---
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later

####################################################################
# WARNING: These are designed specifically for Ansible tests       #
# and should not be used as examples of how to write Ansible roles #
####################################################################

- name: "({{ backend }}) Generate key (check mode)"
  openssh_keypair:
    path: "{{ remote_tmp_dir }}/core"
    size: 1280
    backend: "{{ backend }}"
  register: check_core_output
  check_mode: true

- name: "({{ backend }}) Generate key"
  openssh_keypair:
    path: "{{ remote_tmp_dir }}/core"
    size: 1280
    backend: "{{ backend }}"
  register: core_output

- name: "({{ backend }}) Generate key (check mode idempotent)"
  openssh_keypair:
    path: "{{ remote_tmp_dir }}/core"
    size: 1280
    backend: "{{ backend }}"
  register: idempotency_check_core_output
  check_mode: true

- name: "({{ backend }}) Generate key (idempotent)"
  openssh_keypair:
    path: '{{ remote_tmp_dir }}/core'
    size: 1280
    backend: "{{ backend }}"
  register: idempotency_core_output

- name: "({{ backend }}) Log key return values"
  debug:
    msg: "{{ core_output }}"

- name: "({{ backend }}) Assert core behavior"
  assert:
    that:
      - check_core_output is changed
      - core_output is changed
      - idempotency_check_core_output is not changed
      - idempotency_check_core_output.public_key.startswith('ssh-rsa')
      - idempotency_core_output is not changed

- name: "({{ backend }}) Assert key returns fingerprint"
  assert:
    that:
      - core_output['fingerprint'] is string
      - core_output['fingerprint'].startswith('SHA256:')
  # SHA256 was made the default hashing algorithm for fingerprints in OpenSSH 6.8
  when: not (backend == 'opensshbin' and openssh_version is version('6.8', '<'))

- name: "({{ backend }}) Assert key returns public_key"
  assert:
    that:
      - core_output['public_key'] is string
      - core_output['public_key'].startswith('ssh-rsa ')

- name: "({{ backend }}) Assert key returns size value"
  assert:
    that:
      - core_output['size']|type_debug == 'int'
      - core_output['size'] == 1280

- name: "({{ backend }}) Assert key returns key type"
  assert:
    that:
      - core_output['type'] is string
      - core_output['type'] == 'rsa'

- name: "({{ backend }}) Retrieve key size from 'ssh-keygen'"
  shell: "ssh-keygen -lf {{ remote_tmp_dir }}/core | grep -o -E '^[0-9]+'"
  register: core_size_ssh_keygen

- name: "({{ backend }}) Assert key size matches 'ssh-keygen' output"
  assert:
    that:
      - core_size_ssh_keygen.stdout == '1280'

- name: "({{ backend }}) Read core.pub"
  slurp:
    src: '{{ remote_tmp_dir }}/core.pub'
  register: slurp

- name: "({{ backend }}) Assert public key module return equal to the public key content"
  assert:
    that:
      - "core_output.public_key == (slurp.content | b64decode).strip('\n ')"

- name: "({{ backend }}) Remove key"
  openssh_keypair:
    path: '{{ remote_tmp_dir }}/core'
    backend: "{{ backend }}"
    state: absent
