---
# OIDC auth via Authelia — human login (bao login -method=oidc / UI).
# The Authelia 'openbao' client must already exist (authelia/values.yaml).

- name: Assert the OIDC client secret is provided
  ansible.builtin.assert:
    that:
      - openbao_oidc_client_secret | length > 0
    fail_msg: "Set vault_openbao_oidc_client_secret (plaintext of the Authelia openbao client)."

- name: Enable the OIDC auth method
  ansible.builtin.command: "bao auth enable -path=oidc oidc"
  environment: "{{ openbao_cli_env }}"
  register: oidc_enable
  changed_when: oidc_enable.rc == 0
  failed_when:
    - oidc_enable.rc != 0
    - "'already in use' not in (oidc_enable.stderr | default('')) + (oidc_enable.stdout | default(''))"
  no_log: "{{ openbao_no_log }}"
  # Terraform owns this (../terraform). See openbao_config_managed_by_terraform.
  when: not openbao_config_managed_by_terraform | bool

- name: Configure the OIDC provider (Authelia)
  ansible.builtin.command: >-
    bao write auth/oidc/config
    oidc_discovery_url={{ openbao_oidc_discovery_url }}
    oidc_client_id={{ openbao_oidc_client_id }}
    oidc_client_secret={{ openbao_oidc_client_secret }}
    default_role={{ openbao_oidc_default_role }}
  environment: "{{ openbao_cli_env }}"
  register: oidc_config
  changed_when: oidc_config.rc == 0
  no_log: true    # carries the client secret — always hidden

- name: Create/update the admin OIDC role (restricted to the admin AD group)
  ansible.builtin.command: "bao write auth/oidc/role/{{ openbao_oidc_default_role }} -"
  args:
    stdin: "{{ lookup('template', 'oidc-admin-role.json.j2') }}"
  environment: "{{ openbao_cli_env }}"
  register: oidc_role
  changed_when: oidc_role.rc == 0
  no_log: "{{ openbao_no_log }}"
  # Terraform owns this (../terraform). See openbao_config_managed_by_terraform.
  when: not openbao_config_managed_by_terraform | bool