computer-playbook/roles/web-app-stalwart/tasks/06_oidc.yml

---
# Point Stalwart's auth directory at Keycloak. The directory is Internal XOR one
# external directory (no fallback), so SSO switches all interactive auth to OIDC
# and disables password login — see the role README for the full rationale.
# JMAP request bodies live in templates/jmap/*.json.j2.

- name: "📖 List existing Stalwart directories"
  include_tasks: jmap_call.yml
  vars:
    stalwart_jmap_body: "{{ lookup('template', 'jmap/directory/get.json.j2') }}"

- name: "🔍 Resolve existing Keycloak OIDC directory id (if any)"
  ansible.builtin.set_fact:
    stalwart_oidc_dir_id: >-
      {{ (stalwart_jmap.methodResponses[0][1].list
          | selectattr('@type', 'equalto', 'Oidc')
          | selectattr('issuerUrl', 'equalto', OIDC.CLIENT.ISSUER_URL)
          | map(attribute='id') | first) | default('') }}

- name: "📁 Create the Keycloak OIDC authentication directory"
  include_tasks: jmap_call.yml
  vars:
    stalwart_jmap_body: "{{ lookup('template', 'jmap/directory/create_oidc.json.j2') }}"
  when: stalwart_oidc_dir_id | length == 0

- name: "📖 Capture the newly created OIDC directory id"
  ansible.builtin.set_fact:
    stalwart_oidc_dir_id: "{{ stalwart_jmap.methodResponses[0][1].created.kc.id }}"
  when: stalwart_oidc_dir_id | length == 0

- name: "🔧 Accept Keycloak tokens without a Stalwart audience or mail scope"
  include_tasks: jmap_call.yml
  vars:
    stalwart_jmap_body: "{{ lookup('template', 'jmap/directory/token_validation.json.j2') }}"
  when: stalwart_oidc_dir_id | length > 0

- name: "📖 List Stalwart built-in roles"
  include_tasks: jmap_call.yml
  vars:
    stalwart_jmap_body: "{{ lookup('template', 'jmap/role_get.json.j2') }}"

- name: "🔍 Resolve built-in Stalwart role ids by description"
  ansible.builtin.set_fact:
    stalwart_role_user: "{{ stalwart_jmap.methodResponses[0][1].list | selectattr('description', 'equalto', 'User') | map(attribute='id') | first | default('') }}"
    stalwart_role_group: "{{ stalwart_jmap.methodResponses[0][1].list | selectattr('description', 'equalto', 'Group') | map(attribute='id') | first | default('')
      }}"
    stalwart_role_tenant: "{{ stalwart_jmap.methodResponses[0][1].list | selectattr('description', 'equalto', 'Tenant Administrator') | map(attribute='id') | first
      | default('') }}"
    stalwart_role_admin: "{{ stalwart_jmap.methodResponses[0][1].list | selectattr('description', 'equalto', 'System Administrator') | map(attribute='id') | first
      | default('') }}"

- name: "✅ Ensure the built-in Stalwart 'User' role exists (grants mailbox permissions)"
  ansible.builtin.assert:
    that: stalwart_role_user | length > 0
    fail_msg: "Stalwart built-in 'User' role not found; cannot grant IMAP/SMTP mailbox permissions."

- name: "🔧 Assemble default role-id maps for the authentication singleton"
  ansible.builtin.set_fact:
    stalwart_auth_defaults:
      directoryId: "{{ stalwart_oidc_dir_id }}"
      defaultUserRoleIds: "{{ {stalwart_role_user: true} }}"
      defaultGroupRoleIds: "{{ {stalwart_role_group: true} if stalwart_role_group | length > 0 else {stalwart_role_user: true} }}"
      defaultTenantRoleIds: "{{ {stalwart_role_tenant: true} | combine({stalwart_role_user: true}) if stalwart_role_tenant | length > 0 else {stalwart_role_user:
        true} }}"
      defaultAdminRoleIds: "{{ {stalwart_role_admin: true} | combine({stalwart_role_user: true}) if stalwart_role_admin | length > 0 else {stalwart_role_user: true}
        }}"

- name: "📖 Read the Stalwart authentication singleton"
  include_tasks: jmap_call.yml
  vars:
    stalwart_jmap_body: "{{ lookup('template', 'jmap/authentication/get.json.j2') }}"

- name: "🔧 Record whether the authentication singleton exists"
  ansible.builtin.set_fact:
    stalwart_auth_exists: "{{ (stalwart_jmap.methodResponses[0][1].list | length) > 0 }}"

- name: "📁 Create the authentication singleton (OIDC directory + default roles)"
  include_tasks: jmap_call.yml
  vars:
    stalwart_jmap_body: "{{ lookup('template', 'jmap/authentication/create.json.j2') }}"
  when: not (stalwart_auth_exists | bool)

- name: "🔗 Point the authentication singleton at Keycloak + seed default roles"
  include_tasks: jmap_call.yml
  vars:
    stalwart_jmap_body: "{{ lookup('template', 'jmap/authentication/update.json.j2') }}"
  when: stalwart_auth_exists | bool

- name: "📖 Read the RCPT stage singleton"
  include_tasks: jmap_call.yml
  vars:
    stalwart_jmap_body: "{{ lookup('template', 'jmap/rcpt/get.json.j2') }}"

- name: "🔒 Restrict relaying to authenticated sessions"
  include_tasks: jmap_call.yml
  vars:
    stalwart_jmap_body: "{{ lookup('template', 'jmap/rcpt/update.json.j2') }}"
  when: (stalwart_jmap.methodResponses[0][1].list | length) > 0