---
# Read the upstream credential the adapter is holding right now.
#
# A provider that mints its own secret hands it back once, so the deployment
# cannot re-derive it. Reading it back is what lets a converged run keep the
# working credential instead of minting a replacement and revoking the one the
# sidecar is using.
#
# Param: mcp_upstream_key_path      env file the sidecar reads.
# Sets:  MCP_UPSTREAM_CURRENT_KEY   the stored credential, or "" when none.
- name: "🔍 Read the upstream credential file of {{ application_id }}"
  ansible.builtin.slurp:
    src: "{{ mcp_upstream_key_path }}"
  register: mcp_upstream_current
  failed_when: false
  delegate_to: "{{ STACK_HOST }}"
  become: true
  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}" # nocheck: include-uniform-apply-keyword  the read runs on the stack host and the set_fact on the controller

- name: "🔑 Publish the credential the {{ application_id }} adapter holds"
  ansible.builtin.set_fact:
    MCP_UPSTREAM_CURRENT_KEY: >-
      {{ (mcp_upstream_current.content | b64decode).split('=', 1)[1] | trim
         if mcp_upstream_current.content is defined
         and '=' in (mcp_upstream_current.content | b64decode)
         else '' }}
  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"