---
# include-gated: when: OPENBAO_LDAP_ENABLED | bool
- name: "🧩 Enable the LDAP auth method"
  ansible.builtin.shell: > # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
    container exec {{ OPENBAO_LOCAL_CID | quote }}
    sh -c 'bao auth list -format=json | grep -q "ldap/" ||
    { bao auth enable -plugin-version=latest ldap && echo OPENBAO_CHANGED; }'
  register: openbao_ldap_enable
  changed_when: "'OPENBAO_CHANGED' in openbao_ldap_enable.stdout"

- name: "🔌 Move an LDAP mount of the removed builtin engine onto the plugin"
  ansible.builtin.shell: > # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
    container exec {{ OPENBAO_LOCAL_CID | quote }}
    sh -c '[ "$(bao read -field=plugin_version sys/auth/ldap)" = latest ] ||
    { bao auth tune -plugin-version=latest ldap/ &&
    bao plugin reload -mounts=auth/ldap/ &&
    echo OPENBAO_CHANGED; }'
  register: openbao_ldap_plugin
  changed_when: "'OPENBAO_CHANGED' in openbao_ldap_plugin.stdout"

- name: "📇 Point the LDAP method at the directory"
  ansible.builtin.shell: > # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
    container exec -i {{ OPENBAO_LOCAL_CID | quote }}
    bao write auth/ldap/config
    url={{ OPENBAO_LDAP_URL | quote }}
    userdn={{ LDAP.DN.OU.USERS | quote }}
    userattr={{ OPENBAO_LDAP_USER_ATTR | quote }}
    groupdn={{ LDAP.DN.OU.ROLES | quote }}
    groupattr=cn
    binddn={{ LDAP.DN.ADMINISTRATOR.DATA | quote }}
    bindpass=-
    insecure_tls=false
    starttls=false
  args:
    stdin: "{{ LDAP.BIND_CREDENTIAL }}"
    stdin_add_newline: false
  changed_when: false
  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"