---
- name: 核对秘密元数据（非 404 错误不能视为不存在）
  ansible.builtin.uri:
    url: "{{ pg_bao_url }}/v1/kv/metadata/{{ pg_secret_paths[pg_secret_instance] }}"
    headers:
      X-Vault-Token: "{{ pg_bao_token }}"
    status_code: [200, 404]
  register: pg_secret_metadata
  no_log: true
- name: 明确不存在时创建一次
  when: pg_secret_metadata.status == 404
  block:
    - name: 拒绝为已有实例重造丢失秘密
      ansible.builtin.assert:
        that: >-
          groups['pg_hosts'] | map('extract', hostvars, 'pg_has_data')
          | select('equalto', true) | list | length == 0
    - name: 随机生成只在本次执行内存存在的值
      ansible.builtin.set_fact:
        pg_new_secret:
          ayatori_username: ayatori
          ayatori_password: "{{ lookup('password', '/dev/null', length=48, chars=['ascii_letters', 'digits']) }}"
          superuser_password: "{{ lookup('password', '/dev/null', length=48, chars=['ascii_letters', 'digits']) }}"
          replication_password: "{{ lookup('password', '/dev/null', length=48, chars=['ascii_letters', 'digits']) }}"
          rest_password: "{{ lookup('password', '/dev/null', length=48, chars=['ascii_letters', 'digits']) }}"
      no_log: true
    - name: 使用 KV v2 CAS=0 防覆盖写入
      ansible.builtin.uri:
        url: "{{ pg_bao_url }}/v1/kv/data/{{ pg_secret_paths[pg_secret_instance] }}"
        method: POST
        headers:
          X-Vault-Token: "{{ pg_bao_token }}"
        body_format: json
        body:
          options: {cas: 0}
          data: "{{ pg_new_secret }}"
        status_code: 200
      changed_when: true
      no_log: true
- name: 确认已有秘密数据可读，软删除必须失败
  ansible.builtin.uri:
    url: "{{ pg_bao_url }}/v1/kv/data/{{ pg_secret_paths[pg_secret_instance] }}"
    headers:
      X-Vault-Token: "{{ pg_bao_token }}"
    status_code: 200
  no_log: true