# SPDX-License-Identifier: MIT
---
- name: Ensure that we can set the policy using this role (without reboot)
  hosts: all
  tasks:
    - name: Run test
      block:
        - name: Set correct base policy
          include_role:
            name: linux-system-roles.crypto_policies
          vars:
            crypto_policies_policy: LEGACY
            crypto_policies_reload: false
        - name: Verify that base policy was updated
          assert:
            that:
              - crypto_policies_active == 'LEGACY'
              - crypto_policies_reboot_required | bool

        - name: Set policy and subpolicy to use for test
          set_fact:
            __policy_and_sub: "{{ 'DEFAULT:NO-SHA1'
              if 'NO-SHA1' in crypto_policies_available_subpolicies
              else 'DEFAULT:AD-SUPPORT'
              if 'AD-SUPPORT' in crypto_policies_available_subpolicies
              else 'DEFAULT:' ~ crypto_policies_available_subpolicies[0] }}"

        - name: Set correct base policy and subpolicy
          include_role:
            name: linux-system-roles.crypto_policies
          vars:
            crypto_policies_policy: "{{ __policy_and_sub }}"
            crypto_policies_reload: false
        - name: Verify that base policy and subpolicy were updated
          assert:
            that:
              - crypto_policies_active == __policy_and_sub
              - crypto_policies_reboot_required | bool

        - name: Setting incorrect base policy should fail
          block:
            - name: Set incorrect base policy
              include_role:
                name: linux-system-roles.crypto_policies
              vars:
                crypto_policies_policy: NOEXIST
                crypto_policies_reload: false
            - name: Unreachable task
              fail:
                msg: UNREACH
          rescue:
            - name: Check that we failed in the role
              assert:
                that:
                  - crypto_policies_active == __policy_and_sub
                  - ansible_failed_result.msg != 'UNREACH'
                msg: "Role has not failed when it should have"

        - name: Setting incorrect subpolicy should fail
          block:
            - name: Set incorrect subpolicy
              include_role:
                name: linux-system-roles.crypto_policies
              vars:
                crypto_policies_policy: DEFAULT:NOEXIST
                crypto_policies_reload: false
            - name: Unreachable task
              fail:
                msg: UNREACH
          rescue:
            - name: Check that we failed in the role
              assert:
                that:
                  - crypto_policies_active == __policy_and_sub
                  - ansible_failed_result.msg != 'UNREACH'
                msg: "Role has not failed when it should have"

      always:
        - name: Restore policy to DEFAULT
          tags:
            - tests::cleanup
          include_role:
            name: linux-system-roles.crypto_policies
          vars:
            crypto_policies_policy: DEFAULT
        - name: Check restoration
          tags:
            - tests::cleanup
          block:
            - name: Flush handlers
              meta: flush_handlers
            - name: Check the current policy has been restored to DEFAULT
              assert:
                that:
                  - crypto_policies_active == 'DEFAULT'
                  - crypto_policies_reboot_required | bool
