---
- name: Test firewall ansible fact
  hosts: all
  become: true
  tasks:
    - name: Test firewall ansible fact
      block:
        - name: Start with default configuration
          include_role:
            name: redhat.rhel_system_roles.firewall
          vars:
            firewall:
              - previous: replaced

      # Test base fact (no custom settings applied)

        - name: Get default ansible fact
          include_role:
            name: redhat.rhel_system_roles.firewall
          vars:
            firewall:

        - name: Fail if firewall_config is undefined
          fail:
            msg: Ansible fact firewall_config is not defined
          when: firewall_config is undefined

        - name: Fail if firewall_config custom exists
          fail:
            msg: custom should not exist if there is no custom configuration
          when: "'custom' in firewall_config"

        - name: Fail if firewall_config defaults do not have attributes
          fail:
            msg: default {{ item }} does not have attributes
          when: item | length == 0
          loop: "{{ firewall_config.default | dict2items }}"

        - name: Fail if default zone is not public
          fail:
            msg: default zone should be public
          when: firewall_config.default_zone != "public"

        - name: Save default ansible fact value
          set_fact:
            __previous_firewall_config: "{{ firewall_config }}"
          no_log: true

      # Test fact after adding custom settings

        - name: Modify firewalld configuration
          shell:
            cmd: |
              firewall-cmd --permanent --add-service https
              firewall-cmd --permanent --new-service custom
          changed_when: false

        - name: Refetch firewall_config
          include_role:
            name: redhat.rhel_system_roles.firewall
          vars:
            firewall:

        - name: Fail if firewall_config not changed
          fail:
            msg: >-
              firewall_config was not modified
              after changing firewall settings
          when: firewall_config == __previous_firewall_config

        - name: Fail if config defaults changed
          fail:
            msg: firewall_config defaults changed (should not have)
          when: firewall_config.default != __previous_firewall_config.default

        - name: Fail if custom config unchanged
          fail:
            msg: firewall customs did not change (when they should have)
          when: >-
            'custom' not in firewall_config or
            'zones' not in firewall_config.custom or
            'services' not in firewall_config.custom

        - name: Store previous firewall_config
          set_fact:
            __previous_firewall_config: "{{ firewall_config }}"
          no_log: true

      # Test detailed mode

        - name: Get firewall_config with detailed on
          include_role:
            name: redhat.rhel_system_roles.firewall
          vars:
            firewall:
              detailed: true

        - name: Fail if default settings values not dictionaries
          fail:
            msg: >-
              detailed firewall_config.default not formatted properly -
              see README.md for expected formatting
          when: item is not mapping
          loop: "{{ firewall_config.default.values() | list }}"

        - name: Fail if custom firewall_config is not its previous value
          fail:
            msg: custom firewall_config changed unexpectedly
          when: firewall_config.custom != __previous_firewall_config.custom

        - name: Fail if default zone differs
          fail:
            msg: default zone should not have changed
          when: firewall_config.default_zone != __previous_firewall_config.default_zone

      always:
        - name: Cleanup
          tags:
            - tests::cleanup
          include_role:
            name: redhat.rhel_system_roles.firewall
          vars:
            firewall:
              previous: replaced
          no_log: true
