---

- vars:
    mysql_parameters: &mysql_params
      login_user: '{{ mysql_user }}'
      login_password: '{{ mysql_password }}'
      login_host: '{{ mysql_host }}'
      login_port: '{{ mysql_primary_port }}'

  block:

    - name: Issue-121 | Setup | Get server certificate
      copy:
        content: "{{ lookup('pipe', \"openssl s_client -starttls mysql -connect {{ mysql_host }}:3307 -showcerts 2>/dev/null </dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p'\") }}"
        dest: /tmp/cert.pem
      delegate_to: localhost

    - name: Issue-121 | Drop mysql user if exists
      mysql_user:
        <<: *mysql_params
        name: '{{ item }}'
        host_all: true
        state: absent
      ignore_errors: true
      loop:
        - "{{ user_name_1 }}"
        - "{{ user_name_2 }}"

    - name: Issue-121 | Create user with REQUIRESSL privilege (expect failure)
      mysql_user:
        <<: *mysql_params
        name: "{{ user_name_1 }}"
        password: "{{ user_password_1 }}"
        priv: '*.*:SELECT,CREATE USER,REQUIRESSL,GRANT'
      register: result
      ignore_errors: true

    - name: Issue-121 | Assert error granting privileges
      assert:
        that:
          - result is failed
          - result.msg is search('Error granting privileges')

    - name: >-
        Issue-121 | Create user with both REQUIRESSL privilege and an incompatible
        tls_requires option
      mysql_user:
        <<: *mysql_params
        name: "{{ user_name_1 }}"
        host: '{{ gateway_addr }}'
        password: "{{ user_password_1 }}"
        priv: '*.*:SELECT,CREATE USER,REQUIRESSL,GRANT'
        tls_requires:
          X509:
      register: result
      ignore_errors: true

    - name: >-
        Issue-121 | Assert error granting privileges with incompatible tls_requires
        option
      assert:
        that:
          - result is failed
          - result.msg is search('Error granting privileges')

    - name: Issue-121 | Teardown | Drop mysql user
      mysql_user:
        <<: *mysql_params
        name: '{{ item }}'
        host_all: true
        state: absent
      with_items:
        - "{{ user_name_1 }}"
        - "{{ user_name_2 }}"