---
- name: "🔍 Decidim | Resolve hosting node + container ID ({{ DEPLOYMENT_MODE }})"
  ansible.builtin.include_tasks: "{{ lookup('path_absolute', 'roles/sys-svc-compose/tasks/utils/swarm/resolve_host_cid.yml') }}"
  vars:
    resolve_service_key: decidim
    resolve_output_prefix: DECIDIM
    resolve_compose_cid: "{{ DECIDIM_CONTAINER }}"

- name: "⏳ Decidim | Wait for web container to be healthy"
  ansible.builtin.shell: >
    container inspect --type container --format '{{ "{{.State.Health.Status}}" }}'
    {{ DECIDIM_LOCAL_CID | quote }}
  register: decidim_health
  changed_when: false
  retries: 60
  delay: 15
  until: (decidim_health.stdout | trim) == 'healthy'
  delegate_to: "{{ DECIDIM_HOST_NODE }}"

- name: "▶️ Decidim | Run database migrations"
  ansible.builtin.shell: > # nocheck: container-exec-resolver  DECIDIM_LOCAL_CID resolved at delegate_to runtime
    container exec -e RAILS_ENV={{ ENVIRONMENT | quote }}
    {{ DECIDIM_LOCAL_CID | quote }}
    bundle exec rails db:migrate
  register: decidim_migrate_result
  changed_when: decidim_migrate_result.stdout_lines | default([]) | length > 0
  delegate_to: "{{ DECIDIM_HOST_NODE }}"

- name: "🌱 Decidim | Seed database on first deploy"
  ansible.builtin.shell: > # nocheck: container-exec-resolver  DECIDIM_LOCAL_CID resolved at delegate_to runtime
    container exec -e RAILS_ENV={{ ENVIRONMENT | quote }}
    {{ DECIDIM_LOCAL_CID | quote }}
    bundle exec rails db:seed
  register: decidim_seed_result
  changed_when: decidim_seed_result.stdout_lines | default([]) | length > 0
  failed_when: false
  delegate_to: "{{ DECIDIM_HOST_NODE }}"

- name: "🏛️ Decidim | Create the organization that db:seed skips in production"
  ansible.builtin.shell: > # nocheck: container-exec-resolver  DECIDIM_LOCAL_CID resolved at delegate_to runtime
    container exec -i -e RAILS_ENV={{ ENVIRONMENT | quote }}
    -e DECIDIM_ORG_HOST={{ domain | quote }}
    -e DECIDIM_ORG_NAME={{ DECIDIM_ORGANIZATION_NAME | quote }}
    {{ DECIDIM_LOCAL_CID | quote }}
    bundle exec rails runner -
  args:
    stdin: "{{ lookup('file', 'ruby/ensure/organization.rb') }}"
  register: decidim_organization_result
  changed_when: "'Organization created' in decidim_organization_result.stdout"
  when: ENVIRONMENT == 'production'
  delegate_to: "{{ DECIDIM_HOST_NODE }}"

- name: "📄 Decidim | Ensure default static pages exist (terms-of-service)"
  ansible.builtin.shell: > # nocheck: container-exec-resolver  DECIDIM_LOCAL_CID resolved at delegate_to runtime
    container exec -i -e RAILS_ENV={{ ENVIRONMENT | quote }}
    {{ DECIDIM_LOCAL_CID | quote }}
    bundle exec rails runner -
  args:
    stdin: "{{ lookup('file', 'ruby/ensure/default_pages.rb') }}"
  register: decidim_pages_result
  changed_when: "'Default pages ensured' in decidim_pages_result.stdout"
  delegate_to: "{{ DECIDIM_HOST_NODE }}"

- name: "🔧 Decidim | Set organization host"
  ansible.builtin.shell: > # nocheck: container-exec-resolver  DECIDIM_LOCAL_CID resolved at delegate_to runtime
    container exec -i -e RAILS_ENV={{ ENVIRONMENT | quote }}
    -e DECIDIM_ORG_HOST={{ domain | quote }}
    {{ DECIDIM_LOCAL_CID | quote }}
    bundle exec rails runner -
  args:
    stdin: "{{ lookup('file', 'ruby/set_organization_host.rb') }}"
  register: decidim_org_result
  changed_when: "'Organization host set to' in decidim_org_result.stdout"
  delegate_to: "{{ DECIDIM_HOST_NODE }}"

- name: "✅ Decidim | Ensure administrator user exists with correct credentials"
  ansible.builtin.shell: > # nocheck: container-exec-resolver  DECIDIM_LOCAL_CID resolved at delegate_to runtime
    container exec -i -e RAILS_ENV={{ ENVIRONMENT | quote }}
    -e DECIDIM_ADMIN_EMAIL={{ lookup('users', 'administrator').email | quote }}
    -e DECIDIM_ADMIN_PASSWORD={{ lookup('users', 'administrator').password | quote }}
    {{ DECIDIM_LOCAL_CID | quote }}
    bundle exec rails runner -
  args:
    stdin: "{{ lookup('file', 'ruby/ensure/admin_user.rb') }}"
  register: decidim_admin_result
  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
  changed_when: "'Admin user ready' in decidim_admin_result.stdout"
  delegate_to: "{{ DECIDIM_HOST_NODE }}"

- name: "🔧 Decidim | Configure OIDC omniauth settings in organization"
  ansible.builtin.shell: > # nocheck: container-exec-resolver  DECIDIM_LOCAL_CID resolved at delegate_to runtime
    container exec -i -e RAILS_ENV={{ ENVIRONMENT | quote }}
    {{ DECIDIM_LOCAL_CID | quote }}
    bundle exec rails runner -
  args:
    stdin: "{{ lookup('file', 'ruby/configure_oidc.rb') }}"
  register: decidim_oidc_result
  changed_when: "'OIDC settings configured' in decidim_oidc_result.stdout"
  when: DECIDIM_OIDC_ENABLED | bool
  delegate_to: "{{ DECIDIM_HOST_NODE }}"