---
- name: "✅ Assert '{{ application_id }}' carries a gateway virtual key"
  ansible.builtin.assert:
    that:
      - (lookup('config', application_id, 'secrets.credentials.litellm_api_key', '') | trim) | length > 0
    fail_msg: >-
      {{ application_id }} enables services.litellm but its
      credentials.litellm_api_key is empty, so its native AI surface would
      reach the gateway unauthenticated.

- name: "✅ Assert the AI base URL of '{{ application_id }}' stays inside the deployment"
  ansible.builtin.assert:
    that:
      - (LITELLM_BASE_LOCAL_URL | urlsplit('scheme')) == 'http'
      - "'.' not in (LITELLM_BASE_LOCAL_URL | urlsplit('hostname'))"
      - (LITELLM_BASE_LOCAL_URL | urlsplit('hostname')) != lookup('domain', application_id)
      - (LITELLM_BASE_LOCAL_URL | urlsplit('port') | int) == (lookup('config', 'svc-ai-litellm', 'services.litellm.ports.internal.http') | int)
    fail_msg: >-
      {{ application_id }} would send inference traffic to
      '{{ LITELLM_BASE_LOCAL_URL }}'. Only the container-network gateway is
      allowed: plain http, an undotted service name (the dns-search suffix
      turns a dotted host into the public FQDN and routes it through the
      ingress), a host that is not this role's own domain, and the gateway's
      internal port {{ lookup('config', 'svc-ai-litellm', 'services.litellm.ports.internal.http') }}
      rather than its published one.