---
- name: "➕ Add LDAP Authentication Source"
  shell: | # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
    container exec -i --user {{ GITEA_USER }} {{ GITEA_LOCAL_CID | quote }} \
      gitea admin auth add-ldap \
      {{ GITEA_LDAP_AUTH_ARGS | join(' ') }}
  delegate_to: "{{ GITEA_HOST_NODE }}"
  register: ldap_manage
  failed_when: ldap_manage.rc != 0 and not (ldap_manage.stderr | gitea_auth_noop)

- name: "🔍 Lookup existing LDAP auth source ID"
  shell: | # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
    container exec -i --user {{ GITEA_USER }} {{ GITEA_LOCAL_CID | quote }} \
      gitea admin auth list \
      | tail -n +2 \
      | grep -F "LDAP ({{ DOMAIN_PRIMARY }})" \
      | awk '{print $1; exit}'
  delegate_to: "{{ GITEA_HOST_NODE }}"
  register: ldap_source_id_raw
  failed_when:
    - ldap_source_id_raw.rc != 0
    - ldap_source_id_raw.stdout == ""
  changed_when: false

- name: "🔧 Set LDAP source ID fact"
  set_fact:
    ldap_source_id: "{{ ldap_source_id_raw.stdout }}"

- name: "🔄 Update LDAP Authentication Source"
  shell: | # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
    container exec -i --user {{ GITEA_USER }} {{ GITEA_LOCAL_CID | quote }} \
      gitea admin auth update-ldap \
      --id {{ ldap_source_id }} \
      {{ GITEA_LDAP_AUTH_ARGS | join(' ') }}
  delegate_to: "{{ GITEA_HOST_NODE }}"
  register: ldap_manage
  failed_when: ldap_manage.rc != 0