---
- name: 读取独立管理凭据元数据
  ansible.builtin.uri:
    url: "{{ pg_bao_url }}/v1/kv/metadata/infra/postgresql/ayatori/{{ pg_ayatori_instance }}"
    headers: {X-Vault-Token: "{{ pg_bao_token }}"}
    status_code: [200, 404]
  register: pg_admin_metadata
  no_log: true
- name: 只在明确缺失时写入独立的用户名密码
  ansible.builtin.uri:
    url: "{{ pg_bao_url }}/v1/kv/data/infra/postgresql/ayatori/{{ pg_ayatori_instance }}"
    method: POST
    headers: {X-Vault-Token: "{{ pg_bao_token }}"}
    body_format: json
    body:
      options: {cas: 0}
      data:
        username: "{{ pg_loaded_credentials[pg_ayatori_instance].ayatori_username }}"
        password: "{{ pg_loaded_credentials[pg_ayatori_instance].ayatori_password }}"
    status_code: 200
  when: pg_admin_metadata.status == 404
  changed_when: true
  no_log: true
- name: 回读已有管理凭据
  ansible.builtin.uri:
    url: "{{ pg_bao_url }}/v1/kv/data/infra/postgresql/ayatori/{{ pg_ayatori_instance }}"
    headers: {X-Vault-Token: "{{ pg_bao_token }}"}
    status_code: 200
  register: pg_admin_readback
  no_log: true
- name: 不隐式覆盖或轮换不一致凭据
  ansible.builtin.assert:
    that:
      - pg_admin_readback.json.data.data.keys() | sort == ['password', 'username']
      - pg_admin_readback.json.data.data.username == pg_loaded_credentials[pg_ayatori_instance].ayatori_username
      - pg_admin_readback.json.data.data.password == pg_loaded_credentials[pg_ayatori_instance].ayatori_password
  no_log: true