---
- name: Var block
  vars:
    user_token: '{{ user_token_cmd.result.auth.client_token }}'
  module_defaults:
    community.hashi_vault.vault_kv2_get: &defaults
      url: '{{ vault_test_server_http }}'
      auth_method: token
      token: '{{ user_token }}'
      token_validate: true
      timeout: 5
  block:
    - name: Test defualt path value
      register: default_path
      community.hashi_vault.vault_kv2_get:
        path: '{{ vault_kv2_path }}/secret2'
      ignore_errors: true

    - assert:
        that:
          - default_path is failed
          - default_path.msg is search('Permission Denied to path')

    - module_defaults:
        community.hashi_vault.vault_kv2_get:
          <<: *defaults
          engine_mount_point: '{{ vault_kv2_mount_point }}'
      block:
        - name: Check kv2 get
          register: kv2_result
          community.hashi_vault.vault_kv2_get:
            path: "{{ vault_kv2_path }}/secret2"

        - assert:
            that: &assert_basics
              - "'raw' in kv2_result"
              - "'data' in kv2_result"
              - "'metadata' in kv2_result"
              - "'secret' in kv2_result"
              - "'data' in kv2_result['raw']"
              - kv2_result['data'] == kv2_result['raw']['data']
              - kv2_result['secret'] == kv2_result['data']['data']
              - kv2_result['metadata'] == kv2_result['data']['metadata']
            fail_msg: 'Return value did not contain expected fields.'

        - name: Check kv2 get (check mode)
          register: kv2_result
          community.hashi_vault.vault_kv2_get:
            path: "{{ vault_kv2_path }}/secret2"
          check_mode: true

        - assert:
            that: *assert_basics

        - name: Check kv2 versioned (latest)
          register: kv2_result
          community.hashi_vault.vault_kv2_get:
            path: "{{ vault_kv2_versioned_path }}/twover"

        - assert:
            that: *assert_basics

        - name: Check version-specific expected values (latest)
          vars: &expected_ver2
            expected:
              version: 2
              a: two
              v: 2
          assert:
            that: &assert_expected
              - kv2_result.metadata.version == expected.version
              - kv2_result.secret.a == expected.a
              - kv2_result.secret.v == expected.v

        - name: Check kv2 versioned (2)
          register: kv2_result
          community.hashi_vault.vault_kv2_get:
            path: "{{ vault_kv2_versioned_path }}/twover"
            version: 2

        - assert:
            that: *assert_basics

        - name: Check version-specific expected values (2)
          vars: *expected_ver2
          assert:
            that: *assert_expected

        - name: Check kv2 versioned (1)
          register: kv2_result
          community.hashi_vault.vault_kv2_get:
            path: "{{ vault_kv2_versioned_path }}/twover"
            version: 1

        - assert:
            that: *assert_basics

        - name: Check version-specific expected values (1)
          vars:
            expected:
              version: 1
              a: one
              v: 1
          assert:
            that: *assert_expected

        ### failure tests

        - name: Failure expected when erroneous credentials are used
          register: test_wrong_cred
          community.hashi_vault.vault_kv2_get:
            path: "{{ vault_kv2_path }}/secret2"
            token: wrong_token
          ignore_errors: true

        - assert:
            that:
              - test_wrong_cred is failed
              - test_wrong_cred.msg is search('Invalid Vault Token')
            fail_msg: "Expected failure but got success or wrong failure message."

        - name: Failure expected when unauthorized secret is read
          register: test_unauthorized
          community.hashi_vault.vault_kv2_get:
            path: "{{ vault_kv2_path }}/secret3"
          ignore_errors: true

        - assert:
            that:
              - test_unauthorized is failed
              - test_unauthorized.msg is search('Permission Denied')
            fail_msg: "Expected failure but got success or wrong failure message."

        - name: Failure expected when inexistent secret is read
          register: test_inexistent
          community.hashi_vault.vault_kv2_get:
            path: "{{ vault_kv2_path }}/non_existent_secret"
          ignore_errors: true

        - assert:
            that:
              - test_inexistent is failed
              - test_inexistent.msg is search("missing path")
            fail_msg: "Expected failure but got success or wrong failure message."

        - name: Failure expected when reading invalid version
          register: test_no_ver
          community.hashi_vault.vault_kv2_get:
            path: '{{ vault_kv2_versioned_path }}/twover'
            version: 3
          ignore_errors: true

        - assert:
            that:
              - test_no_ver is failed
              - test_no_ver.msg is search("Invalid or missing path \\['[^']+'\\] with secret version '3'. Check the path or secret version")
