---
- name: 📊 Gather all users with their current objectClass list
  community.general.ldap_search:
    server_uri: "{{ OPENLDAP_SERVER_URI }}"
    bind_dn: "{{ OPENLDAP_BIND_DN }}"
    bind_pw: "{{ OPENLDAP_BIND_PW }}"
    dn: "{{ LDAP.DN.OU.USERS }}"
    scope: subordinate
    filter: "{{ LDAP.FILTERS.USERS.ALL }}"
    attrs:
      - dn
      - objectClass
      - "{{ LDAP.USER.ATTRIBUTES.ID }}"
  register: ldap_users_with_classes

- name: ➕ Add only missing auxiliary classes
  community.general.ldap_attrs:
    server_uri: "{{ OPENLDAP_SERVER_URI }}"
    bind_dn: "{{ OPENLDAP_BIND_DN }}"
    bind_pw: "{{ OPENLDAP_BIND_PW }}"
    dn: "{{ item.dn }}"
    attributes:
      objectClass: "{{ missing_auxiliary }}"
    state: present
  register: openldap_aux_classes
  changed_when: false
  # rationale: async; class additions run overlapped, reaped at the end of this file
  async: "{{ ASYNC_TIME if ASYNC_ENABLED | bool else omit }}"
  poll: "{{ ASYNC_POLL if ASYNC_ENABLED | bool else omit }}"
  loop: "{{ ldap_users_with_classes.results }}"
  loop_control:
    label: "{{ item.dn }}"
  vars:
    missing_auxiliary: >-
      {{ (LDAP.USER.OBJECTS.AUXILIARY.values() | list)
         | difference(item.objectClass | default([]))
      }}
  when: missing_auxiliary | length > 0

- name: "⏳ Reap the LDAP auxiliary class jobs"
  ansible.builtin.include_tasks: utils/async/reap.yml
  vars:
    async_reap_jobs: "{{ openldap_aux_classes.results | default([]) }}"
    async_reap_label: "LDAP auxiliary classes"
    async_reap_tolerate: []