---
- name: "🔍 Resolve {{ application_id }} hosting node + container id"
  ansible.builtin.include_tasks: "{{ lookup('path_absolute', 'roles/sys-svc-compose/tasks/utils/swarm/resolve_host_cid.yml') }}"
  vars:
    resolve_service_key: "{{ BASEROW_SERVICE_NAME }}"
    resolve_output_prefix: BASEROW
    resolve_compose_cid: "{{ BASEROW_CONTAINER }}"

- name: "🔑 Create the MCP endpoint, its owner and its workspace"
  ansible.builtin.command:
    argv:
      - container
      - exec
      - -i
      - -e
      - "DJANGO_SETTINGS_MODULE={{ BASEROW_DJANGO_SETTINGS_MODULE }}"
      - -e
      - "SECRET_KEY={{ BASEROW_SECRET_KEY }}"
      - -e
      - "BASEROW_SECRET_KEY={{ BASEROW_SECRET_KEY }}"
      - -e
      - "MCP_OWNER_EMAIL={{ BASEROW_MCP_OWNER_EMAIL }}"
      - -e
      - "MCP_WORKSPACE_NAME={{ BASEROW_MCP_WORKSPACE_NAME }}"
      - -e
      - "MCP_ENDPOINT_NAME={{ BASEROW_MCP_ENDPOINT_NAME }}"
      - -e
      - "MCP_ENDPOINT_KEY={{ BASEROW_MCP_ENDPOINT_KEY }}"
      - "{{ BASEROW_LOCAL_CID }}" # nocheck: container-exec-resolver
      - "{{ BASEROW_PYTHON }}"
      - "{{ BASEROW_MANAGE_PY }}"
      - shell
      - -c
      - "{{ lookup('file', 'python/provision_mcp.py') }}"
  register: baserow_mcp_provision
  retries: 30
  delay: 10
  until: baserow_mcp_provision.rc == 0
  changed_when: "'CHANGED' in baserow_mcp_provision.stdout"
  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
  delegate_to: "{{ BASEROW_HOST_NODE }}"
  run_once: true

- name: "🩺 Probe the MCP endpoint on the internal origin"
  ansible.builtin.command:
    argv:
      - container
      - exec
      - -i
      - -e
      - "MCP_BASE_URL={{ BASEROW_INTERNAL_URL }}"
      - -e
      - "MCP_ENDPOINT_PATH={{ BASEROW_MCP_ENDPOINT_PATH }}"
      - -e
      - "MCP_ENDPOINT_KEY={{ BASEROW_MCP_ENDPOINT_KEY }}"
      - "{{ BASEROW_LOCAL_CID }}" # nocheck: container-exec-resolver
      - "{{ BASEROW_PYTHON }}"
      - "-"
    stdin: "{{ lookup('file', 'python/probe_mcp_endpoint.py') }}"
  register: baserow_mcp_probe
  retries: 30
  delay: 10
  until: baserow_mcp_probe.rc == 0 or 'REJECTED' in baserow_mcp_probe.stderr
  failed_when: false
  changed_when: false
  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
  delegate_to: "{{ BASEROW_HOST_NODE }}"
  run_once: true

- name: "🛑 Refuse an endpoint that never serves the MCP stream"
  ansible.builtin.assert:
    that:
      - baserow_mcp_probe.rc == 0
    fail_msg: >-
      {{ BASEROW_INTERNAL_URL }}{{ BASEROW_MCP_ENDPOINT_PATH }} did not answer 401
      for an unknown key and text/event-stream for the provisioned one, so every
      MCP client would be pointed at a dead or unguarded endpoint.

- name: "🔁 Rebuild the adapter sidecar against the current contract"
  ansible.builtin.include_tasks: "{{ lookup('path_absolute', 'roles/svc-ai-mcp-adapter/tasks/rebuild.yml') }}"

- name: "🔄 Start the sidecar before probing it"
  ansible.builtin.meta: flush_handlers