---
# Update the realm's Declarative User Profile.
#
# The generic /admin/realms/{realm}/components/{id} endpoint (used by
# keycloak_kcadm_update for client/component/scope) silently drops the
# kc.user.profile.config payload — Keycloak persists only the 4
# default standard attributes. The realm-scoped /admin/realms/{realm}/
# users/profile endpoint accepts the inner attributes/groups payload
# directly and writes through correctly. We piping the JSON via
# kcadm.sh update users/profile -f -.

- name: "⬆️ Push UserProfileProvider config via realms/{{ KEYCLOAK_REALM }}/users/profile"
  ansible.builtin.shell: >
    {{ KEYCLOAK_EXEC_KCADM }}
    update users/profile -r {{ KEYCLOAK_REALM | quote }} -f -
  args:
    stdin: "{{ KEYCLOAK_USER_PROFILE_OBJECT | to_json }}"
  changed_when: true
  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
  register: kc_userprofile