---
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later

- name: "({{ select_crypto_backend }}) Read publickey 1"
  slurp:
    src: '{{ remote_tmp_dir }}/publickey.pub'
  register: slurp

- name: "({{ select_crypto_backend }}) Validate publickey 1 idempotence and result behavior"
  assert:
    that:
      - publickey is changed
      - publickey_idempotence is not changed
      - publickey.publickey == (slurp.content | b64decode)
      - publickey.publickey == publickey_idempotence.publickey

- name: "({{ select_crypto_backend }}) Validate public key (test - privatekey modulus)"
  shell: '{{ openssl_binary }} rsa -noout -modulus -in {{ remote_tmp_dir }}/privatekey.pem'
  register: privatekey_modulus

- name: "({{ select_crypto_backend }}) Validate public key (test - publickey modulus)"
  shell: '{{ openssl_binary }} rsa -pubin -noout -modulus < {{ remote_tmp_dir }}/publickey.pub'
  register: publickey_modulus

- name: "({{ select_crypto_backend }}) Validate public key (assert)"
  assert:
    that:
      - publickey_modulus.stdout == privatekey_modulus.stdout

- name: "({{ select_crypto_backend }}) Validate public key - OpenSSH format (test - privatekey's publickey)"
  shell: 'ssh-keygen -y -f {{ remote_tmp_dir }}/privatekey.pem'
  register: privatekey_publickey
  when: select_crypto_backend == 'cryptography' and cryptography_version.stdout is version('1.4.0', '>=')

- name: "({{ select_crypto_backend }}) Validate public key - OpenSSH format  (test - publickey)"
  slurp:
    src: '{{ remote_tmp_dir }}/publickey-ssh.pub'
  register: publickey
  when: select_crypto_backend == 'cryptography' and cryptography_version.stdout is version('1.4.0', '>=')

- name: "({{ select_crypto_backend }}) Validate public key - OpenSSH format (assert)"
  assert:
    that:
      - privatekey_publickey.stdout == publickey.content | b64decode
  when: select_crypto_backend == 'cryptography' and cryptography_version.stdout is version('1.4.0', '>=')

- name: "({{ select_crypto_backend }}) Validate public key - OpenSSH format - test idempotence (issue 33256)"
  assert:
    that:
      - publickey_ssh_idempotence is not changed
  when: select_crypto_backend == 'cryptography' and cryptography_version.stdout is version('1.4.0', '>=')

- name: "({{ select_crypto_backend }}) Validate publickey2 (test - Ensure key has been removed)"
  stat:
    path: '{{ remote_tmp_dir }}/publickey2.pub'
  register: publickey2

- name: "({{ select_crypto_backend }}) Validate publickey2 (assert - Ensure key has been removed)"
  assert:
    that:
      - publickey2.stat.exists == False

- name: "({{ select_crypto_backend }}) Validate publickey2 removal behavior"
  assert:
    that:
      - publickey2_absent is changed
      - publickey2_absent_idempotence is not changed
      - publickey2_absent.publickey is none


- name: "({{ select_crypto_backend }}) Validate publickey3 (test - privatekey modulus)"
  shell: '{{ openssl_binary }} rsa -noout -modulus -in {{ remote_tmp_dir }}/privatekey3.pem -passin pass:ansible'
  register: privatekey3_modulus
  when: openssl_version.stdout is version('0.9.8zh', '>=')

- name: "({{ select_crypto_backend }}) Validate publickey3 (test - publickey modulus)"
  shell: '{{ openssl_binary }} rsa -pubin -noout -modulus < {{ remote_tmp_dir }}/publickey3.pub'
  register: publickey3_modulus
  when: openssl_version.stdout is version('0.9.8zh', '>=')

- name: "({{ select_crypto_backend }}) Validate publickey3 (assert)"
  assert:
    that:
      - publickey3_modulus.stdout == privatekey3_modulus.stdout
  when: openssl_version.stdout is version('0.9.8zh', '>=')

- name: "({{ select_crypto_backend }}) Validate publickey3 idempotence (assert)"
  assert:
    that:
      - publickey3_idempotence is not changed

- name: "({{ select_crypto_backend }}) Validate publickey4 (test - privatekey modulus)"
  shell: '{{ openssl_binary }} rsa -noout -modulus -in {{ remote_tmp_dir }}/privatekey.pem'
  register: privatekey4_modulus
  when: openssl_version.stdout is version('0.9.8zh', '>=')

- name: "({{ select_crypto_backend }}) Validate publickey4 (test - publickey modulus)"
  shell: '{{ openssl_binary }} rsa -pubin -noout -modulus < {{ remote_tmp_dir }}/publickey4.pub'
  register: publickey4_modulus
  when: openssl_version.stdout is version('0.9.8zh', '>=')

- name: "({{ select_crypto_backend }}) Validate publickey4 (assert)"
  assert:
    that:
      - publickey4_modulus.stdout == privatekey4_modulus.stdout
  when: openssl_version.stdout is version('0.9.8zh', '>=')

- name: "({{ select_crypto_backend }}) Validate idempotency and backup"
  assert:
    that:
      - privatekey5_1 is changed
      - privatekey5_1.backup_file is undefined
      - privatekey5_2 is not changed
      - privatekey5_2.backup_file is undefined
      - privatekey5_3 is changed
      - privatekey5_3.backup_file is string

- name: "({{ select_crypto_backend }}) Validate public key 5 (test - privatekey's pubkey)"
  command: '{{ openssl_binary }} ec -in {{ remote_tmp_dir }}/privatekey5.pem -pubout'
  register: privatekey5_pubkey

- name: "({{ select_crypto_backend }}) Validate public key 5 (test - publickey pubkey)"
  # Fancy way of writing "cat {{ remote_tmp_dir }}/publickey5.pub"
  command: '{{ openssl_binary }} ec -pubin -in {{ remote_tmp_dir }}/publickey5.pub -pubout'
  register: publickey5_pubkey

- name: "({{ select_crypto_backend }}) Validate public key 5 (assert)"
  assert:
    that:
      - publickey5_pubkey.stdout == privatekey5_pubkey.stdout

- name:
  assert:
    that:
      - passphrase_error_1 is failed
      - "'assphrase' in passphrase_error_1.msg or 'assword' in passphrase_error_1.msg"
      - passphrase_error_2 is failed
      - "'assphrase' in passphrase_error_2.msg or 'assword' in passphrase_error_2.msg or 'serializ' in passphrase_error_2.msg"
      - passphrase_error_3 is failed
      - "'assphrase' in passphrase_error_3.msg or 'assword' in passphrase_error_3.msg or 'serializ' in passphrase_error_3.msg"

- name: "({{ select_crypto_backend }}) Verify that broken key will be regenerated"
  assert:
    that:
      - output_broken is changed

- name: "({{ select_crypto_backend }}) Validate remove"
  assert:
    that:
      - remove_1 is changed
      - remove_2 is not changed
      - remove_1.backup_file is string
      - remove_2.backup_file is undefined
