---
# ============================================================================
# test-connection.yml — diagnostic playbook (makes NO changes to any host)
# ============================================================================
# Confirms the Semaphore pipeline works end to end:
#   1. Repo pulled OK over SSH  -> list files in the checked-out repo
#   2. Infisical reachable + auth works -> login + read secret KEYS (not values)
#
# Runs entirely on the Semaphore runner (localhost). No target hosts touched.
#
# Requires (Semaphore Variable Group 'infisical-dev' as env vars):
#   INFISICAL_CLIENT_ID, INFISICAL_CLIENT_SECRET, INFISICAL_PROJECT_ID
#   INFISICAL_URL (default http://192.168.122.41:8080), INFISICAL_ENV_SLUG (default dev)
#
# Usage: Task Template -> playbook playbooks/test-connection.yml, env infisical-dev
# ============================================================================

- name: "Semaphore diagnostics — repo + Infisical"
  hosts: localhost
  gather_facts: false
  vars:
    infisical_url: "{{ lookup('env','INFISICAL_URL') | default('http://192.168.122.41:8080', true) }}"
    infisical_env_slug: "{{ lookup('env','INFISICAL_ENV_SLUG') | default('dev', true) }}"

  tasks:
    # ---------- 1. REPO CHECK (proves SSH clone worked) ----------
    - name: "[repo] Where is the checked-out repo?"
      ansible.builtin.set_fact:
        repo_dir: "{{ playbook_dir | dirname }}"

    - name: "[repo] List files in the repository"
      ansible.builtin.find:
        paths: "{{ repo_dir }}"
        recurse: true
        excludes: ".git"
      register: repo_files

    - name: "[repo] Repo contents"
      ansible.builtin.debug:
        msg: >-
          Repo pulled OK at {{ repo_dir }} —
          {{ repo_files.files | map(attribute='path') | map('regex_replace', '^'+repo_dir+'/', '') | list }}

    # ---------- 2. INFISICAL CHECK (proves auth + read works) ----------
    - name: "[infisical] Auth vars present?"
      ansible.builtin.assert:
        that:
          - lookup('env','INFISICAL_CLIENT_ID') | length > 0
          - lookup('env','INFISICAL_CLIENT_SECRET') | length > 0
          - lookup('env','INFISICAL_PROJECT_ID') | length > 0
        fail_msg: "Missing INFISICAL_CLIENT_ID / _SECRET / _PROJECT_ID (set them in the Variable Group)."
        success_msg: "Infisical auth vars present."

    - name: "[infisical] Log in (universal auth)"
      infisical.vault.login:
        url: "{{ infisical_url }}"
        auth_method: universal_auth
        universal_auth_client_id: "{{ lookup('env','INFISICAL_CLIENT_ID') }}"
        universal_auth_client_secret: "{{ lookup('env','INFISICAL_CLIENT_SECRET') }}"
      register: infisical_login

    - name: "[infisical] Read secrets from project/env"
      infisical.vault.read_secrets:
        login_data: "{{ infisical_login.login_data }}"
        project_id: "{{ lookup('env','INFISICAL_PROJECT_ID') }}"
        env_slug: "{{ infisical_env_slug }}"
        path: "/"
        as_dict: true
      register: infisical_secrets

    - name: "[infisical] Show which secret KEYS are visible (values hidden)"
      ansible.builtin.debug:
        msg: >-
          Infisical OK ({{ infisical_url }}, env={{ infisical_env_slug }}) —
          secret keys available: {{ infisical_secrets.secrets.keys() | list }}

    - name: "[result] ALL CHECKS PASSED"
      ansible.builtin.debug:
        msg: "SSH repo pull ✓  |  Infisical auth + read ✓  — pipeline is ready."