---
- name: Var block
  vars:
    user_token: "{{ user_token_cmd.result.auth.client_token }}"
  module_defaults:
    community.hashi_vault.vault_database_static_role_get_credentials: &defaults
      url: "{{ vault_test_server_http }}"
      auth_method: token
      token: "{{ user_token }}"
      token_validate: true
      timeout: 5
  block:
    - name: Test database get credentials of static role (explicit mount - invalid, role_name) [check mode]
      register: db_static_role
      check_mode: true
      ignore_errors: true
      community.hashi_vault.vault_database_static_role_get_credentials:
        engine_mount_point: NOT REAL
        role_name: role1

    - name: Check (explicit mount - invalid, role_name) [check_mode]
      ansible.builtin.assert: &failure_bad_mount
        that:
          - db_static_role is failed
          - db_static_role.msg is search('Permission Denied')

    - name: Test database get credentials of static role (explicit mount, role_name - invalid) [check mode]
      register: db_static_role
      check_mode: true
      ignore_errors: true
      community.hashi_vault.vault_database_static_role_get_credentials:
        engine_mount_point: database
        role_name: NOT REAL

    - name: Check (explicit mount, role_name - invalid) [check_mode]
      ansible.builtin.assert: &failure_invalid_path
        that:
          - db_static_role is failed
          - db_static_role.msg is search('Invalid or missing path')

    - name: Test database get credentials of static role (explicit mount, role_name) [check mode]
      register: db_static_role
      check_mode: true
      community.hashi_vault.vault_database_static_role_get_credentials:
        engine_mount_point: database
        role_name: role1

    - name: Check (explicit mount, role_name) [check_mode]
      ansible.builtin.assert: &success
        that:
          - db_static_role is defined
          - "'data' in db_static_role"
          - "'password' in db_static_role['data']"
          - "'rotation_period' in db_static_role['data']"
          - "'ttl' in db_static_role['data']"
          - "'last_vault_rotation' in db_static_role['data']"
          - "'raw' in db_static_role"

    - name: Test database get credentials of static role (explicit mount - invalid, role_name)
      register: db_static_role
      ignore_errors: true
      community.hashi_vault.vault_database_static_role_get_credentials:
        engine_mount_point: NOT REAL
        role_name: role1

    - name: Check (explicit mount - invalid, role_name)
      ansible.builtin.assert: *failure_bad_mount

    - name: Test database get credentials of static role (explicit mount, role_name - invalid)
      register: db_static_role
      ignore_errors: true
      community.hashi_vault.vault_database_static_role_get_credentials:
        engine_mount_point: database
        role_name: NOT REAL

    - name: Check (explicit mount, role_name - invalid)
      ansible.builtin.assert: *failure_invalid_path

    - name: Test database get credentials of static role (explicit mount, role_name)
      register: db_static_role
      community.hashi_vault.vault_database_static_role_get_credentials:
        engine_mount_point: database
        role_name: role1

    - name: Check (explicit mount, role_name)
      ansible.builtin.assert: *success

    - name: Test database get credentials of static role (default mount, role_name - invalid) [check mode]
      register: db_static_role
      check_mode: true
      ignore_errors: true
      community.hashi_vault.vault_database_static_role_get_credentials:
        role_name: NOT REAL

    - name: Check (default mount, role_name - invalid) [check mode]
      ansible.builtin.assert: *failure_invalid_path

    - name: Test database get credentials of static role (default mount, role_name - invalid)
      register: db_static_role
      ignore_errors: true
      community.hashi_vault.vault_database_static_role_get_credentials:
        role_name: NOT REAL

    - name: Check (default mount, role_name - invalid)
      ansible.builtin.assert: *failure_invalid_path

    - name: Test database get credentials of static role (default mount, role_name)
      register: db_static_role
      ignore_errors: true
      community.hashi_vault.vault_database_static_role_get_credentials:
        role_name: role1

    - name: Check (default mount, role_name)
      ansible.builtin.assert: *success
