---
# tasks to validate variable values

- name: Check that required variables are set
  block:
    - name: Check that osbuild_worker_server_hostname is set
      ansible.builtin.assert:
        quiet: true
        that:
          - osbuild_worker_server_hostname is defined
          - osbuild_worker_server_hostname | length > 0
        fail_msg: "osbuild_worker_server_hostname must be set"

    - name: Check that osbuild_worker_authentication_oauth_url is set
      ansible.builtin.assert:
        quiet: true
        that:
          - osbuild_worker_authentication_oauth_url is defined
          - osbuild_worker_authentication_oauth_url | length > 0
        fail_msg: "osbuild_worker_authentication_oauth_url must be set"

    - name: Check that osbuild_worker_authentication_client_id is set
      ansible.builtin.assert:
        quiet: true
        that:
          - osbuild_worker_authentication_client_id is defined
          - osbuild_worker_authentication_client_id | length > 0
        fail_msg: "osbuild_worker_authentication_client_id must be set"

    - name: Check that at least one of osbuild_worker_authentication_client_secret_file or osbuild_worker_authentication_offline_token_file is set
      ansible.builtin.assert:
        quiet: true
        that:
          - is_client_secret_file_defined or is_offline_token_file_defined
        fail_msg: "At least one of osbuild_worker_authentication_client_secret_file and osbuild_worker_authentication_offline_token_file must be set"
      vars:
        is_client_secret_file_defined:
          "{{ osbuild_worker_authentication_client_secret_file is defined and osbuild_worker_authentication_client_secret_file | length > 0 }}"
        is_offline_token_file_defined:
          "{{ osbuild_worker_authentication_offline_token_file is defined and osbuild_worker_authentication_offline_token_file | length > 0 }}"

- name: Check optional variables
  block:
    - name: Check that osbuild_worker_authentication_client_secret_file is set if osbuild_worker_authentication_client_secret_path is set
      ansible.builtin.assert:
        quiet: true
        that:
          - osbuild_worker_authentication_client_secret_file is defined
          - osbuild_worker_authentication_client_secret_file | length > 0
        fail_msg: "osbuild_worker_authentication_client_secret_file must be set if osbuild_worker_authentication_client_secret_path is set"
      when: osbuild_worker_authentication_client_secret_path | length > 0

    - name: Check that osbuild_worker_authentication_offline_token_file is set if osbuild_worker_authentication_offline_token_path is set
      ansible.builtin.assert:
        quiet: true
        that:
          - osbuild_worker_authentication_offline_token_file is defined
          - osbuild_worker_authentication_offline_token_file | length > 0
        fail_msg: "osbuild_worker_authentication_offline_token_file must be set if osbuild_worker_authentication_offline_token_path is set"
      when: osbuild_worker_authentication_offline_token_path | length > 0

    - name: Check Koji variables
      when: osbuild_worker_koji_instances | length > 0
      block:
        - name: Check that required Koji variables are set
          ansible.builtin.assert:
            quiet: true
            that:
              - item.koji_host is defined
              - item.koji_host | length > 0
              - item.krb_principal is defined
              - item.krb_principal | length > 0
              - item.krb_keytab_file is defined
              - item.krb_keytab_file | length > 0
            fail_msg: All of koji_host, krb_principal, and krb_keytab_file must be set for each Koji instance
          loop: "{{ osbuild_worker_koji_instances }}"

        - name: Check that relax_timeout_factor is a positive integer
          ansible.builtin.assert:
            quiet: true
            that:
              - item.relax_timeout_factor | int > 0
            fail_msg: relax_timeout_factor must be a positive integer if set
          loop: "{{ osbuild_worker_koji_instances }}"
          when: item.relax_timeout_factor is defined

    - name: Check Azure variables
      block:
        - name: Check that no Azure variables are set if osbuild_worker_azure_credentials_file is not set
          ansible.builtin.assert:
            quiet: true
            that:
              - osbuild_worker_azure_credentials_path | length == 0
              - osbuild_worker_azure_upload_threads == 0
            fail_msg: "osbuild_worker_azure_credentials_path and osbuild_worker_azure_upload_threads must not be set
              if osbuild_worker_azure_credentials_file is not set"
          when: osbuild_worker_azure_credentials_file | length == 0

        - name: Check that osbuild_worker_azure_upload_threads is a positive integer
          ansible.builtin.assert:
            quiet: true
            that:
              - osbuild_worker_azure_upload_threads | int > 0
            fail_msg: "osbuild_worker_azure_upload_threads must be a positive integer"
          when: osbuild_worker_azure_upload_threads != 0

    - name: Check that no AWS variables are set if osbuild_worker_aws_credentials_file is not set
      ansible.builtin.assert:
        quiet: true
        that:
          - osbuild_worker_aws_credentials_path | length == 0
          - osbuild_worker_aws_bucket | length == 0
        fail_msg: "osbuild_worker_aws_credentials_path and osbuild_worker_aws_bucket must not be set if osbuild_worker_aws_credentials_file is not set"
      when: osbuild_worker_aws_credentials_file | length == 0

    - name: Check that no GCP variables are set if osbuild_worker_gcp_credentials_file is not set
      ansible.builtin.assert:
        quiet: true
        that:
          - osbuild_worker_gcp_credentials_path | length == 0
          - osbuild_worker_gcp_bucket | length == 0
        fail_msg: "osbuild_worker_gcp_credentials_path and osbuild_worker_gcp_bucket must not be set if osbuild_worker_gcp_credentials_file is not set"
      when: osbuild_worker_gcp_credentials_file | length == 0
