---
- name: Test that old config can be purged idempotently
  hosts: all
  vars:
    basic_config:
      - zone: customzone
        state: present
      - set_default_zone: customzone
        state: enabled
      - service: [tftp, ftp]
        port: ['443/tcp', '443/udp']
        forward_port: ['447/tcp;;1.2.3.4',
                       '448/tcp;;1.2.3.5']
        state: enabled
      - zone: internal
        service: [tftp, ftp]
        port: ['443/tcp', '443/udp']
        forward_port: ['447/tcp;;1.2.3.4',
                       '448/tcp;;1.2.3.5']
        state: enabled
      - masquerade: true
      - service: http
        state: enabled
  tasks:
    - name: Run previous replaced tests
      block:
        - name: Start from a clean slate
          include_role:
            name: linux-system-roles.firewall
          vars:
            firewall:
              - previous: replaced

        - name: Run the role with no config
          include_role:
            name: linux-system-roles.firewall

        - name: Verify that nothing changed
          fail:
            msg: The role changed something
          when: firewall_lib_result.changed  # noqa no-handler

        - name: Apply basic config
          include_role:
            name: linux-system-roles.firewall
          vars:
            firewall: "{{ basic_config }}"

        - name: Verify role reports changed
          fail:
            msg: The role reported no changes
          when: not firewall_lib_result.changed  # noqa no-handler

        - name: Apply again basic config
          include_role:
            name: linux-system-roles.firewall
          vars:
            firewall: "{{ basic_config }}"

        - name: Verify role reports nothing changed
          fail:
            msg: The role reported changes
          when: firewall_lib_result.changed  # noqa no-handler

        - name: Use previous replaced and basic config
          include_role:
            name: linux-system-roles.firewall
          vars:
            firewall: "{{ basic_config + [{'previous': 'replaced'}] }}"

        - name: Verify role reports no changes
          fail:
            msg: The role reported changes
          when: firewall_lib_result.changed  # noqa no-handler

        - name: Use again previous replaced and basic config
          include_role:
            name: linux-system-roles.firewall
          vars:
            firewall: "{{ basic_config + [{'previous': 'replaced'}] }}"

        - name: Verify role reports no changes
          fail:
            msg: The role reported changes
          when: firewall_lib_result.changed  # noqa no-handler

        - name: Apply basic config
          include_role:
            name: linux-system-roles.firewall
          vars:
            firewall: "{{ basic_config }}"

        - name: Verify role reports no changes
          fail:
            msg: The role reported changes
          when: firewall_lib_result.changed  # noqa no-handler

        - name: Use only previous replaced
          include_role:
            name: linux-system-roles.firewall
          vars:
            firewall:
              - previous: replaced

        - name: Verify role reports changed
          fail:
            msg: The role reported no changes
          when: not firewall_lib_result.changed  # noqa no-handler

        - name: Apply only default zone
          include_role:
            name: linux-system-roles.firewall
          vars:
            firewall:
              - set_default_zone: dmz

        - name: Verify role reports changed
          fail:
            msg: The role reported no changes
          when: not firewall_lib_result.changed  # noqa no-handler

        - name: Apply only default zone again
          include_role:
            name: linux-system-roles.firewall
          vars:
            firewall:
              - set_default_zone: dmz

        - name: Verify role reports not changed
          fail:
            msg: The role reported changes
          when: firewall_lib_result.changed  # noqa no-handler

        - name: Apply only default zone again with previous replaced
          include_role:
            name: linux-system-roles.firewall
          vars:
            firewall:
              - previous: replaced
              - set_default_zone: dmz

        - name: Verify role reports not changed
          fail:
            msg: The role reported changes
          when: firewall_lib_result.changed  # noqa no-handler

        ### Test firewalld.conf reset

        - name: Change default zone (Change firewalld.conf)
          include_role:
            name: linux-system-roles.firewall
          vars:
            firewall:
              - set_default_zone: internal

        - name: Get stats for firewalld.conf
          stat:
            path: /etc/firewalld/firewalld.conf
          register: __stat_before
          failed_when: not __stat_before.stat.exists

        - name: Purge config
          include_role:
            name: linux-system-roles.firewall
          vars:
            firewall:
              - previous: replaced

        - name: Fail if /etc/firewalld/firewalld.conf no longer exists
          stat:
            path: /etc/firewalld/firewalld.conf
          register: __stat_after_a
          failed_when: not __stat_after_a.stat.exists

        - name: Assert that collected firewalld.conf checksums do not match
          fail:
            msg: firewalld.conf should have changed on reset
          when: __stat_before.stat.checksum == __stat_after_a.stat.checksum

        - name: Purge config (no changes made since last purge)
          include_role:
            name: linux-system-roles.firewall
          vars:
            firewall:
              - previous: replaced

        - name: Fail if /etc/firewalld/firewalld.conf no longer exists
          stat:
            path: /etc/firewalld/firewalld.conf
          register: __stat_after_b
          failed_when: not __stat_after_b.stat.exists

        - name: Assert that collected firewalld.conf checksums match
          fail:
            msg: firewalld.conf should have changed on reset
          when: __stat_after_a.stat.checksum != __stat_after_b.stat.checksum

      always:
        - name: Cleanup
          tags:
            - tests::cleanup
          include_role:
            name: linux-system-roles.firewall
          vars:
            firewall:
              - previous: replaced
