---
- name: "Test block"
  vars:
    is_default_path: "{{ this_path == default_path }}"
  module_defaults:
    vault_test_auth:
      url: "{{ vault_test_server_https }}"
      ca_cert: "{{ vault_cert_file }}"
      auth_method: "{{ ansible_hashi_vault_auth_method }}"
      mount_point: "{{ omit if is_default_path else this_path }}"
      cert_auth_public_key: "{{ auth_cert_cert }}"
      cert_auth_private_key: "{{ auth_cert_key }}"
  block:
    # the purpose of this test is to catch when the plugin accepts mount_point but does not pass it into hvac
    # we set the policy of the default mount to deny access to this secret and so we expect failure when the mount
    # is default, and success when the mount is alternate
    - name: Check auth mount differing result
      vault_test_auth:
      register: response

    - assert:
        fail_msg: "A token from mount path '{{ this_path }}' had the wrong policy: {{ response.login.auth.policies }}"
        that:
          - ('test-policy' in response.login.auth.policies) | bool == is_default_path
          - ('test-policy' not in response.login.auth.policies) | bool != is_default_path
          - ('alt-policy' in response.login.auth.policies) | bool != is_default_path
          - ('alt-policy' not in response.login.auth.policies) | bool == is_default_path

    - name: Failure expected when erroneous credentials are used
      vault_test_auth:
        cert_auth_public_key: "{{ invalid_auth_cert_cert }}"
        cert_auth_private_key: "{{ invalid_auth_cert_key }}"
        want_exception: true
      register: response

    - assert:
        fail_msg: "An invalid cert somehow did not cause a failure."
        that:
          - response.inner is failed
          - response.msg is search('invalid certificate or no client certificate supplied')
