---
# Persist the OIDC mapping for the Pixelfed administrator user. SQL
# bodies live in roles/web-app-pixelfed/files/sql/*.sql and are loaded
# via `query_file:` so the same task shape works whether Pixelfed's DB
# runs in a central `svc-db-*` container or a per-role
# `<entity>-database` container — the database_query module hands the
# query off to whichever the `database` lookup resolves to.

- name: "⏳ Wait until the Pixelfed OIDC mapping table exists"
  database_query:
    config: "{{ lookup('database', application_id) }}"
    query_file: "{{ role_path }}/files/sql/oidc-mapping/select-table.sql"
    named_args:
      db_name: "{{ PIXELFED_DB_NAME }}"
    expect_rows: true
    mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
  register: pixelfed_admin_oidc_table
  changed_when: false
  retries: 60
  delay: 5
  until: pixelfed_admin_oidc_table.rows | length > 0
  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"

- name: "✅ Verify the Pixelfed OIDC mapping table contains the expected columns"
  database_query:
    config: "{{ lookup('database', application_id) }}"
    query_file: "{{ role_path }}/files/sql/oidc-mapping/count-columns.sql"
    named_args:
      db_name: "{{ PIXELFED_DB_NAME }}"
    expect_rows: true
    mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
  register: pixelfed_admin_oidc_columns
  changed_when: false
  failed_when: (pixelfed_admin_oidc_columns.rows[0][0] | int) != 4
  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"

- name: "✅ Ensure the Pixelfed administrator OIDC mapping exists"
  database_query:
    config: "{{ lookup('database', application_id) }}"
    query_file: "{{ role_path }}/files/sql/oidc-mapping/upsert.sql"
    named_args:
      user_id: "{{ pixelfed_admin_id.rows[0][0] | int }}"
      oidc_id: "{{ PIXELFED_ADMIN_OIDC_ID }}"
    expect_rows: true
    mask_values: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
  register: pixelfed_admin_oidc_mapping
  changed_when: (pixelfed_admin_oidc_mapping.rows[-1][0] | int) > 0
  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"