# roles/web-app-keycloak/tasks/05_ldap.yml
---
- name: "Update REALM settings (merge LDAP component .config)"
  include_tasks: 03_update.yml
  vars:
    kc_object_kind:  "component"
    kc_lookup_value: "{{ KEYCLOAK_LDAP_CMP_NAME }}"
    kc_desired: >-
      {{
        KEYCLOAK_DICTIONARY_REALM.components['org.keycloak.storage.UserStorageProvider']
        | selectattr('providerId','equalto','ldap')
        | list | first
      }}
    kc_merge_path: "config"

# --- Read desired mapper definition from KEYCLOAK_DICTIONARY_REALM ---

- name: Get LDAP component (from KEYCLOAK_DICTIONARY_REALM)
  set_fact:
    ldap_component: >-
      {{
        KEYCLOAK_DICTIONARY_REALM.components['org.keycloak.storage.UserStorageProvider']
        | selectattr('providerId','equalto','ldap')
        | list | first | default({})
      }}

- name: Sanity check LDAP component
  assert:
    that:
      - ldap_component | length > 0
      - (ldap_component.subComponents | default({})) | length > 0
    fail_msg: "LDAP component not found in KEYCLOAK_DICTIONARY_REALM."

- name: Extract desired group-ldap-mapper definition (raw)
  set_fact:
    desired_group_mapper_raw: >-
      {{
        (
          ldap_component.subComponents['org.keycloak.storage.ldap.mappers.LDAPStorageMapper']
          | default([])
        )
        | selectattr('providerId','equalto','group-ldap-mapper')
        | list | first | default({})
      }}

- name: Ensure we found the mapper in the dictionary
  assert:
    that:
      - desired_group_mapper_raw | length > 0
    fail_msg: "group-ldap-mapper not found below LDAP component in KEYCLOAK_DICTIONARY_REALM."

- name: Compute desired mapper name
  set_fact:
    desired_group_mapper_name: "{{ desired_group_mapper_raw.name | default('ldap-roles') }}"

- name: Build clean mapper payload (strip unsupported keys)
  set_fact:
    desired_group_mapper: >-
      {{
        desired_group_mapper_raw
        | dict2items
        | rejectattr('key','equalto','subComponents')
        | rejectattr('key','equalto','id')
        | list | items2dict
      }}

# --- Work against Keycloak ---

- name: Resolve LDAP component id
  shell: >
    {{ KEYCLOAK_EXEC_KCADM }} get components
    -r {{ KEYCLOAK_REALM }}
    --query 'name={{ KEYCLOAK_LDAP_CMP_NAME }}'
    --fields id --format json | jq -r '.[0].id'
  register: ldap_cmp_id
  changed_when: false

- name: Assert LDAP component id resolved
  assert:
    that:
      - (ldap_cmp_id.stdout | trim) not in ["", "null"]
    fail_msg: "LDAP component '{{ KEYCLOAK_LDAP_CMP_NAME }}' not found in Keycloak."

- name: Check for group-ldap-mapper existence (by name under LDAP component)
  shell: >
    {{ KEYCLOAK_EXEC_KCADM }} get components
    -r {{ KEYCLOAK_REALM }}
    --query "parent={{ ldap_cmp_id.stdout | trim }}&type=org.keycloak.storage.ldap.mappers.LDAPStorageMapper&name={{ desired_group_mapper_name }}"
    --format json
    | jq -r '.[] | select(.parentId=="{{ ldap_cmp_id.stdout | trim }}"
           and .providerType=="org.keycloak.storage.ldap.mappers.LDAPStorageMapper"
           and .providerId=="group-ldap-mapper"
           and .name=="{{ desired_group_mapper_name }}") | .id' | head -n1
  register: grp_mapper_id
  changed_when: false

- name: Ensure group-ldap-mapper exists (create if missing)
  when: (grp_mapper_id.stdout | trim) in ["", "null"]
  shell: |
    cat <<'JSON' | {{ KEYCLOAK_EXEC_KCADM }} create components -r {{ KEYCLOAK_REALM }} -f -
    {{
      desired_group_mapper
      | combine({
          'name':        desired_group_mapper_name,
          'parentId':    ldap_cmp_id.stdout | trim,
          'providerType':'org.keycloak.storage.ldap.mappers.LDAPStorageMapper',
          'providerId':  'group-ldap-mapper'
        }, recursive=True)
      | to_json
    }}
    JSON
  register: create_mapper
  changed_when: create_mapper.rc == 0
  failed_when: create_mapper.rc != 0 and ('already exists' not in (create_mapper.stderr | lower))
  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"

- name: Update existing group-ldap-mapper config (merge only .config)
  when: (grp_mapper_id.stdout | trim) not in ["", "null"]
  vars:
    kc_object_kind:  "component"
    kc_lookup_field: "id"
    kc_lookup_value: "{{ grp_mapper_id.stdout | trim }}"
    kc_desired: >-
      {{
        desired_group_mapper
        | combine({
            'name':         desired_group_mapper_name,
            'parentId':     ldap_cmp_id.stdout | trim,
            'providerType': 'org.keycloak.storage.ldap.mappers.LDAPStorageMapper',
            'providerId':   'group-ldap-mapper'
          }, recursive=True)
      }}
    kc_merge_path:   "config"
  include_tasks: 03_update.yml