---
- name: Var block
  vars:
    ansible_hashi_vault_token_validate: true
    user_token: '{{ user_token_cmd.result.auth.client_token }}'
    kwargs:
      url: '{{ vault_test_server_http }}'
      auth_method: token
      token: '{{ user_token }}'
  block:
    - name: 'Check kv2 secret list'
      vars:
        kv2_secret2: "{{ lookup('community.hashi_vault.vault_list', vault_kv2_api_list_path, **kwargs) }}"
      assert:
        that:
          - "'data' in kv2_secret2"
          - "'keys' in kv2_secret2['data']"
        fail_msg: 'Return value did not contain expected fields.'

    - name: 'Check kv2 mount point list'
      vars:
        kv2_mount_point: "{{ lookup('community.hashi_vault.vault_list', vault_kv2_api_list_mount_point, **kwargs) }}"
      assert:
        that:
          - "'data' in kv2_mount_point"
          - "'keys' in kv2_mount_point['data']"
        fail_msg: 'Return value did not contain expected fields.'

    - name: "Check multiple path list as array"
      vars:
        paths:
          - '{{ vault_kv2_api_list_path }}'
          - '{{ vault_policy_api_list_path }}'
        list_results: "{{ lookup('community.hashi_vault.vault_list', *paths, **kwargs) }}"
      assert:
        that:
          - list_results | type_debug == 'list'
          - item | type_debug == 'dict'
          - "'data' in item"
          - "'keys' in item['data']"
          - item['data']['keys'] | type_debug == 'list'
        fail_msg: 'Return value was not correct type or items do not match.'
      loop: '{{ list_results }}'


    ### failure tests

    - name: 'Failure expected when erroneous credentials are used'
      vars:
        secret_wrong_cred: "{{ lookup('community.hashi_vault.vault_list', vault_kv2_api_list_path, token='wrong_token', url=kwargs.url) }}"
      debug:
        msg: 'Failure is expected ({{ secret_wrong_cred }})'
      register: test_wrong_cred
      ignore_errors: true

    - assert:
        that:
          - test_wrong_cred is failed
          - test_wrong_cred.msg is search('Invalid Vault Token')
        fail_msg: "Expected failure but got success or wrong failure message."

    - name: 'Failure expected when unauthorized path is provided'
      vars:
        secret_unauthorized: "{{ lookup('community.hashi_vault.vault_list', unauthorized_vault_kv2_mount_point, **kwargs) }}"
      debug:
        msg: 'Failure is expected ({{ secret_unauthorized }})'
      register: test_unauthorized
      ignore_errors: true

    - assert:
        that:
          - test_unauthorized is failed
          - test_unauthorized.msg is search('Permission Denied')
        fail_msg: "Expected failure but got success or wrong failure message."

    # When an inexistent mount point is listed, the API returns a 403 error, not 404.
    - name: 'Failure expected when inexistent mount point is listed'
      vars:
        mount_point_inexistent: "{{ lookup('community.hashi_vault.vault_list', vault_kv2_api_list_inexistent_mount_point, **kwargs) }}"
      debug:
        msg: 'Failure is expected ({{ mount_point_inexistent }})'
      register: test_inexistent_mount_point
      ignore_errors: true

    - assert:
        that:
          - test_inexistent_mount_point is failed
          - test_inexistent_mount_point.msg is search("Permission Denied")
        fail_msg: "Expected failure but got success or wrong failure message."

    - name: 'Failure expected when inexistent path is listed'
      vars:
        path_inexistent: "{{ lookup('community.hashi_vault.vault_list', vault_kv2_api_list_inexistent_path, **kwargs) }}"
      debug:
        msg: 'Failure is expected ({{ path_inexistent }})'
      register: test_inexistent
      ignore_errors: true

    - assert:
        that:
          - test_inexistent is failed
          - test_inexistent.msg is search("doesn't seem to exist")
        fail_msg: "Expected failure but got success or wrong failure message."

    # If an inexistent path is included in a policy statement that denies access, the list API returns a 403 error.
    - name: 'Failure expected when inexistent path is listed but is explicitly mentioned in a policy statement'
      vars:
        path_inexistent_unauthorized: "{{ lookup('community.hashi_vault.vault_list', vault_kv2_api_list_inexistent_unauthorized_path, **kwargs) }}"
      debug:
        msg: 'Failure is expected ({{ path_inexistent_unauthorized }})'
      register: test_inexistent_unauthorized
      ignore_errors: true

    - assert:
        that:
          - test_inexistent_unauthorized is failed
          - test_inexistent_unauthorized.msg is search("Permission Denied")
        fail_msg: "Expected failure but got success or wrong failure message."

    # do this last so our set_fact doesn't affect any other tests
    - name: Set the vars that will configure the lookup settings we can't set via with_
      set_fact:
        ansible_hashi_vault_url: '{{ kwargs.url }}'
        ansible_hashi_vault_token: '{{ kwargs.token }}'
        ansible_hashi_vault_auth_method: '{{ kwargs.auth_method }}'

    - name: Check multiple path list via with_
      assert:
        that:
          - item | type_debug == 'dict'
          - "'data' in item"
          - "'keys' in item['data']"
          - item['data']['keys'] | type_debug == 'list'
        fail_msg: 'Return value was not correct type or items do not match.'
      with_community.hashi_vault.vault_list:
        - '{{ vault_kv2_api_list_path }}'
        - '{{ vault_policy_api_list_path }}'
