---
- name: Verify
  hosts: all
  vars:
     keycloak_admin_password: "remembertochangeme"
  tasks:
    - name: Populate service facts
      ansible.builtin.service_facts:

    - name: Check if keycloak service started
      ansible.builtin.assert:
        that:
          - ansible_facts.services["keycloak.service"]["state"] == "running"
          - ansible_facts.services["keycloak.service"]["status"] == "enabled"
        fail_msg: "Service not running"

    - name: Set internal envvar
      ansible.builtin.set_fact:
        hera_home: "{{ lookup('env', 'HERA_HOME') }}"

    - name: Verify openid config
      when:
        - hera_home is defined
        - hera_home | length == 0
      block:
        - name: Fetch openID config # noqa blocked_modules command-instead-of-module
          ansible.builtin.shell: |
            set -o pipefail
            curl -H 'Host: instance' https://localhost:8443/realms/master/.well-known/openid-configuration -k | jq .
          args:
            executable: /bin/bash
          delegate_to: localhost
          register: openid_config
          changed_when: False
        - name: Verify endpoint URLs
          ansible.builtin.assert:
            that:
              - (openid_config.stdout | from_json)["backchannel_authentication_endpoint"] == 'https://instance/realms/master/protocol/openid-connect/ext/ciba/auth'
              - (openid_config.stdout | from_json)['issuer'] == 'https://instance/realms/master'
              - (openid_config.stdout | from_json)['authorization_endpoint'] == 'https://instance/realms/master/protocol/openid-connect/auth'
              - (openid_config.stdout | from_json)['token_endpoint'] == 'https://instance/realms/master/protocol/openid-connect/token'
          delegate_to: localhost

    - name: Check log folder
      ansible.builtin.stat:
        path: /tmp/keycloak
      register: keycloak_log_folder

    - name: Check that keycloak log folder exists and is a link
      ansible.builtin.assert:
        that:
          - keycloak_log_folder.stat.exists
          - not keycloak_log_folder.stat.isdir
          - keycloak_log_folder.stat.islnk
        fail_msg: "Service log symlink not correctly created"

    - name: Check log file
      become: true
      ansible.builtin.stat:
        path: /tmp/keycloak/keycloak.log
      register: keycloak_log_file

    - name: Check if keycloak file exists
      ansible.builtin.assert:
        that:
          - keycloak_log_file.stat.exists
          - not keycloak_log_file.stat.isdir

    - name: Check default log folder
      become: yes
      ansible.builtin.stat:
        path: /var/log/keycloak
      register: keycloak_default_log_folder
      failed_when: false

    - name: Check that default keycloak log folder doesn't exist
      ansible.builtin.assert:
        that:
          - not keycloak_default_log_folder.stat.exists

    - name: Verify vault SPI in logfile
      become: true
      ansible.builtin.shell: |
        set -o pipefail
        zgrep 'Configured KeystoreVaultProviderFactory with the keystore file' /opt/keycloak/keycloak-*/data/log/keycloak.log*zip
      changed_when: false
      failed_when: slurped_log.rc != 0
      register: slurped_log

    - name: Verify token api call
      ansible.builtin.uri:
        url: "https://instance:8443/realms/master/protocol/openid-connect/token"
        method: POST
        body: "client_id=admin-cli&username=admin&password={{ keycloak_admin_password }}&grant_type=password"
        validate_certs: no
      register: keycloak_auth_response
      until: keycloak_auth_response.status == 200
      retries: 2
      delay: 2

    - name: "Get Clients"
      ansible.builtin.uri:
        url: "https://instance:8443/admin/realms/TestRealm/clients"
        headers:
          validate_certs: false
          Authorization: "Bearer {{ keycloak_auth_response.json.access_token }}"
      register: keycloak_clients

    - name: Get client uuid
      ansible.builtin.set_fact:
        keycloak_client_uuid: "{{ ((keycloak_clients.json | selectattr('clientId', '==', 'TestClient')) | first).id }}"

    - name: "Get Client {{ keycloak_client_uuid }}"
      ansible.builtin.uri:
        url: "https://instance:8443/admin/realms/TestRealm/clients/{{ keycloak_client_uuid }}"
        headers:
          validate_certs: false
          Authorization: "Bearer {{ keycloak_auth_response.json.access_token }}"
      register: keycloak_test_client

    - name: "Get Client roles"
      ansible.builtin.uri:
        url: "https://instance:8443/admin/realms/TestRealm/clients/{{ keycloak_client_uuid }}/roles"
        headers:
          validate_certs: false
          Authorization: "Bearer {{ keycloak_auth_response.json.access_token }}"
      register: keycloak_test_client_roles