +920,26 @@ func (s *State) ConfigureRemoteBinding(input RemoteBindingInput) (RemoteBinding,
 	return binding, nil
 }
 
+func (s *State) RemoveRemoteBinding(binding RemoteBinding) error {
+	session, ok := s.Session.(MutableSession)
+	if !ok {
+		return fmt.Errorf("session is not mutable")
+	}
+
+	model, err := session.Current()
+	if err != nil {
+		return err
+	}
+
+	if err := RemoveRemoteBinding(&model, binding); err != nil {
+		return err
+	}
+
+	session.Replace(model)
+	s.Dirty = true
+	return nil
+}
+
 func (s *State) CreateGroup(name string) error {
 	session, ok := s.Session.(MutableSession)
 	if !ok {

appstate/state_test.go

@@ -1168,6 +1168,46 @@ func TestConfigureRemoteBindingRequiresMutableSession(t *testing.T) {
 	}
 }
 
+func TestRemoveRemoteBindingRemovesVaultDataAndMarksDirty(t *testing.T) {
+	t.Parallel()
+
+	sess := &mutableStubSession{model: vault.Model{
+		Entries: []vault.Entry{{
+			ID:       "remote-creds-1",
+			Title:    "WebDAV Sign-In",
+			Username: "tjulian",
+			Password: "token-1",
+		}},
+		RemoteProfiles: []vault.RemoteProfile{{
+			ID:      "family-webdav",
+			Name:    "Family Vault",
+			Backend: vault.RemoteBackendWebDAV,
+			BaseURL: "https://dav.example.invalid/remote.php/dav",
+			Path:    "files/family/keepass.kdbx",
+		}},
+	}}
+	state := State{Session: sess}
+
+	err := state.RemoveRemoteBinding(RemoteBinding{
+		LocalVaultPath:    "/tmp/family.kdbx",
+		RemoteProfileID:   "family-webdav",
+		CredentialEntryID: "remote-creds-1",
+	})
+	if err != nil {
+		t.Fatalf("RemoveRemoteBinding() error = %v", err)
+	}
+
+	if !state.Dirty {
+		t.Fatal("Dirty = false, want true after RemoveRemoteBinding")
+	}
+	if got := len(sess.model.RemoteProfiles); got != 0 {
+		t.Fatalf("len(RemoteProfiles) = %d, want 0", got)
+	}
+	if _, err := sess.model.EntryByID("remote-creds-1"); !errors.Is(err, vault.ErrEntryNotFound) {
+		t.Fatalf("EntryByID(remote-creds-1) error = %v, want ErrEntryNotFound", err)
+	}
+}
+
 func TestLockClearsSelectionAndMakesVaultUnavailable(t *testing.T) {
 	t.Parallel()