- name: "Setup block"
  vars:
    is_default_path: "{{ this_path == default_path }}"
  block:
    - name: 'Enable the JWT auth method'
      vault_ci_enable_auth:
        method_type: jwt
        path: '{{ omit if is_default_path else this_path }}'
        config:
          default_lease_ttl: 60m

    - name: 'Configure the JWT auth method'
      vars:
        jwt_public_key: '{{ lookup("file", "jwt_public.pem") }}'
      vault_ci_write:
        path: 'auth/{{ this_path }}/config'
        data:
          # in docs, this is token_policies (changed in Vault 1.2)
          # use 'policies' to support older versions
          policies: "{{ 'test-policy' if is_default_path else 'alt-policy' }},approle-policy"
          jwt_validation_pubkeys: '{{ jwt_public_key }}'

    - name: 'Create a named role'
      vault_ci_write:
        path: 'auth/{{ this_path }}/role/test-role'
        data:
          # in docs, this is token_policies (changed in Vault 1.2)
          # use 'policies' to support older versions
          policies: "{{ 'test-policy' if is_default_path else 'alt-policy' }},approle-policy"
          role_type: jwt
          user_claim: sub
          bound_audiences: test
