---
- name: Check if selinux role sets SELinux login mappings
  hosts: all
  tasks:
    - name: Add a System Api Roles SELinux User
      user:
        comment: System Api Roles SELinux User
        name: sar-user

    - name: Initial changes
      include_role:
        name: fedora.linux_system_roles.selinux
      vars:
        selinux_logins_purge: true
        selinux_logins:
          - {login: 'sar-user', seuser: 'staff_u', serange: 's0-s0:c0.c1023', state: 'present'}

    - name: Include test variables
      import_tasks: set_selinux_variables.yml

    - name: Save state after initial changes and before other changes
      set_fact:
        login_before: "{{ selinux_role_login.stdout }}"

    - name: Check if there are SELinux login mapping changes
      assert:
        that: login_before | length > 0

    - name: Subsequent changes
      include_role:
        name: fedora.linux_system_roles.selinux
      vars:
        selinux_logins_purge: false
        selinux_logins:
          - {login: '__default__', seuser: 'staff_u', serange: 's0-s0:c0.c1023', state: 'present'}

    - name: Include test variables
      import_tasks: set_selinux_variables.yml

    - name: Save state after other changes
      set_fact:
        login_after: "{{ selinux_role_login.stdout }}"

    - name: Check if there are SELinux login mapping changes
      assert:
        that: login_before != login_after

    - name: Revert subsequent changes
      include_role:
        name: fedora.linux_system_roles.selinux
      vars:
        selinux_logins_purge: false
        selinux_logins:
          - {login: '__default__', seuser: 'staff_u', serange: 's0-s0:c0.c1023', state: 'absent'}

    - name: Include test variables
      import_tasks: set_selinux_variables.yml

    - name: Save state after reverting other changes
      set_fact:
        login_after: "{{ selinux_role_login.stdout }}"

    - name: Check if SELinux login mapping is as before
      assert:
        that: login_before == login_after

    - name: Include role
      include_role:
        name: fedora.linux_system_roles.selinux
      vars:
        selinux_logins_purge: true

    - name: Include test variables
      import_tasks: set_selinux_variables.yml

    - name: Check if there are no SELinux login mapping changes
      assert:
        that: selinux_role_login.stdout | length == 0

    - name: Remove a System Api Roles SELinux User
      user:
        comment: System Api Roles SELinux User
        name: sar-user
        state: absent
