---
# Expected behavior of nbde_server_rotate_keys is the following:
# - if there are no keys, create new keys
# - if there are keys, do not touch them, unless set
# - if set, rotate existing keys, if any, plus create new keys
- name: Verify behavior of nbde_server_rotate_keys
  hosts: all

  tasks:
    - name: Run tests
      block:
        - name: Ensure we have keys
          include_role:
            name: linux-system-roles.nbde_server
            public: true

        - name: Gather keys
          find:
            paths: "{{ __nbde_server_keydir }}"
            file_type: file
            recurse: false
            patterns:
              - "*.jwk"
              - ".*.jwk"
          check_mode: true
          register: nbde_server_keys

        - name: Run with nbde_server_rotate_keys not set to check keys
          include_role:
            name: linux-system-roles.nbde_server
            public: true
          vars:
            nbde_server_rotate_keys: false

        - name: Gather keys after running with nbde_server_rotate_keys not set
          find:
            paths: "{{ __nbde_server_keydir }}"
            file_type: file
            recurse: false
            patterns:
              - "*.jwk"
              - ".*.jwk"
          check_mode: true
          register: nbde_server_rotate_not_set

        - name: Check whether keys changed - nbde_server_rotate_keys not set
          assert:
            that: nbde_server_keys.files == nbde_server_rotate_not_set.files

        - name: Run with nbde_server_rotate_keys set to check keys
          include_role:
            name: linux-system-roles.nbde_server
            public: true
          vars:
            nbde_server_rotate_keys: true

        - name: Gather keys after running with nbde_server_rotate_keys set
          find:
            paths: "{{ __nbde_server_keydir }}"
            file_type: file
            recurse: false
            patterns:
              - "*.jwk"
              - ".*.jwk"
          check_mode: true
          register: nbde_server_rotate_set

        - name: Check whether keys changed - nbde_server_rotate_keys set
          assert:
            that: nbde_server_keys.files != nbde_server_rotate_set.files
      always:
        - name: Cleanup
          tags: tests::cleanup
          include_tasks: tasks/cleanup.yml

# vim:set ts=2 sw=2 et:
