---
- name: Var block
  vars:
    ansible_hashi_vault_token_validate: true
    user_token: '{{ user_token_cmd.result.auth.client_token }}'
    kwargs:
      url: '{{ vault_test_server_http }}'
      auth_method: token
      token: '{{ user_token }}'
      engine_mount_point: '{{ vault_kv1_mount_point }}'
  block:
    - name: Check kv1 secret read
      vars:
        kv1_secret2: "{{ lookup('community.hashi_vault.vault_kv1_get', vault_kv1_path ~ '/secret2', **kwargs) }}"
      assert:
        that:
          - "'raw' in kv1_secret2"
          - "'data' in kv1_secret2"
          - "'metadata' in kv1_secret2"
          - "'secret' in kv1_secret2"
          - "'data' in kv1_secret2['raw']"
          - kv1_secret2['data'] == kv1_secret2['raw']['data']
          - kv1_secret2['secret'] == kv1_secret2['data']
          - kv1_secret2['metadata'] | combine({'data':kv1_secret2['data']}) == kv1_secret2['raw']
        fail_msg: 'Return value did not contain expected fields.'

    - name: Check multiple path read as array
      vars:
        paths:
          - '{{ vault_kv1_path }}/secret2'
          - '{{ vault_kv1_path }}/secret1'
        kv1_secrets: "{{ lookup('community.hashi_vault.vault_kv1_get', *paths, **kwargs) }}"
      assert:
        that:
          - kv1_secrets | type_debug == 'list'
          - item | type_debug == 'dict'
          - "'raw' in item"
          - "'data' in item"
          - "'metadata' in item"
          - "'secret' in item"
          - "'data' in item['raw']"
          - item['data'] == item['raw']['data']
          - item['secret'] == item['data']
          - item['metadata'] | combine({'data':item['data']}) == item['raw']
        fail_msg: 'Return value was not correct type or items do not match.'
      loop: '{{ kv1_secrets }}'


    ### failure tests

    - name: Test defualt path value
      vars:
        default_path_access: "{{ lookup('community.hashi_vault.vault_kv1_get', vault_kv1_path ~ '/secret2', url=kwargs.url, token=kwargs.token) }}"
      debug:
        msg: 'Failure is expected ({{ default_path_access }})'
      register: default_path
      ignore_errors: true

    - assert:
        that:
          - default_path is failed
          - default_path.msg is search('Permission Denied to path')

    - name: Failure expected when erroneous credentials are used
      vars:
        secret_wrong_cred: "{{ lookup('community.hashi_vault.vault_kv1_get', vault_kv1_path ~ '/secret2', token='wrong_token', url=kwargs.url) }}"
      debug:
        msg: 'Failure is expected ({{ secret_wrong_cred }})'
      register: test_wrong_cred
      ignore_errors: true

    - assert:
        that:
          - test_wrong_cred is failed
          - test_wrong_cred.msg is search('Invalid Vault Token')
        fail_msg: "Expected failure but got success or wrong failure message."

    - name: Failure expected when unauthorized secret is read
      vars:
        secret_unauthorized: "{{ lookup('community.hashi_vault.vault_kv1_get', vault_kv1_path ~ '/secret3', **kwargs) }}"
      debug:
        msg: 'Failure is expected ({{ secret_unauthorized }})'
      register: test_unauthorized
      ignore_errors: true

    - assert:
        that:
          - test_unauthorized is failed
          - test_unauthorized.msg is search('Permission Denied')
        fail_msg: "Expected failure but got success or wrong failure message."

    - name: Failure expected when inexistent secret is read
      vars:
        secret_inexistent: "{{ lookup('community.hashi_vault.vault_kv1_get', vault_kv1_path ~ '/non_existent_secret', **kwargs) }}"
      debug:
        msg: 'Failure is expected ({{ secret_inexistent }})'
      register: test_inexistent
      ignore_errors: true

    - assert:
        that:
          - test_inexistent is failed
          - test_inexistent.msg is search("missing path")
        fail_msg: "Expected failure but got success or wrong failure message."

    - name: Specific failure message expected when trying to read kv2
      vars:
        kv2_read: >-
          {{
            lookup(
              'community.hashi_vault.vault_kv1_get',
              vault_kv2_path ~ '/secret2',
              engine_mount_point=vault_kv2_mount_point,
              url=kwargs.url, token=kwargs.token
            )
          }}
      debug:
        msg: 'Failure is expected ({{ kv2_read }})'
      register: test_kv_mismatch
      ignore_errors: true

    - assert:
        that:
          - test_kv_mismatch is failed
          - test_kv_mismatch.msg is search('If this is a KV version 2 path, use community.hashi_vault.vault_kv2_get')


    # do this last so our set_fact doesn't affect any other tests
    - name: Set the vars that will configure the lookup settings we can't set via with_
      set_fact:
        ansible_hashi_vault_url: '{{ kwargs.url }}'
        ansible_hashi_vault_token: '{{ kwargs.token }}'
        ansible_hashi_vault_auth_method: '{{ kwargs.auth_method }}'
        ansible_hashi_vault_engine_mount_point: '{{ kwargs.engine_mount_point }}'

    - name: Check multiple path read via with_
      assert:
        that:
          - item | type_debug == 'dict'
          - "'raw' in item"
          - "'data' in item"
          - "'metadata' in item"
          - "'secret' in item"
          - "'data' in item['raw']"
          - item['data'] == item['raw']['data']
          - item['secret'] == item['data']
          - item['metadata'] | combine({'data':item['data']}) == item['raw']
        fail_msg: 'Return value was not correct type or items do not match.'
      with_community.hashi_vault.vault_kv1_get:
        - '{{ vault_kv1_path }}/secret2'
        - '{{ vault_kv1_path }}/secret1'
