# SPDX-License-Identifier: MIT
---
- name: Configure acls
  hosts: all
  vars_files: vars/main.yml

  tasks:
    - name: Create multiple acl objects
      tags:
        - tests::booted
        - tests::verify
      block:
        - name: Skip test in bootc mode
          include_tasks: tasks/skip_if_bootc.yml

        - name: Set up test environment
          include_role:
            name: linux-system-roles.ha_cluster
            tasks_from: test_setup.yml

        - name: Run HA Cluster role
          include_role:
            name: linux-system-roles.ha_cluster
            public: true
          vars:
            ha_cluster_cluster_name: test-cluster
            ha_cluster_manage_firewall: true
            ha_cluster_manage_selinux: true
            # To test an acl role permission reference, the reference must exist
            # in CIB.
            ha_cluster_resource_primitives:
              - id: not-for-operator
                # wokeignore:rule=dummy
                agent: 'ocf:pacemaker:Dummy'
            # To work with acls, we need to enable acls in cluster properties.
            ha_cluster_cluster_properties:
              - attrs:
                  - name: enable-acl
                    value: 'true'
            ha_cluster_acls:
              acl_roles:
                - id: operator
                  description: HA cluster operator
                  permissions:
                    - kind: write
                      xpath: //crm_config//nvpair[@name='maintenance-mode']
                    - kind: deny
                      reference: not-for-operator
                - id: administrator
                  permissions:
                    - kind: write
                      xpath: /cib
                - id: empty
              acl_users:
                - id: alice
                  roles:
                    - operator
                    - administrator
                - id: bob
              acl_groups:
                - id: admins
                  roles:
                    - administrator

        - name: Verify acls
          vars:
            __test_expected_lines:
              - ACLs are enabled
              - ""
              - "User: alice"
              - "  Roles: operator administrator"
              - "User: bob"
              - "  Roles:"
              - "Group: admins"
              - "  Roles: administrator"
              - "Role: operator"
              - "  Description: HA cluster operator"
              - "  Permission:
                   write xpath //crm_config//nvpair[@name='maintenance-mode']
                   (operator-write)"
              - "  Permission: deny id not-for-operator (operator-deny)"
              - "Role: administrator"
              - "  Permission: write xpath /cib (administrator-write)"
              - "Role: empty"
          block:
            - name: List all current access control lists
              command:
                cmd: pcs acl
              register: __test_pcs_acl_config
              changed_when: false

            - name: Print real acl configuration
              debug:
                var: __test_pcs_acl_config

            - name: Print expected acl configuration
              debug:
                var: __test_expected_lines | list

            - name: Check acl configuration
              assert:
                that:
                  - __test_pcs_acl_config.stdout_lines
                    == __test_expected_lines | list
