---
- name: Var block
  vars:
    user_token: "{{ user_token_cmd.result.auth.client_token }}"
    rotation_statements:
      - 'ALTER USER {{ "{{name}}" }} WITH PASSWORD {{ ''{{password}}'' }};'
  module_defaults:
    community.hashi_vault.vault_database_static_role_create: &defaults
      url: "{{ vault_test_server_http }}"
      auth_method: token
      token: "{{ user_token }}"
      token_validate: true
      timeout: 5
  block:
    - name: Test database create static role [check mode]
      register: db_create_static_role
      check_mode: true
      community.hashi_vault.vault_database_static_role_create:
        engine_mount_point: Does Not Matter
        connection_name: Does Not Matter
        rotation_statements:
          - Does Not Matter
        role_name: Does Not Matter
        db_username: Does Not Matter

    - name: Check [check mode]
      ansible.builtin.assert: &success
        that:
          - db_create_static_role is changed

    - name: Test database create static role (explicit mount point - invalid, connection_name, db_username)
      register: db_create_static_role
      ignore_errors: true
      community.hashi_vault.vault_database_static_role_create:
        engine_mount_point: NOT REAL
        connection_name: "{{ vault_database_connection_name }}"
        rotation_statements:
          - "{{ rotation_statements }}"
        db_username: role3
        role_name: role3

    - name: Check (explicit mount point - invalid, connection_name)
      ansible.builtin.assert: &failure_bad_mount
        that:
          - db_create_static_role is failed
          - db_create_static_role.msg is search('Permission Denied')

    - name: Test database create static role  (explicit mount point, connection_name - invalid, db_username)
      register: db_create_static_role
      ignore_errors: true
      community.hashi_vault.vault_database_static_role_create:
        engine_mount_point: database
        connection_name: NOT REAL
        rotation_statements:
          - "{{ rotation_statements }}"
        db_username: role3
        role_name: role3

    # Note that this statement will be successful and a dynamic role will be added, although the connection name is not existing
    - name: Check (explicit mount point, connection_name - invalid)
      ansible.builtin.assert: *success

    - name: Test database create static role  (explicit mount point, connection_name, db_username - invalid)
      register: db_create_static_role
      ignore_errors: true
      community.hashi_vault.vault_database_static_role_create:
        engine_mount_point: database
        connection_name: "{{ vault_database_connection_name }}"
        rotation_statements:
          - "{{ rotation_statements }}"
        db_username: NOT REAL
        role_name: role3

    - name: Check (explicit mount point, connection_name, db_username - invalid)
      ansible.builtin.assert: &failure_invalid_request
        that:
          - db_create_static_role is failed
          - db_create_static_role.msg is search('Cannot update static role')

    - name: Test database create static role (explicit mount point, connection_name, db_username)
      register: db_create_static_role
      community.hashi_vault.vault_database_static_role_create:
        engine_mount_point: database
        connection_name: "{{ vault_database_connection_name }}"
        rotation_statements:
          - "{{ rotation_statements }}"
        db_username: role3
        role_name: role3

    - name: Check (explicit mount point, connection_name, db_username)
      ansible.builtin.assert: *success

    - name: Test database create static role (default mount point, connection_name - invalid, db_username)
      register: db_create_static_role
      ignore_errors: true
      community.hashi_vault.vault_database_static_role_create:
        connection_name: NOT REAL
        rotation_statements:
          - "{{ rotation_statements }}"
        db_username: role3
        role_name: role3

    # Note that this statement will be successful and a dynamic role will be added, although the connection name is not existing
    - name: Check (default mount point, connection_name - invalid, db_username)
      ansible.builtin.assert: *success

    - name: Test database create static role (default mount point, connection_name, db_username - invalid)
      register: db_create_static_role
      ignore_errors: true
      community.hashi_vault.vault_database_static_role_create:
        connection_name: NOT REAL
        rotation_statements:
          - "{{ rotation_statements }}"
        db_username: NOT REAL
        role_name: role3

    - name: Check (default mount point, connection_name, db_username - invalid)
      ansible.builtin.assert: *failure_invalid_request

    - name: Test database create static role (default mount point, connection_name, db_username)
      register: db_create_static_role
      community.hashi_vault.vault_database_static_role_create:
        connection_name: "{{ vault_database_connection_name }}"
        rotation_statements:
          - "{{ rotation_statements }}"
        role_name: role3
        db_username: role3

    - name: Check (default mount point, connection_name, db_username)
      ansible.builtin.assert: *success
