---
# ============================================================================
# test-connection.yml — diagnostic (no host changes). Confirms repo pull +
# Infisical auth. Reads Infisical creds from EITHER env vars OR ansible vars,
# so it works regardless of which Semaphore Variable-Group section they're in.
# ============================================================================

- name: "Semaphore diagnostics — repo + Infisical"
  hosts: localhost
  gather_facts: false
  vars:
    # Accept creds from env var OR extra/ansible var (whichever Semaphore provides)
    infisical_client_id: "{{ lookup('env','INFISICAL_CLIENT_ID') | default(INFISICAL_CLIENT_ID | default(''), true) }}"
    infisical_client_secret: "{{ lookup('env','INFISICAL_CLIENT_SECRET') | default(INFISICAL_CLIENT_SECRET | default(''), true) }}"
    infisical_project_id: "{{ lookup('env','INFISICAL_PROJECT_ID') | default(INFISICAL_PROJECT_ID | default(''), true) }}"
    infisical_url: "{{ lookup('env','INFISICAL_URL') | default(INFISICAL_URL | default('http://192.168.122.41:8080'), true) }}"
    infisical_env_slug: "{{ lookup('env','INFISICAL_ENV_SLUG') | default(INFISICAL_ENV_SLUG | default('dev'), true) }}"

  tasks:
    - name: "[repo] Locate + list repo files"
      ansible.builtin.find:
        paths: "{{ playbook_dir | dirname }}"
        excludes: ".git"
        recurse: false
      register: repo_files

    - name: "[repo] Repo pulled OK"
      ansible.builtin.debug:
        msg: "Repo at {{ playbook_dir | dirname }} — files: {{ repo_files.files | map(attribute='path') | map('basename') | list }}"

    # DIAGNOSTIC: show what channels actually carried the value (lengths only, no secrets)
    - name: "[diag] Which channel carried INFISICAL_CLIENT_ID?"
      ansible.builtin.debug:
        msg:
          - "env var length: {{ lookup('env','INFISICAL_CLIENT_ID') | length }}"
          - "ansible var defined: {{ INFISICAL_CLIENT_ID is defined }}"
          - "resolved id length: {{ infisical_client_id | length }}"

    - name: "[infisical] Auth vars present (via env or var)?"
      ansible.builtin.assert:
        that:
          - infisical_client_id | length > 0
          - infisical_client_secret | length > 0
          - infisical_project_id | length > 0
        fail_msg: >-
          Infisical creds not reaching the playbook via EITHER env vars or ansible vars.
          Check the Variable Group values are non-empty and the group is attached.

    - name: "[infisical] Log in"
      infisical.vault.login:
        url: "{{ infisical_url }}"
        auth_method: universal_auth
        universal_auth_client_id: "{{ infisical_client_id }}"
        universal_auth_client_secret: "{{ infisical_client_secret }}"
      register: infisical_login

    - name: "[infisical] Read secrets"
      infisical.vault.read_secrets:
        login_data: "{{ infisical_login.login_data }}"
        project_id: "{{ infisical_project_id }}"
        env_slug: "{{ infisical_env_slug }}"
        path: "/"
        as_dict: true
      register: infisical_secrets

    - name: "[infisical] Secret keys visible (values hidden)"
      ansible.builtin.debug:
        msg: "Infisical OK (env={{ infisical_env_slug }}) — keys: {{ infisical_secrets.secrets.keys() | list }}"

    - name: "[result] ALL CHECKS PASSED"
      ansible.builtin.debug:
        msg: "SSH repo pull ✓ | Infisical auth + read ✓ — pipeline ready."