---
- name: ⏳ Wait for the SuiteCRM web endpoint
  wait_for:
    host: "{{ DOCKER_REACH_HOST }}"
    port: "{{ lookup('config', 'web-app-suitecrm', 'services.suitecrm.ports.local.http') }}"
    delay: 5
    timeout: "{{ lookup('timeout', 600) | int }}"

- name: 🔧 Provision SuiteCRM OAuth2 password client (idempotent), capture credentials
  ansible.builtin.command:
    argv:
      - container
      - exec
      - -i
      - -e
      - "NC_CLIENT_NAME={{ nextcloud_crm_client_name }}"
      - -e
      - "NC_CLIENT_SECRET={{ nextcloud_crm_client_secret }}"
      - "{{ nextcloud_crm_container }}" # nocheck: container-exec-resolver  runs only behind the bare-name partner probe gate, compose co-location
      - php
      - -d
      - error_reporting=E_ERROR
      - -
    chdir: "{{ nextcloud_crm_instance_dir }}"
    stdin: "{{ lookup('file', 'php/addons/suitecrm/provision_oauth_password_client.php') }}"
  register: nextcloud_crm_provision
  changed_when: false
  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"

- name: 🔎 Parse the SuiteCRM OAuth client credentials
  set_fact:
    nextcloud_crm_client_id: "{{ nextcloud_crm_provision.stdout | regex_search('CLIENT_ID=(.+)', '\\1') | first }}"
  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"

- name: 🔗 Link the SuiteCRM OAuth password client into integration_suitecrm
  shell: >
    {{ NEXTCLOUD_DOCKER_EXEC_OCC }} config:app:set integration_suitecrm {{ item.key }}
    --value={{ item.value | quote }}
  loop:
    - { key: "oauth_instance_url", value: "{{ nextcloud_crm_base_url }}" }
    - { key: "client_id", value: "{{ nextcloud_crm_client_id }}" }
    - { key: "client_secret", value: "{{ nextcloud_crm_client_secret }}" }
  loop_control:
    label: "{{ item.key }}"
  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"