# SPDX-License-Identifier: MIT
---
- name: Set user and group
  set_fact:
    __podman_credential_user: "{{ __podman_credential_item['run_as_user']
      if 'run_as_user' in __podman_credential_item else podman_run_as_user }}"
    __podman_credential_group: "{{ __podman_credential_item['run_as_group']
      if 'run_as_group' in __podman_credential_item else podman_run_as_group }}"

# NOTE: Sets __podman_group that we use below
- name: Check user and group information
  include_tasks: handle_user_group.yml
  vars:
    __podman_user: "{{ __podman_credential_user }}"
    __podman_spec_item: "{{ __podman_credential_item }}"

- name: Set credential variables
  set_fact:
    __podman_credential_str: "{{ __podman_credential_item['file_content']
      if 'file_content' in __podman_credential_item
      else lookup('template', __podman_credential_item['template_src'])
      if 'template_src' in __podman_credential_item
      else none }}"
    __podman_credential_file_src: "{{ __podman_credential_item['file_src']
      if 'file_src' in __podman_credential_item
      else none }}"
    __podman_credential_file: "{{ __authdir ~ 'auth.json'
      if not 'file' in __podman_credential_item
      else __authdir ~ __podman_credential_item['file']
      if not __podman_credential_item['file'] is abs
      else __podman_credential_item['file'] }}"
    __podman_credential_mode: "{{ __podman_credential_item['mode']
      if 'mode' in __podman_credential_item else '0600' }}"
  vars:
    __authdir: "{{
      ansible_facts['getent_passwd'][__podman_credential_user][4] ~
      '/.config/containers/' }}"
  no_log: true

- name: Handle state present
  when:
    - __podman_credential_item["state"] | d("present") == "present"
    - __podman_handle_state == "present"
  block:
    - name: Ensure the credentials directory is present
      file:
        path: "{{ __podman_credential_file | dirname }}"
        state: directory
        owner: "{{ __podman_credential_user }}"
        group: "{{ __podman_group }}"
        mode: "0700"

    - name: Ensure credential file is copied
      copy:
        src: "{{ __podman_credential_file_src }}"
        dest: "{{ __podman_credential_file }}"
        owner: "{{ __podman_credential_user }}"
        group: "{{ __podman_group }}"
        mode: "{{ __podman_credential_mode }}"
      when: __podman_credential_file_src | length > 0
      no_log: true

    - name: Ensure credential file content is present
      copy:
        content: "{{ __podman_credential_str }}"
        dest: "{{ __podman_credential_file }}"
        owner: "{{ __podman_credential_user }}"
        group: "{{ __podman_group }}"
        mode: "{{ __podman_credential_mode }}"
      when:
        - __podman_credential_str | length > 0
        - not __podman_credential_file_src
      no_log: true

- name: Handle state absent
  when:
    - __podman_credential_item["state"] | d("present") == "absent"
    - __podman_handle_state == "absent"
  block:
    - name: Ensure credential file is absent
      file:
        path: "{{ __podman_credential_file }}"
        state: absent
      no_log: true

    - name: Find files in credentials directory
      find:
        path: "{{ __podman_credential_file | dirname }}"
        file_type: any
        hidden: true
      register: __credential_dir_files
      no_log: true

    - name: Ensure the credentials directory is absent if empty
      file:
        path: "{{ __podman_credential_file | dirname }}"
        state: absent
      when: __credential_dir_files.matched == 0
