---
- name: "➕ Add Keycloak OIDC Provider"
  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
  shell: | # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
    container exec -i --user {{ GITEA_USER }} {{ GITEA_LOCAL_CID | quote }} \
      gitea admin auth add-oauth \
        --provider openidConnect \
        --name     "{{ OIDC.BUTTON_TEXT }}" \
        --key      "{{ OIDC.CLIENT.ID }}" \
        --secret   "{{ OIDC.CLIENT.SECRET }}" \
        --auto-discover-url "{{ OIDC.CLIENT.DISCOVERY_DOCUMENT }}" \
        --scopes   "openid profile email"
  delegate_to: "{{ GITEA_HOST_NODE }}"
  register: oidc_manage
  failed_when: oidc_manage.rc != 0 and not (oidc_manage.stderr | gitea_auth_noop)

- name: "🔍 Lookup existing Keycloak auth source ID"
  shell: | # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
    container exec -i --user {{ GITEA_USER }} {{ GITEA_LOCAL_CID | quote }} \
      /app/gitea/gitea admin auth list \
      | tail -n +2 \
      | grep -F "{{ OIDC.BUTTON_TEXT }}" \
      | awk '{print $1; exit}'
  delegate_to: "{{ GITEA_HOST_NODE }}"
  register: oidc_source_id_raw
  failed_when:
    - oidc_source_id_raw.rc != 0
    - oidc_source_id_raw.stdout == ""
  changed_when: false

- name: "🔧 Set Keycloak source ID fact"
  set_fact:
    oidc_source_id: "{{ oidc_source_id_raw.stdout }}"

- name: "🔄 Update Keycloak OIDC Provider"
  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
  shell: | # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
    container exec -i --user {{ GITEA_USER }} {{ GITEA_LOCAL_CID | quote }} \
      gitea admin auth update-oauth \
        --id {{ oidc_source_id }}\
        --provider openidConnect \
        --name     "{{ OIDC.BUTTON_TEXT }}" \
        --key      "{{ OIDC.CLIENT.ID }}" \
        --secret   "{{ OIDC.CLIENT.SECRET }}" \
        --auto-discover-url "{{ OIDC.CLIENT.DISCOVERY_DOCUMENT }}" \
        --scopes   "openid profile email"
  delegate_to: "{{ GITEA_HOST_NODE }}"
  register: oidc_manage
  failed_when: oidc_manage.rc != 0