---
# @See https://docs.nextcloud.com/server/latest/admin_manual/configuration_user/user_auth_ldap.html
- name: 🔍 Resolve desired Nextcloud LDAP config ID
  set_fact:
    nextcloud_ldap_config_id: "{{ (NEXTCLOUD_LDAP_CONFIG_PREFIX | default('s01')) | string | trim }}"
  changed_when: false
- name: 🔎 Check if desired Nextcloud LDAP config ID exists
  shell: >
    {{ NEXTCLOUD_DOCKER_EXEC_OCC }} ldap:show-config {{ nextcloud_ldap_config_id }}
  register: nextcloud_ldap_config_probe
  changed_when: false
  failed_when: false
- name: 🛑 Fail when LDAP config probe failed for unexpected reason
  fail:
    msg: >-
      Could not verify Nextcloud LDAP config '{{ nextcloud_ldap_config_id }}'.
      stdout='{{ nextcloud_ldap_config_probe.stdout }}'
      stderr='{{ nextcloud_ldap_config_probe.stderr }}'
  when:
    - nextcloud_ldap_config_probe.rc != 0
    - "'Invalid configID' not in ((nextcloud_ldap_config_probe.stdout) ~ (nextcloud_ldap_config_probe.stderr))"
- name: 📁 Auto-create empty Nextcloud LDAP config when desired config ID is missing
  shell: >
    {{ NEXTCLOUD_DOCKER_EXEC_OCC }} ldap:create-empty-config
  register: nextcloud_ldap_config_create
  changed_when: nextcloud_ldap_config_create.rc == 0
  when:
    - nextcloud_ldap_config_probe.rc != 0
    - "'Invalid configID' in ((nextcloud_ldap_config_probe.stdout) ~ (nextcloud_ldap_config_probe.stderr))"
- name: 🔎 Re-check desired Nextcloud LDAP config ID after auto-create
  shell: >
    {{ NEXTCLOUD_DOCKER_EXEC_OCC }} ldap:show-config {{ nextcloud_ldap_config_id }}
  register: nextcloud_ldap_config_reprobe
  changed_when: false
  failed_when: false
  when:
    - nextcloud_ldap_config_create is defined
    - nextcloud_ldap_config_create is changed
- name: 🛑 Fail when desired LDAP config ID is still missing after auto-create
  assert:
    that:
      - nextcloud_ldap_config_reprobe.rc == 0
    fail_msg: >-
      Nextcloud LDAP config '{{ nextcloud_ldap_config_id }}' is still missing after auto-create.
      create_stdout='{{ nextcloud_ldap_config_create.stdout | default('') }}'
      create_stderr='{{ nextcloud_ldap_config_create.stderr | default('') }}'
  when:
    - nextcloud_ldap_config_create is defined
    - nextcloud_ldap_config_create is changed
- name: 🔧 Set Nextcloud LDAP bind password
  shell: >
    {{ NEXTCLOUD_DOCKER_EXEC_OCC }} ldap:set-config {{ nextcloud_ldap_config_id }} ldapAgentPassword '{{ LDAP.BIND_CREDENTIAL }}'
  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
- name: 🟢 Activate Nextcloud LDAP configuration
  shell: >
    {{ NEXTCLOUD_DOCKER_EXEC_OCC }} ldap:set-config {{ nextcloud_ldap_config_id }} ldapConfigurationActive 1
- name: 🗂️ Warm LDAP cache (to guaranty that all LDAP users are present)
  shell: >
    {{ NEXTCLOUD_DOCKER_EXEC_OCC }} ldap:search ""