---
- name: Var block
  vars:
    user_token: '{{ user_token_cmd.result.auth.client_token }}'
  module_defaults:
    community.hashi_vault.vault_list:
      url: '{{ vault_test_server_http }}'
      auth_method: token
      token: '{{ user_token }}'
      token_validate: true
      timeout: 5
  block:
    - name: 'Check kv2 secret list'
      register: kv2_path
      community.hashi_vault.vault_list:
        path: "{{ vault_kv2_api_list_path }}"

    - assert:
        that:
          - "'data' in kv2_path"
          - "'data' in kv2_path['data']"
          - "'keys' in kv2_path['data']['data']"
        fail_msg: 'Return value did not contain expected fields.'

    - name: 'Check kv2 mount point list'
      register: kv2_mount_point
      community.hashi_vault.vault_list:
        path: "{{ vault_kv2_api_list_mount_point }}"

    - assert:
        that:
          - "'data' in kv2_mount_point"
          - "'data' in kv2_mount_point['data']"
          - "'keys' in kv2_mount_point['data']['data']"
        fail_msg: 'Return value did not contain expected fields.'

    ### failure tests

    - name: 'Failure expected when erroneous credentials are used'
      register: test_wrong_cred
      community.hashi_vault.vault_list:
        path: "{{ vault_kv2_api_list_path }}"
        token: wrong_token
      ignore_errors: true

    - assert:
        that:
          - test_wrong_cred is failed
          - test_wrong_cred.msg is search('Invalid Vault Token')
        fail_msg: "Expected failure but got success or wrong failure message."

    - name: 'Failure expected when unauthorized path is listed'
      register: test_unauthorized
      community.hashi_vault.vault_list:
        path: "{{ unauthorized_vault_kv2_mount_point }}"
      ignore_errors: true

    - assert:
        that:
          - test_unauthorized is failed
          - test_unauthorized.msg is search('Permission Denied')
        fail_msg: "Expected failure but got success or wrong failure message."

    # When an inexistent mount point is listed, the API returns a 403 error, not 404.
    - name: 'Failure expected when inexistent mount point is listed'
      register: test_inexistent_mount_point
      community.hashi_vault.vault_list:
        path: "{{ vault_kv2_api_list_inexistent_mount_point }}"
      ignore_errors: true

    - assert:
        that:
          - test_inexistent_mount_point is failed
          - test_inexistent_mount_point.msg is search("Permission Denied")
        fail_msg: "Expected failure but got success or wrong failure message."

    - name: 'Failure expected when inexistent path is listed'
      register: test_inexistent
      community.hashi_vault.vault_list:
        path: "{{ vault_kv2_api_list_inexistent_path }}"
      ignore_errors: true

    - assert:
        that:
          - test_inexistent is failed
          - test_inexistent.msg is search("doesn't seem to exist")
        fail_msg: "Expected failure but got success or wrong failure message."

    # If an inexistent path is included in a policy statement that denies access, the list API returns a 403 error.
    - name: 'Failure expected when inexistent path is listed but is explicitly mentioned in a policy statement'
      register: test_inexistent_unauthorized
      community.hashi_vault.vault_list:
        path: "{{ vault_kv2_api_list_inexistent_unauthorized_path }}"
      ignore_errors: true

    - assert:
        that:
          - test_inexistent_unauthorized is failed
          - test_inexistent_unauthorized.msg is search("Permission Denied")
        fail_msg: "Expected failure but got success or wrong failure message."
