---
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later

- name: Generate a password protected key
  command: 'ssh-keygen -f {{ remote_tmp_dir }}/password_protected -N {{ passphrase }}'

- name: Modify the password protected key with passphrase
  openssh_keypair:
    path: '{{ remote_tmp_dir }}/password_protected'
    size: 1024
    passphrase: "{{ passphrase }}"
    backend: cryptography
  register: password_protected_output

- name: Check password protected key idempotency
  openssh_keypair:
    path: '{{ remote_tmp_dir }}/password_protected'
    size: 1024
    passphrase: "{{ passphrase }}"
    backend: cryptography
  register: password_protected_idempotency_output

- name: Ensure that ssh-keygen can read keys generated with passphrase
  command: 'ssh-keygen -yf {{ remote_tmp_dir }}/password_protected -P {{ passphrase }}'
  register: password_protected_ssh_keygen_output

- name: Check that password protected key with passphrase was regenerated
  assert:
    that:
      - password_protected_output is changed
      - password_protected_idempotency_output is not changed
      - password_protected_ssh_keygen_output is success

- name: Remove password protected key
  openssh_keypair:
    path: '{{ remote_tmp_dir }}/password_protected'
    backend: cryptography
    state: absent

- name: Generate an unprotected key
  openssh_keypair:
    path: '{{ remote_tmp_dir }}/unprotected'
    backend: cryptography

- name: Modify unprotected key with passphrase
  openssh_keypair:
    path: '{{ remote_tmp_dir }}/unprotected'
    size: 1280
    passphrase: "{{ passphrase }}"
    backend: cryptography
  ignore_errors: true
  register: unprotected_modification_output

- name: Modify unprotected key with passphrase (force)
  openssh_keypair:
    path: '{{ remote_tmp_dir }}/unprotected'
    size: 1280
    passphrase: "{{ passphrase }}"
    force: true
    backend: cryptography
  register: force_unprotected_modification_output

- name: Check that unprotected key was modified
  assert:
    that:
      - unprotected_modification_output is failed
      - force_unprotected_modification_output is changed

- name: Remove unprotected key
  openssh_keypair:
    path: '{{ remote_tmp_dir }}/unprotected'
    backend: cryptography
    state: absent

- name: Generate PEM encoded key with passphrase
  command: 'ssh-keygen -t rsa -b 1280 -f {{ remote_tmp_dir }}/pem_encoded -N {{ passphrase }} -m PEM'

- name: Try to verify a PEM encoded key
  openssh_keypair:
    path: '{{ remote_tmp_dir }}/pem_encoded'
    passphrase: "{{ passphrase }}"
    backend: cryptography
    size: 1280
  register: pem_encoded_output

- name: Check that PEM encoded file is read without errors
  assert:
    that:
      - pem_encoded_output is not changed

- name: Remove PEM encoded key
  openssh_keypair:
    path: '{{ remote_tmp_dir }}/pem_encoded'
    backend: cryptography
    state: absent

- name: Generate a private key with specified format
  openssh_keypair:
    path: '{{ remote_tmp_dir }}/private_key_format'
    private_key_format: pkcs1
    backend: cryptography

- name: Generate a private key with specified format (Idempotent)
  openssh_keypair:
    path: '{{ remote_tmp_dir }}/private_key_format'
    private_key_format: pkcs1
    backend: cryptography
  register: private_key_format_idempotent

- name: Check that private key with specified format is idempotent
  assert:
    that:
      - private_key_format_idempotent is not changed

- name: Change to PKCS8 format
  openssh_keypair:
    path: '{{ remote_tmp_dir }}/private_key_format'
    private_key_format: pkcs8
    backend: cryptography
  register: private_key_format_pkcs8

- name: Check that format change causes regeneration
  assert:
    that:
      - private_key_format_pkcs8 is changed

- name: Change to PKCS8 format (Idempotent)
  openssh_keypair:
    path: '{{ remote_tmp_dir }}/private_key_format'
    private_key_format: pkcs8
    backend: cryptography
  register: private_key_format_pkcs8_idempotent

- name: Check that private key with PKCS8 format is idempotent
  assert:
    that:
      - private_key_format_pkcs8_idempotent is not changed

- name: Change to SSH format
  openssh_keypair:
    path: '{{ remote_tmp_dir }}/private_key_format'
    private_key_format: ssh
    backend: cryptography
  register: private_key_format_ssh

- name: Check that format change causes regeneration
  assert:
    that:
      - private_key_format_ssh is changed

- name: Change to SSH format (Idempotent)
  openssh_keypair:
    path: '{{ remote_tmp_dir }}/private_key_format'
    private_key_format: ssh
    backend: cryptography
  register: private_key_format_ssh_idempotent

- name: Check that private key with SSH format is idempotent
  assert:
    that:
      - private_key_format_ssh_idempotent is not changed

- name: Remove private key with specified format
  openssh_keypair:
    path: '{{ remote_tmp_dir }}/private_key_format'
    backend: cryptography
    state: absent
