- name: "Test block"
  vars:
    is_default_path: "{{ this_path == default_path }}"
    kwargs_mount: "{{ {} if is_default_path else {'mount_point': this_path} }}"
    kwargs_common:
      username: '{{ userpass_username }}'
    kwargs: "{{ kwargs_common | combine(kwargs_mount) }}"
  block:
    # the purpose of this test is to catch when the plugin accepts mount_point but does not pass it into hvac
    # we set the policy of the default mount to deny access to this secret and so we expect failure when the mount
    # is default, and success when the mount is alternate
    - name: Check auth mount differing result
      set_fact:
        response: "{{ lookup('vault_test_auth', password=userpass_password, **kwargs) }}"

    - assert:
        fail_msg: "A token from mount path '{{ this_path }}' had the wrong policy: {{ response.login.auth.policies }}"
        that:
          - ('test-policy' in response.login.auth.policies) | bool == is_default_path
          - ('test-policy' not in response.login.auth.policies) | bool != is_default_path
          - ('alt-policy' in response.login.auth.policies) | bool != is_default_path
          - ('alt-policy' not in response.login.auth.policies) | bool == is_default_path

    - name: Failure expected when erroneous credentials are used
      set_fact:
        response: "{{ lookup('vault_test_auth', password='fake', want_exception=true, **kwargs) }}"

    - assert:
        fail_msg: "An invalid password somehow did not cause a failure."
        that:
          - response is failed
          - response.msg is search('invalid username or password')
