# @See https://raw.githubusercontent.com/snipe/snipe-it/master/app/Models/Setting.php
---
- name: "Wait until the Snipe-IT Login is available"
  uri:
    url: "{{ snipe_it_url }}/login"
    method: GET
    return_content: no
    status_code: 200
  register: snipeit_admin_check
  retries: 30
  delay: 5
  until: snipeit_admin_check.status == 200
  when: not ( applications | get_app_conf(application_id, 'features.oauth2', False))

- name: "Set all LDAP settings via Laravel Setting model (inside container as {{ snipe_it_user }})"
  shell: |
    docker-compose exec -T \
    -e APP_KEY='{{ applications | get_app_conf(application_id, 'credentials.app_key', True) }}' \ 
    -e XDG_CONFIG_HOME=/tmp \ 
    -u {{ snipe_it_user }} application \ 
    sh -c 'php artisan tinker << "EOF"
    $s = \App\Models\Setting::getSettings();
    $s->ldap_enabled             = 1;
    $s->ldap_server              = "{{ ldap.server.uri }}";
    $s->ldap_port                = {{ ldap.server.port }};
    $s->ldap_uname               = "{{ ldap.dn.administrator.data }}";
    $s->ldap_basedn              = "{{ ldap.dn.ou.users }}";
    $s->ldap_filter              = "&(objectClass=inetOrgPerson)";
    $s->ldap_username_field      = "{{ ldap.user.attributes.id }}";
    $s->ldap_fname_field         = "{{ ldap.user.attributes.firstname }}";
    $s->ldap_lname_field         = "{{ ldap.user.attributes.surname }}";
    $s->ldap_auth_filter_query   = "uid=";
    $s->ldap_version             = 3;
    $s->ldap_pw_sync             = 0;
    $s->is_ad                    = 0;
    $s->ad_domain                = "";
    $s->ldap_default_group       = "";
    $s->ldap_email               = "{{ ldap.user.attributes.mail }}";
    $s->custom_forgot_pass_url   = "{{ OIDC.CLIENT.RESET_CREDENTIALS }}";
    $s->save();
    EOF'
  args:
    chdir: "{{ docker_compose.directories.instance }}"
  register: ldap_tinker
  failed_when: >
    ldap_tinker.stdout_lines is not defined
    or ldap_tinker.stdout_lines[0] != '= true'
  changed_when: >
    ldap_tinker.stdout_lines is defined
    and ldap_tinker.stdout_lines[0] == '= true'
  notify: docker compose up

- name: Encrypt & save LDAP bind password via Crypt + DB façade
  shell: |
    docker-compose exec -T \
      -u {{ snipe_it_user }} \
      -e APP_KEY="{{ applications | get_app_conf(application_id, 'credentials.app_key', True) }}" \
      -e XDG_CONFIG_HOME=/tmp \
      application \
      php artisan tinker --execute="
        use Illuminate\Support\Facades\Crypt;
        use Illuminate\Support\Facades\DB;

        /* encrypt the clear-text password */
        \$encrypted = Crypt::encrypt('{{ ldap.bind_credential }}');

        /* write it straight into settings.ldap_pword */
        /* update the one and only row in `settings` */
        DB::table('settings')->update([
          'ldap_pword' => \$encrypted
        ]);
        echo 'Stored: ' . \$encrypted . PHP_EOL;
      "
  args:
    chdir: "{{ docker_compose.directories.instance }}"
  register: ldap_encrypt
  failed_when: ldap_encrypt.rc != 0

- name: "Clear Laravel config & cache (inside container as {{ snipe_it_user }})"
  shell: |
    docker-compose exec -T -u {{ snipe_it_user }} application php artisan config:clear
    docker-compose exec -T -u {{ snipe_it_user }} application php artisan cache:clear
  args:
    chdir: "{{ docker_compose.directories.instance }}"
  notify: docker compose up 