---
- name: "🔍 Read the MCP token this hub already issued"
  ansible.builtin.set_fact:
    homeassistant_mcp_token: "{{ lookup('mcp_credential', application_id) }}"

- name: "🔍 Resolve {{ application_id }} hosting node + container id"
  ansible.builtin.include_tasks: "{{ lookup('path_absolute', 'roles/sys-svc-compose/tasks/utils/swarm/resolve_host_cid.yml') }}"
  vars:
    resolve_service_key: "{{ entity_name }}"
    resolve_output_prefix: HOMEASSISTANT
    resolve_compose_cid: "{{ HOMEASSISTANT_CONTAINER }}"

- name: "🩺 Check the stored token against the running hub"
  ansible.builtin.include_tasks: "{{ role_path }}/tasks/utils/mcp/probe.yml"
  when: homeassistant_mcp_token | length > 0

- name: "🚀 Onboard the hub and enable its MCP server"
  ansible.builtin.include_tasks: "{{ role_path }}/tasks/utils/mcp/provision.yml"
  when: homeassistant_mcp_token | length == 0 or homeassistant_token_probe.rc | default(1) != 0

- name: "🩺 Re-check the freshly minted token"
  ansible.builtin.include_tasks: "{{ role_path }}/tasks/utils/mcp/probe.yml"
  when: homeassistant_token_probe is not defined or homeassistant_token_probe.rc != 0

- name: "🛑 Refuse a hub whose MCP token every client would be rejected with"
  ansible.builtin.assert:
    that:
      - homeassistant_token_probe.rc == 0
    fail_msg: >-
      The hub rejected the token stored for {{ application_id }}, so every MCP
      client would be configured with a bearer the hub answers 401 to.