# SPDX-License-Identifier: MIT
---
- name: Ensure that the role runs with default parameters
  hosts: all
  tasks:
    - name: See if /dev/log exists for the fingerprint check
      ansible.builtin.stat:
        path: /dev/log
      register: __register_dev_log

    - name: Set the start time for the journal search
      ansible.builtin.set_fact:
        __journal_start_time: "{{ ansible_facts['date_time']['date'] ~ ' ' ~ ansible_facts['date_time']['time'] }}"
      when: __register_dev_log.stat.exists

    - name: Run the role
      include_tasks: tasks/run_role_with_clear_facts.yml
      vars:
        __aide_write_log_file: true

    # look for the exact module invocation, not some other message that might contain the string
    - name: Get fingerprint entries from journal
      ansible.builtin.shell:
        executable: /bin/bash
        cmd: >-
          set -eo pipefail;
          journalctl --since "{{ __journal_start_time }}" --no-pager |
          grep -v " Invoked with" |
          grep "sr_fingerprint.*role_name=aide"
      register: __register_journal_fingerprints
      changed_when: false
      when: __register_dev_log.stat.exists

    - name: Check that the log file was written
      ansible.builtin.slurp:
        path: /var/log/sysroles.jsonl
      register: __register_log_file

    - name: Verify log file and journal fingerprints
      when: __register_dev_log.stat.exists
      vars:
        __journal_lines: "{{ __register_journal_fingerprints.stdout_lines }}"
        __journal_begin: "{{ __journal_lines | select('search', 'status=begin') | list }}"
        __journal_success: "{{ __journal_lines | select('search', 'status=success') | list }}"
        __begin_date: "{{ (__journal_begin[0] | regex_search('date=([^ ]+)', '\\1'))[0] }}"
        __success_date: "{{ (__journal_success[0] | regex_search('date=([^ ]+)', '\\1'))[0] }}"
        __file_content: "{{ __register_log_file.content | b64decode }}"
      block:
        - name: Print contents of logs
          debug:
            var: item
          loop:
            - "{{ __file_content }}"
            - "{{ __journal_lines }}"

        - name: Assert content is correct
          ansible.builtin.assert:
            that:
              - __journal_begin | length > 0
              - __journal_success | length > 0
              - __begin_date in __file_content
              - __success_date in __file_content

    - name: Check if the file exists
      ansible.builtin.stat:
        path: /etc/aide.conf
      register: file_check

    - name: Assert that the file exists
      ansible.builtin.assert:
        that: file_check.stat.exists
        fail_msg: The file does not exist.