---
- name: Check if selinux role sets SELinux booleans
  hosts: all
  tasks:
    - name: Initial changes
      include_role:
        name: linux-system-roles.selinux
      vars:
        selinux_booleans_purge: true
        selinux_booleans:
          - {name: 'daemons_use_tcp_wrapper', state: 'on', persistent: 'yes'}

    - name: Include test variables
      import_tasks: set_selinux_variables.yml

    - name: Save state after initial changes and before other changes
      set_fact:
        boolean_before: "{{ selinux_role_boolean.stdout_lines }}"

    - name: Check if there are SELinux boolean changes
      assert:
        that: selinux_role_boolean.stdout | length > 0

    - name: Subsequent changes
      include_role:
        name: linux-system-roles.selinux
      vars:
        selinux_booleans_purge: false
        selinux_booleans:
          - {name: 'httpd_can_network_connect', state: 'on',
             persistent: 'yes'}

    - name: Include test variables
      import_tasks: set_selinux_variables.yml

    - name: Save state after other changes
      set_fact:
        boolean_after: "{{ selinux_role_boolean.stdout_lines }}"

    - name: Check if there are SELinux boolean changes
      assert:
        that: (boolean_before | count) < (boolean_after | count)

    - name: Include role
      include_role:
        name: linux-system-roles.selinux
      vars:
        selinux_booleans_purge: true

    - name: Include test variables
      import_tasks: set_selinux_variables.yml

    - name: Check if there are no SELinux boolean mapping changes
      assert:
        that: selinux_role_boolean.stdout | length == 0
