---
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later

- name: Create with keyfile1
  luks_device:
    device: "{{ cryptfile_device }}"
    state: closed
    keyfile: "{{ remote_tmp_dir }}/keyfile1"
    pbkdf:
      iteration_time: 0.1
  become: true

# Access: keyfile1

- name: Try to open with keyfile1
  luks_device:
    device: "{{ cryptfile_device }}"
    state: opened
    keyfile: "{{ remote_tmp_dir }}/keyfile1"
  become: true
  ignore_errors: true
  register: open_try
- assert:
    that:
    - open_try is not failed
- name: Close
  luks_device:
    device: "{{ cryptfile_device }}"
    state: closed
  become: true

- name: Try to open with keyfile2
  luks_device:
    device: "{{ cryptfile_device }}"
    state: opened
    keyfile: "{{ remote_tmp_dir }}/keyfile2"
  become: true
  ignore_errors: true
  register: open_try
- assert:
    that:
    - open_try is failed

- name: Give access to keyfile2
  luks_device:
    device: "{{ cryptfile_device }}"
    state: closed
    keyfile: "{{ remote_tmp_dir }}/keyfile1"
    new_keyfile: "{{ remote_tmp_dir }}/keyfile2"
    pbkdf:
      iteration_time: 0.1
  become: true
  register: result_1

- name: Give access to keyfile2 (idempotent)
  luks_device:
    device: "{{ cryptfile_device }}"
    state: closed
    keyfile: "{{ remote_tmp_dir }}/keyfile1"
    new_keyfile: "{{ remote_tmp_dir }}/keyfile2"
  become: true
  register: result_2

- assert:
    that:
      - result_1 is changed
      - result_2 is not changed

# Access: keyfile1 and keyfile2

- name: Try to open with keyfile2
  luks_device:
    device: "{{ cryptfile_device }}"
    state: opened
    keyfile: "{{ remote_tmp_dir }}/keyfile2"
  become: true
  ignore_errors: true
  register: open_try
- assert:
    that:
    - open_try is not failed
- name: Close
  luks_device:
    device: "{{ cryptfile_device }}"
    state: closed
  become: true

- name: Dump LUKS header
  command: "cryptsetup luksDump {{ cryptfile_device }}"
  become: true

- name: Remove access from keyfile1
  luks_device:
    device: "{{ cryptfile_device }}"
    state: closed
    keyfile: "{{ remote_tmp_dir }}/keyfile1"
    remove_keyfile: "{{ remote_tmp_dir }}/keyfile1"
  become: true
  register: result_1

- name: Remove access from keyfile1 (idempotent)
  luks_device:
    device: "{{ cryptfile_device }}"
    state: closed
    keyfile: "{{ remote_tmp_dir }}/keyfile1"
    remove_keyfile: "{{ remote_tmp_dir }}/keyfile1"
  become: true
  register: result_2

- assert:
    that:
      - result_1 is changed
      - result_2 is not changed

# Access: keyfile2

- name: Try to open with keyfile1
  luks_device:
    device: "{{ cryptfile_device }}"
    state: opened
    keyfile: "{{ remote_tmp_dir }}/keyfile1"
  become: true
  ignore_errors: true
  register: open_try
- assert:
    that:
    - open_try is failed

- name: Try to open with keyfile2
  luks_device:
    device: "{{ cryptfile_device }}"
    state: opened
    keyfile: "{{ remote_tmp_dir }}/keyfile2"
  become: true
  ignore_errors: true
  register: open_try
- assert:
    that:
    - open_try is not failed
- name: Close
  luks_device:
    device: "{{ cryptfile_device }}"
    state: closed
  become: true

- name: Dump LUKS header
  command: "cryptsetup luksDump {{ cryptfile_device }}"
  become: true

- name: Remove access from keyfile2
  luks_device:
    device: "{{ cryptfile_device }}"
    state: closed
    keyfile: "{{ remote_tmp_dir }}/keyfile2"
    remove_keyfile: "{{ remote_tmp_dir }}/keyfile2"
  become: true
  ignore_errors: true
  register: remove_last_key
- assert:
    that:
    - remove_last_key is failed
    - "'force_remove_last_key' in remove_last_key.msg"

# Access: keyfile2

- name: Try to open with keyfile2
  luks_device:
    device: "{{ cryptfile_device }}"
    state: opened
    keyfile: "{{ remote_tmp_dir }}/keyfile2"
  become: true
  ignore_errors: true
  register: open_try
- assert:
    that:
    - open_try is not failed
- name: Close
  luks_device:
    device: "{{ cryptfile_device }}"
    state: closed
  become: true

- name: Remove access from keyfile2
  luks_device:
    device: "{{ cryptfile_device }}"
    state: closed
    keyfile: "{{ remote_tmp_dir }}/keyfile2"
    remove_keyfile: "{{ remote_tmp_dir }}/keyfile2"
    force_remove_last_key: true
  become: true

# Access: none

- name: Try to open with keyfile2
  luks_device:
    device: "{{ cryptfile_device }}"
    state: opened
    keyfile: "{{ remote_tmp_dir }}/keyfile2"
  become: true
  ignore_errors: true
  register: open_try
- assert:
    that:
    - open_try is failed
