---
- name: Set version specific variables
  include_tasks: set_vars.yml

- name: Scan sudoers
  fedora.linux_system_roles.scan_sudoers:
    output_parsed_configs: true
    output_raw_configs: false
#  no_log: true
#  when: sudo_check_if_configured | bool

- name: Sudo is already configured - skip rest of role
  ansible.builtin.meta: end_host
  when:
    - __actual == sudo_sudoers_files
    - sudo_check_if_configured | bool
  vars:
    __actual: "{{ ansible_facts['sudoers'].sudoers_files | map('dict2items') | map('rejectattr', 'key', 'match', '^include_files$') | map('list') | map('items2dict') | list }}"

- name: Ensure sudo is installed
  package:
    name: "{{ __sudo_packages }}"
    state: present
    use: "{{ (__sudo_is_ostree | d(false)) | ternary('ansible.posix.rhel_rpm_ostree', omit) }}"
  register: sudo_package_result

- name: Handle reboot for transactional update systems
  when:
    - __sudo_is_transactional | d(false)
    - sudo_package_result is changed
  block:
    - name: Notify user that reboot is needed to apply changes
      debug:
        msg: >
          Reboot required to apply changes due to transactional updates.

    - name: Reboot transactional update systems
      reboot:
        msg: Rebooting the system to apply transactional update changes.
      when: sudo_transactional_update_reboot_ok | bool

    - name: Fail if reboot is needed and not set
      fail:
        msg: >
          Reboot is required but not allowed. Please set
          'sudo_transactional_update_reboot_ok' to proceed.
      when:
        - sudo_transactional_update_reboot_ok is none

- name: Set include directories variable
  set_fact:
    sudo_include_dirs: "{{ sudo_sudoers_files | selectattr('include_directories', 'defined') | map(attribute='include_directories') | flatten }}"

- name: Set sudoer file paths variable
  set_fact:
    sudo_file_paths: "{{ sudo_sudoers_files | selectattr('path', 'defined') | map(attribute='path') | flatten }}"

- name: Ensure include directories are created
  file:
    path: "{{ item }}"
    owner: root
    group: root
    mode: "0750"
    state: directory
  with_items: "{{ sudo_include_dirs }}"
  when: sudo_include_dirs | length > 0

- name: Ensure sudoers include files are configured
  template:
    src: sudoers.j2
    dest: "{{ item.path }}"
    owner: root
    group: root
    mode: "0440"
    validate: "{{ sudo_visudo_path }} -cf %s"
  with_items: "{{ sudo_sudoers_files }}"
  loop_control:
    label: "{{ item.path }}"
  when: item.path != "/etc/sudoers"

- name: Ensure /etc/sudoers is configured
  template:
    src: sudoers.j2
    dest: "{{ item.path }}"
    owner: root
    group: root
    mode: "0440"
    validate: "{{ sudo_visudo_path }} -cf %s"
  with_items: "{{ sudo_sudoers_files }}"
  loop_control:
    label: "{{ item.path }}"
  when:
    - item.path == "/etc/sudoers"
    - sudo_rewrite_default_sudoers_file | bool

- name: Remove unauthorized included sudoer files
  when:
    - sudo_remove_unauthorized_included_files | bool
    - sudo_include_dirs | length > 0
  block:
    - name: Search for sudoers files in included directories
      find:
        paths: "{{ sudo_include_dirs }}"
        recurse: true
        hidden: true
        file_type: any
      register: sudo_existing_included_files

    - name: Set unauthorized included sudoers files variable
      set_fact:
        sudo_unauthorized_files: "{{ sudo_existing_included_files['files'] | selectattr('path', 'defined') | map(attribute='path') | flatten | difference(sudo_file_paths) }}"

    - name: Remove unauthorized included sudoers files
      file:
        path: "{{ item }}"
        state: absent
      with_items: "{{ sudo_unauthorized_files }}"
      when: sudo_unauthorized_files | length > 0
