---
- name: Var block
  vars:
    user_token: '{{ user_token_cmd.result.auth.client_token }}'
    regex_secret_version_is_deleted: "^[0-9]{4}-[0-9]{2}-[0-9]{2}T.*"
    regex_secret_version_not_deleted: "^$"

  module_defaults:
    community.hashi_vault.vault_kv2_delete: &defaults
      url: '{{ vault_test_server_http }}'
      auth_method: token
      token: '{{ user_token }}'
      token_validate: true
      timeout: 5
    vault_ci_kv2_metadata_read: '{{ vault_plugins_module_defaults_common }}'

  block:
    - name: Test default path value
      register: default_path
      community.hashi_vault.vault_kv2_delete:
        path: '{{ vault_kv2_path }}/secret2'
      ignore_errors: true

    - assert:
        that:
          - default_path is failed
          - default_path.msg is search('Permission Denied to path')

    - module_defaults:
        community.hashi_vault.vault_kv2_delete:
          <<: *defaults
          engine_mount_point: '{{ vault_kv2_mount_point }}'
      block:

        - name: Check kv2 existing versions
          register: kv2_result
          vault_ci_kv2_metadata_read:
            path: "{{ vault_kv2_versioned_path }}/secret6"
            mount_point: '{{ vault_kv2_mount_point }}'

        - assert:
            that:
              - "'result' in kv2_result"
              - "'data' in kv2_result['result']"
              - "'versions' in kv2_result['result']['data']"
              - "kv2_result['result']['data']['versions']['1']['deletion_time'] is search(regex_secret_version_not_deleted)"
              - "kv2_result['result']['data']['versions']['2']['deletion_time'] is search(regex_secret_version_not_deleted)"
              - "kv2_result['result']['data']['versions']['3']['deletion_time'] is search(regex_secret_version_not_deleted)"
              - "kv2_result['result']['data']['versions']['4']['deletion_time'] is search(regex_secret_version_not_deleted)"
              - "kv2_result['result']['data']['versions']['5']['deletion_time'] is search(regex_secret_version_not_deleted)"
            fail_msg: 'Test Seed value did not contain expected data.'


        - name: Try kv2 delete latest version in check mode
          register: kv2_result
          community.hashi_vault.vault_kv2_delete:
            path: "{{ vault_kv2_versioned_path }}/secret6"
          check_mode: true

        - assert:
            that:
              - kv2_result is changed
              - kv2_result.data == {}

        - name: Read resultant secret versions
          register: kv2_result
          vault_ci_kv2_metadata_read:
            path: "{{ vault_kv2_versioned_path }}/secret6"
            mount_point: '{{ vault_kv2_mount_point }}'

        - assert:
            that:
              - "'result' in kv2_result"
              - "'data' in kv2_result['result']"
              - "'versions' in kv2_result['result']['data']"
              - "kv2_result['result']['data']['versions']['1']['deletion_time'] is search(regex_secret_version_not_deleted)"
              - "kv2_result['result']['data']['versions']['2']['deletion_time'] is search(regex_secret_version_not_deleted)"
              - "kv2_result['result']['data']['versions']['3']['deletion_time'] is search(regex_secret_version_not_deleted)"
              - "kv2_result['result']['data']['versions']['4']['deletion_time'] is search(regex_secret_version_not_deleted)"
              - "kv2_result['result']['data']['versions']['5']['deletion_time'] is search(regex_secret_version_not_deleted)"
            fail_msg: 'Secret version was deleted while in check mode.'


        - name: Try kv2 delete specific version in check mode
          register: kv2_result
          community.hashi_vault.vault_kv2_delete:
            path: "{{ vault_kv2_versioned_path }}/secret6"
            versions: [1, 3]
          check_mode: true

        - name: Read resultant secret versions
          register: kv2_result
          vault_ci_kv2_metadata_read:
            path: "{{ vault_kv2_versioned_path }}/secret6"
            mount_point: '{{ vault_kv2_mount_point }}'

        - assert:
            that:
              - "'result' in kv2_result"
              - "'data' in kv2_result['result']"
              - "'versions' in kv2_result['result']['data']"
              - "kv2_result['result']['data']['versions']['1']['deletion_time'] is search(regex_secret_version_not_deleted)"
              - "kv2_result['result']['data']['versions']['2']['deletion_time'] is search(regex_secret_version_not_deleted)"
              - "kv2_result['result']['data']['versions']['3']['deletion_time'] is search(regex_secret_version_not_deleted)"
              - "kv2_result['result']['data']['versions']['4']['deletion_time'] is search(regex_secret_version_not_deleted)"
              - "kv2_result['result']['data']['versions']['5']['deletion_time'] is search(regex_secret_version_not_deleted)"
            fail_msg: 'Secret version was deleted while in check mode.'


