---
- name: Var block
  vars:
    user_token: "{{ user_token_cmd.result.auth.client_token }}"
    expected_role: readonly
  module_defaults:
    community.hashi_vault.vault_database_roles_list: &defaults
      url: "{{ vault_test_server_http }}"
      auth_method: token
      token: "{{ user_token }}"
      token_validate: true
      timeout: 5
  block:
    - name: Test list database dynamic roles (explicit mount - invalid) [check mode]
      register: db_roles_list
      check_mode: true
      ignore_errors: true
      community.hashi_vault.vault_database_roles_list:
        engine_mount_point: NOT REAL

    - name: Check (explicit mount - invalid) [check mode]
      ansible.builtin.assert: &failure_bad_mount
        that:
          - db_roles_list is failed
          - db_roles_list.msg is search('Permission Denied')

    - name: Test list database dynamic roles (explicit mount) [check mode]
      register: db_roles_list
      check_mode: true
      community.hashi_vault.vault_database_roles_list:
        engine_mount_point: database

    - name: Check (explicit mount) [check mode]
      ansible.builtin.assert: &success
        that:
          - db_roles_list is defined
          - "'data' in db_roles_list"
          - "'raw' in db_roles_list"
          - "'keys' in db_roles_list['data']"
          - "'roles' in db_roles_list"
          - db_roles_list.roles == db_roles_list.data['keys']
          - expected_role in db_roles_list.roles

    - name: Test list database dynamic roles (explicit mount)
      register: db_roles_list
      community.hashi_vault.vault_database_roles_list:
        engine_mount_point: database

    - name: Check (explicit mount)
      ansible.builtin.assert: *success

    - name: Test list database dynamic roles (default mount) [check mode]
      register: db_roles_list
      check_mode: true
      community.hashi_vault.vault_database_roles_list:

    - name: Check (default mount) [check mode]
      ansible.builtin.assert: *success

    - name: Test list database dynamic roles (default mount)
      register: db_roles_list
      community.hashi_vault.vault_database_roles_list:

    - name: Check (default mount)
      ansible.builtin.assert: *success
