---
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later

- name: Validate CRL 1
  assert:
    that:
      - crl_1_check is changed
      - crl_1 is changed
      - crl_1_idem_check is not changed
      - crl_1_idem is not changed
      - crl_1_idem_content_check is not changed
      - crl_1_idem_content is not changed

- name: Validate CRL 1 info
  assert:
    that:
      - crl_1_info_1.format == 'pem'
      - crl_1_info_1.digest == 'ecdsa-with-SHA256'
      - crl_1_info_1.issuer | length == 1
      - crl_1_info_1.issuer.commonName == 'Ansible'
      - crl_1_info_1.issuer_ordered | length == 1
      - crl_1_info_1.last_update == '20191013000000Z'
      - crl_1_info_1.next_update == '20191113000000Z'
      - crl_1_info_1.revoked_certificates | length == 3
      - crl_1_info_1.revoked_certificates[0].invalidity_date is none
      - crl_1_info_1.revoked_certificates[0].invalidity_date_critical == false
      - crl_1_info_1.revoked_certificates[0].issuer is none
      - crl_1_info_1.revoked_certificates[0].issuer_critical == false
      - crl_1_info_1.revoked_certificates[0].reason is none
      - crl_1_info_1.revoked_certificates[0].reason_critical == false
      - crl_1_info_1.revoked_certificates[0].revocation_date == '20191013000000Z'
      - crl_1_info_1.revoked_certificates[0].serial_number == certificate_infos.results[0].serial_number
      - crl_1_info_1.revoked_certificates[1].invalidity_date == '20191012000000Z'
      - crl_1_info_1.revoked_certificates[1].invalidity_date_critical == false
      - crl_1_info_1.revoked_certificates[1].issuer is none
      - crl_1_info_1.revoked_certificates[1].issuer_critical == false
      - crl_1_info_1.revoked_certificates[1].reason == 'key_compromise'
      - crl_1_info_1.revoked_certificates[1].reason_critical == true
      - crl_1_info_1.revoked_certificates[1].revocation_date == '20191013000000Z'
      - crl_1_info_1.revoked_certificates[1].serial_number == certificate_infos.results[1].serial_number
      - crl_1_info_1.revoked_certificates[2].invalidity_date is none
      - crl_1_info_1.revoked_certificates[2].invalidity_date_critical == false
      - crl_1_info_1.revoked_certificates[2].issuer is none
      - crl_1_info_1.revoked_certificates[2].issuer_critical == false
      - crl_1_info_1.revoked_certificates[2].reason is none
      - crl_1_info_1.revoked_certificates[2].reason_critical == false
      - crl_1_info_1.revoked_certificates[2].revocation_date == '20191001000000Z'
      - crl_1_info_1.revoked_certificates[2].serial_number == 1234
      - crl_1_info_1 == crl_1_info_2
      - crl_1_info_1 == crl_1_info_3

- name: Validate CRL 1
  assert:
    that:
      - crl_1_format_check is changed
      - crl_1_format is changed
      - crl_1_format_idem_check is not changed
      - crl_1_format_idem is not changed
      - crl_1_info_4.format == 'der'
      - crl_1_info_5.format == 'der'

- name: Read ca-crl1.crl
  slurp:
    src: "{{ remote_tmp_dir }}/ca-crl1.crl"
  register: content
- name: Validate CRL 1 Base64 content
  assert:
    that:
      - crl_1_format_idem.crl | b64decode == content.content | b64decode

- name: Validate CRL 2
  assert:
    that:
      - crl_2_check is changed
      - crl_2 is changed
      - crl_2_idem_check is not changed
      - crl_2_idem is not changed
      - crl_2_idem_update_change_check is changed
      - crl_2_idem_update_change is changed
      - crl_2_idem_update_check is not changed
      - crl_2_idem_update is not changed
      - crl_2_change_check is changed
      - crl_2_change is changed
      - crl_2_change.crl == (slurp_crl2_1.content | b64decode)
      - crl_2_change_order_ignore is not changed
      - crl_2_change_order is changed
      - crl_2_change_order.crl == (slurp_crl2_2.content | b64decode)

- name: Validate CRL 2 info
  assert:
    that:
      - "'revoked_certificates' not in crl_2_info_1"
      - >
        crl_2_info_1.issuer_ordered == [
          ['commonName', 'Ansible'],
          ['commonName', 'CRL'],
          ['countryName', 'US'],
          ['commonName', 'Test'],
        ]
      - >
        crl_2_info_2.issuer_ordered == [
          ['commonName', 'Ansible'],
          ['countryName', 'US'],
          ['commonName', 'CRL'],
          ['commonName', 'Test'],
        ]

