---
- name: 🔀 Merge networks definitions
  ansible.builtin.set_fact:
    networks: "{{ defaults_networks | combine(networks | default({}, true), recursive=True) }}"

- name: 🧊 Render the applications SPOT once for the merge block
  applications_carrier: {}

- name: "✅ Sanity check: all group_names must exist in applications"
  ansible.builtin.assert:
    that:
      - group_name in lookup('applications')
    fail_msg: "Group '{{ group_name }}' has no entry in 'applications'"
    success_msg: "Group '{{ group_name }}' is defined in 'applications'"
  loop: "{{ group_names }}"
  loop_control:
    loop_var: group_name
  when: MODE_ASSERT | bool

- name: 🔀 Merge current play applications
  ansible.builtin.set_fact:
    CURRENT_PLAY_APPLICATIONS: "{{ lookup('applications_current_play') }}"
  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"

- name: 🔀 Merge current play domain definitions
  ansible.builtin.set_fact:
    CURRENT_PLAY_DOMAINS: >-
      {{
        lookup('applications')
        | canonical_domains_map(
            DOMAIN_PRIMARY,
            recursive=True,
            roles_base_dir=(lookup('path_absolute', 'roles')),
            seed=(CURRENT_PLAY_APPLICATIONS | dict2items | map(attribute='key') | list)
          )
      }}

- name: 🔧 Set CURRENT_PLAY_REDIRECT_DOMAINS
  ansible.builtin.set_fact:
    CURRENT_PLAY_REDIRECT_DOMAINS: "{{ lookup('current_play_redirect_domains') }}"

- name: 🔧 Set current play all domains incl. www redirect if enabled
  ansible.builtin.set_fact:
    CURRENT_PLAY_DOMAINS_ALL: >-
      {{
        (
          CURRENT_PLAY_DOMAINS
          | combine(
              CURRENT_PLAY_REDIRECT_DOMAINS | default([])
              | items2dict(key_name='source', value_name='source'),
              recursive=True
            )
        )
        | generate_all_domains(WWW_REDIRECT_ENABLED | bool)
      }}

- name: ✅ Assert OIDC resolves lazily (inventory overrides live in OIDC_OVERRIDE)
  ansible.builtin.assert:
    that:
      - OIDC.CLIENT.DISCOVERY_DOCUMENT is defined
    fail_msg: >-
      OIDC does not resolve to the full defaults tree. An inventory most
      likely still defines 'OIDC:' at host level, shadowing the lazy
      group_var — migrate that block to 'OIDC_OVERRIDE:' so the issuer can
      family-align to each consuming role.
    quiet: true
  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"

- name: 🔀 Merge service_provider configuration
  ansible.builtin.set_fact:
    service_provider: "{{ defaults_service_provider | combine(service_provider | default({}, true), recursive=True) }}"

- name: 🧊 Drop the merge-block carrier so later stages re-render
  applications_carrier:
    clear: true