---
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later

####################################################################
# WARNING: These are designed specifically for Ansible tests       #
# and should not be used as examples of how to write Ansible roles #
####################################################################

- set_fact:
    test_cases:
      - test_name: Generate certificate
        type: user
        signing_key: "{{ signing_key }}"
        public_key: "{{ public_key }}"
        path: "{{ certificate_path }}"
        valid_from: always
        valid_to: forever
        regenerate: never
        changed: true
      - test_name: Regenerate never - same options
        type: user
        signing_key: "{{ signing_key }}"
        public_key: "{{ public_key }}"
        path: "{{ certificate_path }}"
        valid_from: always
        valid_to: forever
        regenerate: never
        changed: false
      - test_name: Regenerate never - different options
        type: user
        signing_key: "{{ signing_key }}"
        public_key: "{{ public_key }}"
        path: "{{ certificate_path }}"
        valid_from: always
        valid_to: forever
        options:
          - clear
        regenerate: never
        changed: false
      - test_name: Regenerate never with force
        force: true
        type: user
        signing_key: "{{ signing_key }}"
        public_key: "{{ public_key }}"
        path: "{{ certificate_path }}"
        valid_from: always
        valid_to: forever
        regenerate: never
        changed: true
      - test_name: Remove certificate
        path: "{{ certificate_path }}"
        state: absent
        changed: true
      - test_name: Regenerate fail - new certificate
        type: user
        signing_key: "{{ signing_key }}"
        public_key: "{{ public_key }}"
        path: "{{ certificate_path }}"
        valid_from: always
        valid_to: forever
        regenerate: fail
        changed: true
      - test_name: Regenerate fail - same options
        type: user
        signing_key: "{{ signing_key }}"
        public_key: "{{ public_key }}"
        path: "{{ certificate_path }}"
        valid_from: always
        valid_to: forever
        regenerate: fail
        changed: false
      - test_name: Regenerate fail - different options
        type: user
        signing_key: "{{ signing_key }}"
        public_key: "{{ public_key }}"
        path: "{{ certificate_path }}"
        valid_from: always
        valid_to: forever
        options:
          - clear
        regenerate: fail
        changed: false
        ignore_errors: true
      - test_name: Regenerate fail with force
        force: true
        type: user
        signing_key: "{{ signing_key }}"
        public_key: "{{ public_key }}"
        path: "{{ certificate_path }}"
        valid_from: always
        valid_to: forever
        regenerate: fail
        changed: true
      - test_name: Regenerate always
        type: user
        signing_key: "{{ signing_key }}"
        public_key: "{{ public_key }}"
        path: "{{ certificate_path }}"
        valid_from: always
        valid_to: forever
        regenerate: always
        changed: true

- name: Execute regenerate tests
  openssh_cert:
    force: "{{ test_case.force | default(omit) }}"
    options: "{{ test_case.options | default(omit) }}"
    path: "{{ test_case.path | default(omit) }}"
    public_key: "{{ test_case.public_key | default(omit) }}"
    principals: "{{ test_case.principals | default(omit) }}"
    regenerate: "{{ test_case.regenerate | default(omit) }}"
    serial_number: "{{ test_case.serial_number | default(omit) }}"
    signing_key: "{{ test_case.signing_key | default(omit) }}"
    state: "{{ test_case.state | default(omit) }}"
    type: "{{ test_case.type | default(omit) }}"
    valid_at: "{{ test_case.valid_at | default(omit) }}"
    valid_from: "{{ test_case.valid_from | default(omit) }}"
    valid_to: "{{ test_case.valid_to | default(omit) }}"
  check_mode: "{{ test_case.check_mode | default(omit) }}"
  ignore_errors: "{{ test_case.ignore_errors | default(omit) }}"
  register: regenerate_tests_output
  loop: "{{ test_cases }}"
  loop_control:
    loop_var: test_case

- name: Assert task statuses
  assert:
    that:
      - result.changed == test_cases[index].changed
  loop: "{{ regenerate_tests_output.results }}"
  loop_control:
    index_var: index
    loop_var: result

- name: Remove certificate
  openssh_cert:
    path: "{{ certificate_path }}"
    state: absent
