---
- name: "📇 Configure the OIDC auth method against Keycloak"
  when: OPENBAO_SSO_ENABLED | bool
  block:
    - name: "🧩 Enable the OIDC auth method"
      ansible.builtin.shell: > # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
        container exec {{ OPENBAO_LOCAL_CID | quote }}
        sh -c 'bao auth list -format=json | grep -q "oidc/" ||
        { bao auth enable oidc && echo OPENBAO_CHANGED; }'
      register: openbao_oidc_enable
      changed_when: "'OPENBAO_CHANGED' in openbao_oidc_enable.stdout"
      delegate_to: "{{ OPENBAO_HOST_NODE }}"

    - name: "📇 Point the OIDC method at the Keycloak realm"
      ansible.builtin.shell: > # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
        container exec -i {{ OPENBAO_LOCAL_CID | quote }}
        bao write auth/oidc/config
        oidc_discovery_url={{ OPENBAO_OIDC_ISSUER | quote }}
        oidc_client_id={{ OPENBAO_OIDC_CLIENT_ID | quote }}
        oidc_client_secret=-
        default_role={{ OPENBAO_OIDC_DEFAULT_ROLE | quote }}
      args:
        stdin: "{{ OPENBAO_OIDC_CLIENT_SECRET }}"
        stdin_add_newline: false
      changed_when: false
      delegate_to: "{{ OPENBAO_HOST_NODE }}"
      no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"

    - name: "📇 Configure the default OIDC role, which grants only the 'default' policy"
      ansible.builtin.shell: > # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
        container exec {{ OPENBAO_LOCAL_CID | quote }}
        sh -c 'set -e;
        p=auth/oidc/role/{{ OPENBAO_OIDC_DEFAULT_ROLE }};
        before=$(bao read -format=json $p 2>/dev/null | grep -v request_id || true);
        bao write $p role_type=oidc
        user_claim={{ OPENBAO_OIDC_USER_CLAIM | quote }}
        groups_claim={{ OPENBAO_OIDC_GROUPS_CLAIM | quote }}
        oidc_scopes=openid,profile,email
        token_policies=default
        allowed_redirect_uris={{ OPENBAO_OIDC_REDIRECT_URIS | quote }} >/dev/null;
        after=$(bao read -format=json $p | grep -v request_id);
        [ "$before" = "$after" ] || echo OPENBAO_CHANGED'
      register: openbao_oidc_role
      changed_when: "'OPENBAO_CHANGED' in openbao_oidc_role.stdout"
      delegate_to: "{{ OPENBAO_HOST_NODE }}"

- name: "📇 Configure the LDAP auth method against svc-db-openldap"
  ansible.builtin.include_tasks:
    file: addons/auth-ldap.yml
    apply:
      delegate_to: "{{ OPENBAO_HOST_NODE }}"
  when: OPENBAO_LDAP_ENABLED | bool

- name: "🔍 Read the auth mount accessors"
  ansible.builtin.shell: > # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
    container exec {{ OPENBAO_LOCAL_CID | quote }}
    bao auth list -format=json
  register: openbao_auth_list
  changed_when: false
  delegate_to: "{{ OPENBAO_HOST_NODE }}"

- name: "🔧 Keep the auth mount table, keyed by mount path such as 'oidc/'"
  ansible.builtin.set_fact:
    openbao_auth_mounts: "{{ openbao_auth_list.stdout | from_json }}"

- name: "👥 Upsert the external identity group per RBAC role"
  ansible.builtin.shell: > # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
    container exec {{ OPENBAO_LOCAL_CID | quote }}
    sh -c 'set -e;
    p=identity/group/name/{{ item }};
    before=$(bao read -field=policies $p 2>/dev/null || true);
    bao write $p type=external policies={{ item | quote }} >/dev/null;
    after=$(bao read -field=policies $p);
    [ "$before" = "$after" ] || echo OPENBAO_CHANGED'
  loop: "{{ OPENBAO_RBAC_ROLES }}"
  register: openbao_identity_group
  changed_when: "'OPENBAO_CHANGED' in openbao_identity_group.stdout"
  delegate_to: "{{ OPENBAO_HOST_NODE }}"

- name: "🔍 Read the identity group ids"
  ansible.builtin.shell: > # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
    container exec {{ OPENBAO_LOCAL_CID | quote }}
    bao read -field=id identity/group/name/{{ item | quote }}
  loop: "{{ OPENBAO_RBAC_ROLES }}"
  register: openbao_group_ids
  changed_when: false
  delegate_to: "{{ OPENBAO_HOST_NODE }}"

- name: "🔗 Bind each Keycloak group path to its OpenBao identity group"
  ansible.builtin.include_tasks:
    file: utils/group_alias.yml
    apply:
      delegate_to: "{{ OPENBAO_HOST_NODE }}"
  loop: "{{ openbao_group_ids.results }}"
  loop_control:
    loop_var: openbao_group
  vars:
    alias_mount: "oidc/"
    alias_name: "/{{ lookup('rbac_group_path', application_id=application_id, role=openbao_group.item) }}"
  when: OPENBAO_SSO_ENABLED | bool

- name: "🔗 Bind each LDAP role group to its OpenBao identity group"
  ansible.builtin.include_tasks:
    file: utils/group_alias.yml
    apply:
      delegate_to: "{{ OPENBAO_HOST_NODE }}"
  loop: "{{ openbao_group_ids.results }}"
  loop_control:
    loop_var: openbao_group
  vars:
    alias_mount: "ldap/"
    alias_name: "{{ application_id }}-{{ openbao_group.item }}"
  when: OPENBAO_LDAP_ENABLED | bool