---
- name: Check if selinux role sets SELinux port mapping
  hosts: all
  tasks:
    - name: Initial changes
      include_role:
        name: linux-system-roles.selinux
      vars:
        selinux_ports_purge: true
        selinux_ports:
          - {ports: '22100', proto: 'tcp', setype: 'ssh_port_t',
             state: 'present'}

    - name: Include test variables
      import_tasks: set_selinux_variables.yml

    - name: Save state after initial changes and before other changes
      set_fact:
        port_before: "{{ selinux_role_port.stdout }}"

    - name: Check if there are SELinux port mapping changes
      assert:
        that: port_before | length > 0

    - name: Subsequent changes
      include_role:
        name: linux-system-roles.selinux
      vars:
        selinux_ports_purge: false
        selinux_ports:
          - {ports: '22022', proto: 'tcp', setype: 'ssh_port_t',
             state: 'present'}
          - {ports: '22023', proto: 'tcp', setype: 'ssh_port_t',
             state: 'present', local: true}

    - name: Include test variables
      import_tasks: set_selinux_variables.yml

    - name: Save state after other changes
      set_fact:
        port_after: "{{ selinux_role_port.stdout }}"

    - name: Check if there are SELinux port mapping changes
      assert:
        that: port_before != port_after

    - name: Revert subsequent changes
      include_role:
        name: linux-system-roles.selinux
      vars:
        selinux_ports_purge: false
        selinux_ports:
          - {ports: '22022', proto: 'tcp', setype: 'ssh_port_t',
             state: 'absent'}
          - {ports: '22', proto: 'tcp', setype: 'ssh_port_t',
             state: 'absent', local: true}
          - {ports: '22023', proto: 'tcp', setype: 'ssh_port_t',
             state: 'absent', local: true}
          - {ports: '22023', proto: 'tcp', setype: 'ssh_port_t',
             state: 'absent', local: true}

    - name: Include test variables
      import_tasks: set_selinux_variables.yml

    - name: Save state after reverting other changes
      set_fact:
        port_after: "{{ selinux_role_port.stdout }}"

    - name: Check if SELinux port mapping is as before
      assert:
        that: port_before == port_after

    - name: Include role
      include_role:
        name: linux-system-roles.selinux
      vars:
        selinux_ports_purge: true

    - name: Include test variables
      import_tasks: set_selinux_variables.yml

    - name: Check if there are no SELinux port mapping changes
      assert:
        that: selinux_role_port.stdout | length == 0
