---
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later

- name: Create with passphrase1
  luks_device:
    device: "{{ cryptfile_device }}"
    state: closed
    passphrase: "{{ cryptfile_passphrase1 }}"
    type: luks2
    pbkdf:
      iteration_time: 0.1
      algorithm: argon2i
      memory: 1000
      parallel: 1
    sector_size: 1024
  become: true
  ignore_errors: true
  register: create_passphrase_1

- name: Make sure that the previous task only fails if LUKS2 is not supported
  assert:
    that:
      - "'Unknown option --type' in create_passphrase_1.msg"
  when: create_passphrase_1 is failed

- name: Create with passphrase1 (without argon2i)
  luks_device:
    device: "{{ cryptfile_device }}"
    state: closed
    passphrase: "{{ cryptfile_passphrase1 }}"
    pbkdf:
      iteration_time: 0.1
  become: true
  when: create_passphrase_1 is failed

- name: Open with passphrase1
  luks_device:
    device: "{{ cryptfile_device }}"
    state: opened
    # Encode passphrase with Base64 to test passphrase_encoding
    passphrase: "{{ cryptfile_passphrase1 | b64encode }}"
    passphrase_encoding: base64
  become: true
  ignore_errors: true
  register: open_try
- assert:
    that:
    - open_try is not failed
- name: Close
  luks_device:
    device: "{{ cryptfile_device }}"
    state: closed
  become: true

- name: Give access with ambiguous new_ arguments
  luks_device:
    device: "{{ cryptfile_device }}"
    state: closed
    passphrase: "{{ cryptfile_passphrase1 }}"
    new_passphrase: "{{ cryptfile_passphrase2 }}"
    new_keyfile: "{{ remote_tmp_dir }}/keyfile1"
    pbkdf:
      iteration_time: 0.1
  become: true
  ignore_errors: true
  register: new_try
- assert:
    that:
      - new_try is failed

- name: Try to open with passphrase2
  luks_device:
    device: "{{ cryptfile_device }}"
    state: opened
    passphrase: "{{ cryptfile_passphrase2 }}"
  become: true
  ignore_errors: true
  register: open_try
- assert:
    that:
    - open_try is failed

- name: Give access to passphrase2
  luks_device:
    device: "{{ cryptfile_device }}"
    state: closed
    passphrase: "{{ cryptfile_passphrase1 }}"
    new_passphrase: "{{ cryptfile_passphrase2 }}"
    pbkdf:
      iteration_time: 0.1
  become: true
  register: result_1

- name: Give access to passphrase2 (idempotent)
  luks_device:
    device: "{{ cryptfile_device }}"
    state: closed
    passphrase: "{{ cryptfile_passphrase1 }}"
    new_passphrase: "{{ cryptfile_passphrase2 }}"
  become: true
  register: result_2

- assert:
    that:
      - result_1 is changed
      - result_2 is not changed

- name: Open with passphrase2
  luks_device:
    device: "{{ cryptfile_device }}"
    state: opened
    passphrase: "{{ cryptfile_passphrase2 }}"
  become: true
  ignore_errors: true
  register: open_try
- assert:
    that:
    - open_try is not failed
- name: Close
  luks_device:
    device: "{{ cryptfile_device }}"
    state: closed
  become: true

- name: Try to open with keyfile1
  luks_device:
    device: "{{ cryptfile_device }}"
    state: opened
    keyfile: "{{ remote_tmp_dir }}/keyfile1"
  become: true
  ignore_errors: true
  register: open_try
- assert:
    that:
    - open_try is failed

- name: Give access to keyfile1 from passphrase1
  luks_device:
    device: "{{ cryptfile_device }}"
    state: closed
    passphrase: "{{ cryptfile_passphrase1 }}"
    new_keyfile: "{{ remote_tmp_dir }}/keyfile1"
    pbkdf:
      iteration_time: 0.1
  become: true

- name: Remove access with ambiguous remove_ arguments
  luks_device:
    device: "{{ cryptfile_device }}"
    state: closed
    remove_keyfile: "{{ remote_tmp_dir }}/keyfile1"
    remove_passphrase: "{{ cryptfile_passphrase1 }}"
  become: true
  ignore_errors: true
  register: remove_try
- assert:
    that:
      - remove_try is failed

- name: Open with keyfile1
  luks_device:
    device: "{{ cryptfile_device }}"
    state: opened
    keyfile: "{{ remote_tmp_dir }}/keyfile1"
  become: true
  ignore_errors: true
  register: open_try
- assert:
    that:
    - open_try is not failed
- name: Close
  luks_device:
    device: "{{ cryptfile_device }}"
    state: closed
  become: true

- name: Remove access for passphrase1
  luks_device:
    device: "{{ cryptfile_device }}"
    state: closed
    remove_passphrase: "{{ cryptfile_passphrase1 }}"
  become: true
  register: result_1

- name: Remove access for passphrase1 (idempotent)
  luks_device:
    device: "{{ cryptfile_device }}"
    state: closed
    remove_passphrase: "{{ cryptfile_passphrase1 }}"
  become: true
  register: result_2

- assert:
    that:
      - result_1 is changed
      - result_2 is not changed

- name: Try to open with passphrase1
  luks_device:
    device: "{{ cryptfile_device }}"
    state: opened
    passphrase: "{{ cryptfile_passphrase1 }}"
  become: true
  ignore_errors: true
  register: open_try
- assert:
    that:
    - open_try is failed

- name: Try to open with passphrase3
  luks_device:
    device: "{{ cryptfile_device }}"
    state: opened
    passphrase: "{{ cryptfile_passphrase3 }}"
  become: true
  ignore_errors: true
  register: open_try
- assert:
    that:
    - open_try is failed

- name: Give access to passphrase3 from keyfile1
  luks_device:
    device: "{{ cryptfile_device }}"
    state: closed
    keyfile: "{{ remote_tmp_dir }}/keyfile1"
    new_passphrase: "{{ cryptfile_passphrase3 }}"
    pbkdf:
      iteration_time: 0.1
  become: true

- name: Open with passphrase3
  luks_device:
    device: "{{ cryptfile_device }}"
    state: opened
    passphrase: "{{ cryptfile_passphrase3 }}"
  become: true
  ignore_errors: true
  register: open_try
- assert:
    that:
    - open_try is not failed
- name: Close
  luks_device:
    device: "{{ cryptfile_device }}"
    state: closed
  become: true