- name: Validate CRL 3 info
  assert:
    that:
      - crl_3.revoked_certificates == crl_3_info.revoked_certificates
      - crl_3.revoked_certificates[0].issuer == ([
          "DNS:ca.example.org",
          "DNS:ffóò.ḃâŗ.çøṁ",
          "email:foo@ḃâŗ.çøṁ",
          "URI:https://ffóò.ḃâŗ.çøṁ/baz?foo=bar",
          "URI:https://www.straße.de",
          "URI:https://straße.de:8080",
          "URI:http://gefäß.org",
          "URI:http://ä:1",
        ] if cryptography_version.stdout is version('2.1', '<') else [
          "DNS:ca.example.org",
          "DNS:xn--ff-3jad.xn--2ca8uh37e.xn--7ca8a981n",
          "email:foo@xn--2ca8uh37e.xn--7ca8a981n",
          "URI:https://xn--ff-3jad.xn--2ca8uh37e.xn--7ca8a981n/baz?foo=bar",
          "URI:https://www.xn--strae-oqa.de",
          "URI:https://xn--strae-oqa.de:8080",
          "URI:http://xn--gef-7kay.org",
          "URI:http://xn--4ca:1",
        ] if ansible_facts.python.version.minor == 5 else [
          "DNS:ca.example.org",
          "DNS:xn--ff-3jad.xn--2ca8uh37e.xn--7ca8a981n",
          "email:foo@xn--2ca8uh37e.xn--7ca8a981n",
          "URI:https://admin:hunter2@xn--ff-3jad.xn--2ca8uh37e.xn--7ca8a981n/baz?foo=bar",
          "URI:https://goo@www.xn--strae-oqa.de",
          "URI:https://xn--strae-oqa.de:8080",
          "URI:http://xn--gef-7kay.org",
          "URI:http://a:b@xn--4ca:1",
        ])
      - crl_3_idna is not changed
      - crl_3_idna.revoked_certificates == crl_3_info_idna.revoked_certificates
      - crl_3_idna.revoked_certificates[0].issuer == ([
          "DNS:ca.example.org",
          "DNS:xn--ff-3jad.xn--2ca8uh37e.xn--7ca8a981n",
          "email:foo@xn--2ca8uh37e.xn--7ca8a981n",
          "URI:https://xn--ff-3jad.xn--2ca8uh37e.xn--7ca8a981n/baz?foo=bar",
          "URI:https://www.xn--strae-oqa.de",
          "URI:https://xn--strae-oqa.de:8080",
          "URI:http://xn--gef-7kay.org",
          "URI:http://xn--4ca:1",
        ] if cryptography_version.stdout is version('2.1', '<') or ansible_facts.python.version.minor == 5 else [
          "DNS:ca.example.org",
          "DNS:xn--ff-3jad.xn--2ca8uh37e.xn--7ca8a981n",
          "email:foo@xn--2ca8uh37e.xn--7ca8a981n",
          "URI:https://admin:hunter2@xn--ff-3jad.xn--2ca8uh37e.xn--7ca8a981n/baz?foo=bar",
          "URI:https://goo@www.xn--strae-oqa.de",
          "URI:https://xn--strae-oqa.de:8080",
          "URI:http://xn--gef-7kay.org",
          "URI:http://a:b@xn--4ca:1",
        ])
      - crl_3_unicode is not changed
      - crl_3_unicode.revoked_certificates == crl_3_info_unicode.revoked_certificates
      - crl_3_unicode.revoked_certificates[0].issuer == ([
          "DNS:ca.example.org",
          "DNS:ffóò.ḃâŗ.çøṁ",
          "email:foo@ḃâŗ.çøṁ",
          "URI:https://ffóò.ḃâŗ.çøṁ/baz?foo=bar",
          "URI:https://www.straße.de",
          "URI:https://straße.de:8080",
          "URI:http://gefäß.org",
          "URI:http://ä:1",
        ] if cryptography_version.stdout is version('2.1', '<') or ansible_facts.python.version.minor == 5 else [
          "DNS:ca.example.org",
          "DNS:ffóò.ḃâŗ.çøṁ",
          "email:foo@ḃâŗ.çøṁ",
          "URI:https://admin:hunter2@ffóò.ḃâŗ.çøṁ/baz?foo=bar",
          "URI:https://goo@www.straße.de",
          "URI:https://straße.de:8080",
          "URI:http://gefäß.org",
          "URI:http://a:b@ä:1",
        ])

- name: Verify Ed25519 and Ed448 tests (for cryptography >= 2.6, < 2.8)
  assert:
    that:
      - ed25519_ed448_crl.results[0] is failed
      - ed25519_ed448_crl.results[1] is failed
      - ed25519_ed448_crl_idempotence.results[0] is failed
      - ed25519_ed448_crl_idempotence.results[1] is failed
  when: cryptography_version.stdout is version('2.6', '>=') and cryptography_version.stdout is version('2.8', '<') and ed25519_ed448_privatekey is not failed

- name: Verify Ed25519 and Ed448 tests (for cryptography >= 2.8)
  assert:
    that:
      - ed25519_ed448_crl is succeeded
      - ed25519_ed448_crl.results[0] is changed
      - ed25519_ed448_crl.results[1] is changed
      - ed25519_ed448_crl_idempotence is succeeded
      - ed25519_ed448_crl_idempotence.results[0] is not changed
      - ed25519_ed448_crl_idempotence.results[1] is not changed
  when: cryptography_version.stdout is version('2.8', '>=') and ed25519_ed448_privatekey is not failed
