---
# Exception logic: genuine bidirectional OAuth 2.0 coupling the generic config SPOT cannot do.
# An OAuth application is registered on the OpenProject side and a Nextcloud OAuth2 client is
# registered back on the OpenProject storage; the partner-derived client ids/secret are linked
# into integration_openproject. Re-runs only while Nextcloud is not yet coupled.
- name: 🔍 Resolve expected OpenProject base URL for the integration
  set_fact:
    nextcloud_op_expected_url: "{{ lookup('tls', 'web-app-openproject', 'url.base') | trim }}"
    nextcloud_op_storage_name: "Nextcloud ({{ lookup('domain', 'web-app-nextcloud') }})"
  changed_when: false

- name: 📖 Read persisted integration_openproject OpenProject OAuth client id
  shell: >
    {{ NEXTCLOUD_DOCKER_EXEC_OCC }} config:app:get integration_openproject openproject_client_id
  register: nextcloud_op_client_id_current
  changed_when: false
  failed_when: false

- name: 📖 Read persisted integration_openproject Nextcloud OAuth client id
  shell: >
    {{ NEXTCLOUD_DOCKER_EXEC_OCC }} config:app:get integration_openproject nc_oauth_client_id
  register: nextcloud_op_nc_client_current
  changed_when: false
  failed_when: false

- name: 📖 Read persisted integration_openproject OpenProject OAuth client secret
  shell: >
    {{ NEXTCLOUD_DOCKER_EXEC_OCC }} config:app:get integration_openproject openproject_client_secret
  register: nextcloud_op_client_secret_current
  changed_when: false
  failed_when: false
  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"

- name: 🔧 Provision the bidirectional OpenProject <-> Nextcloud OAuth coupling
  include_tasks: integration_openproject_provision.yml
  when: >-
    IS_STACK_HOST | bool
    and (
      (nextcloud_op_client_id_current.stdout | trim) | length == 0
      or (nextcloud_op_nc_client_current.stdout | trim) | length == 0
    )