        - name: Try kv2 delete version 1 and 3
          register: kv2_result
          community.hashi_vault.vault_kv2_delete:
            path: "{{ vault_kv2_versioned_path }}/secret6"
            versions:
              - 1
              - 3

        - name: Read resultant secret versions
          register: kv2_result
          vault_ci_kv2_metadata_read:
            path: "{{ vault_kv2_versioned_path }}/secret6"
            mount_point: '{{ vault_kv2_mount_point }}'

        - assert:
            that:
              - "'result' in kv2_result"
              - "'data' in kv2_result['result']"
              - "'versions' in kv2_result['result']['data']"
              - "kv2_result['result']['data']['versions']['1']['deletion_time'] is search(regex_secret_version_is_deleted)"
              - "kv2_result['result']['data']['versions']['2']['deletion_time'] is search(regex_secret_version_not_deleted)"
              - "kv2_result['result']['data']['versions']['3']['deletion_time'] is search(regex_secret_version_is_deleted)"
              - "kv2_result['result']['data']['versions']['4']['deletion_time'] is search(regex_secret_version_not_deleted)"
              - "kv2_result['result']['data']['versions']['5']['deletion_time'] is search(regex_secret_version_not_deleted)"
            fail_msg: 'Result value did not contain expected data.'


        - name: Try kv2 delete latest version
          register: kv2_result
          community.hashi_vault.vault_kv2_delete:
            path: "{{ vault_kv2_versioned_path }}/secret6"

        - name: Read resultant secret versions
          register: kv2_result
          vault_ci_kv2_metadata_read:
            path: "{{ vault_kv2_versioned_path }}/secret6"
            mount_point: '{{ vault_kv2_mount_point }}'

        - assert:
            that:
              - "'result' in kv2_result"
              - "'data' in kv2_result['result']"
              - "'versions' in kv2_result['result']['data']"
              - "kv2_result['result']['data']['versions']['1']['deletion_time'] is search(regex_secret_version_is_deleted)"
              - "kv2_result['result']['data']['versions']['2']['deletion_time'] is search(regex_secret_version_not_deleted)"
              - "kv2_result['result']['data']['versions']['3']['deletion_time'] is search(regex_secret_version_is_deleted)"
              - "kv2_result['result']['data']['versions']['4']['deletion_time'] is search(regex_secret_version_not_deleted)"
              - "kv2_result['result']['data']['versions']['5']['deletion_time'] is search(regex_secret_version_is_deleted)"
            fail_msg: 'Result value did not contain expected data.'


        - name: Success expected when authorized delete on non-existent path (latest version)
          register: test_nonexistant
          community.hashi_vault.vault_kv2_delete:
            path: "{{ vault_kv2_versioned_path }}/non_existent_secret"


        - name: Success expected when authorized delete on non-existent path (specific version)
          register: test_nonexistant
          community.hashi_vault.vault_kv2_delete:
            path: "{{ vault_kv2_versioned_path }}/non_existent_secret"
            versions:
              - 1


        ### failure tests

        - name: Failure expected when erroneous credentials are used (latest version)
          register: test_wrong_cred
          community.hashi_vault.vault_kv2_delete:
            path: "{{ vault_kv2_versioned_path }}/secret6"
            token: wrong_token
          ignore_errors: true

        - assert:
            that:
              - test_wrong_cred is failed
              - test_wrong_cred.msg is search('Invalid Vault Token')
            fail_msg: "Expected failure but got success or wrong failure message."


        - name: Failure expected when erroneous credentials are used (specific version)
          register: test_wrong_cred
          community.hashi_vault.vault_kv2_delete:
            path: "{{ vault_kv2_versioned_path }}/secret6"
            token: wrong_token
            versions:
              - 1
          ignore_errors: true

        - assert:
            that:
              - test_wrong_cred is failed
              - test_wrong_cred.msg is search('Invalid Vault Token')
            fail_msg: "Expected failure but got success or wrong failure message."


        - name: Failure expected when unauthorized secret is deleted (latest version)
          register: test_unauthorized
          community.hashi_vault.vault_kv2_delete:
            path: "{{ vault_kv2_path }}/secret3"
          ignore_errors: true

        - assert:
            that:
              - test_unauthorized is failed
              - test_unauthorized.msg is search('Permission Denied')
            fail_msg: "Expected failure but got success or wrong failure message."


        - name: Failure expected when unauthorized secret is deleted (specific version)
          register: test_unauthorized
          community.hashi_vault.vault_kv2_delete:
            path: "{{ vault_kv2_path }}/secret3"
            versions:
              - 1
          ignore_errors: true

        - assert:
            that:
              - test_unauthorized is failed
              - test_unauthorized.msg is search('Permission Denied')
            fail_msg: "Expected failure but got success or wrong failure message."
