refactor(web-app-dashboard): hide a tile through services.dashboard.enabled instead of display

services.dashboard.enabled already says whether a role takes part in the dashboard: roles_with_service lists only roles with enabled and shared as tile-reachability targets, the CSP filter adds the dashboard to frame-ancestors only when it is set, and docker_cards uses it as the card's iframe flag. A separate display key duplicated that switch and left a role with enabled false still rendering a card. docker_cards now skips the card when services.dashboard.enabled is false (a role without a dashboard binding keeps its card, and a value that is not a boolean fails loudly), so display, its validator exception and its roles_with_service filter go again; base.md documents enabled as the per-host switch.

An inventory hides a tile with applications.<role>.services.dashboard.enabled: false, which also drops the dashboard framing of that role. Unit tests cover false, true, a missing binding, a rendered string and a non-boolean; forcing the helper to always show the card fails four of them.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

tests/unit/python/plugins/lookup/test_docker_cards.py

@@ -382,40 +382,34 @@ logo:
         fake_variables["group_names"] = ["portfolio", "other"]
         return fake_variables
 
-    def test_display_false_skips_the_card(self):
+    def test_enabled_false_skips_the_card(self):
         fake_variables = self._base_fake_variables()
         fake_variables["applications"]["portfolio"]["services"]["dashboard"][
-            "display"
+            "enabled"
         ] = False
 
         result = self._run_lookup(LookupModule(), fake_variables)
 
         self.assertEqual(result, [[]])
 
-    def test_absent_display_shows_the_card(self):
+    def test_a_role_without_a_dashboard_binding_shows_the_card(self):
         fake_variables = self._base_fake_variables()
-        self.assertNotIn(
-            "display",
-            fake_variables["applications"]["portfolio"]["services"]["dashboard"],
-        )
+        fake_variables["applications"]["portfolio"]["services"] = {}
 
         result = self._run_lookup(LookupModule(), fake_variables)
 
         self.assertEqual([c["title"] for c in result[0]], ["Portfolio Application"])
 
-    def test_display_true_shows_the_card(self):
+    def test_enabled_true_shows_the_card(self):
         fake_variables = self._base_fake_variables()
-        fake_variables["applications"]["portfolio"]["services"]["dashboard"][
-            "display"
-        ] = True
 
         result = self._run_lookup(LookupModule(), fake_variables)
 
         self.assertEqual([c["title"] for c in result[0]], ["Portfolio Application"])
 
-    def test_display_false_hides_only_its_own_card(self):
+    def test_enabled_false_hides_only_its_own_card(self):
         fake_variables = self._two_role_variables()
-        fake_variables["applications"]["other"]["services"]["dashboard"]["display"] = (
+        fake_variables["applications"]["other"]["services"]["dashboard"]["enabled"] = (
             False
         )
 
@@ -423,7 +417,7 @@ logo:
 
         self.assertEqual([c["title"] for c in result[0]], ["Portfolio Application"])
 
-    def test_both_cards_render_without_display(self):
+    def test_both_cards_render_when_both_are_enabled(self):
         fake_variables = self._two_role_variables()
 
         result = self._run_lookup(LookupModule(), fake_variables)
@@ -444,11 +438,11 @@ logo:
 
         self.assertEqual([c["title"] for c in result[0]], ["Portfolio Application"])
 
-    def test_non_bool_display_fails_loudly(self):
+    def test_non_boolean_enabled_fails_loudly(self):
         fake_variables = self._base_fake_variables()
         fake_variables["applications"]["portfolio"]["services"]["dashboard"][
-            "display"
-        ] = "false"
+            "enabled"
+        ] = "maybe"
 
         with self.assertRaisesRegex(AnsibleError, "portfolio"):
             self._run_lookup(LookupModule(), fake_variables)

tests/unit/python/plugins/lookup/test_roles_with_service.py

@@ -613,37 +613,6 @@ class RolesWithServiceLookupTests(unittest.TestCase):
             ("matrix.example.com", "https://web-app-chat.example.com"),
         )
 
-    def test_dashboard_display_false_drops_the_tile_target(self):
-        applications = {
-            "web-app-hidden": {
-                "services": {
-                    "dashboard": {"enabled": True, "shared": True, "display": False}
-                },
-                "domains": {"canonical": ["hidden.example.com"]},
-            },
-            "web-app-shown": {
-                "services": {"dashboard": {"enabled": True, "shared": True}},
-                "domains": {"canonical": ["shown.example.com"]},
-            },
-        }
-        result = self._run(["dashboard"], applications)[0]
-        self.assertEqual([r["id"] for r in result], ["web-app-shown"])
-
-    def test_dashboard_display_true_keeps_the_tile_target(self):
-        applications = self._card_target_role("dashboard", display=True)
-        result = self._run(["dashboard"], applications)[0]
-        self.assertEqual([r["id"] for r in result], ["web-app-chat"])
-
-    def test_dashboard_non_bool_display_fails_loudly(self):
-        applications = self._card_target_role("dashboard", display="false")
-        with self.assertRaisesRegex(AnsibleError, "web-app-chat"):
-            self._run(["dashboard"], applications)
-
-    def test_other_services_ignore_a_display_key(self):
-        applications = self._card_target_role("prometheus", display=False)
-        result = self._run(["prometheus"], applications)[0]
-        self.assertEqual([r["id"] for r in result], ["web-app-chat"])
-
 
 if __name__ == "__main__":
     unittest.main()