---
# Delivers the 1Password service account token to a file only the daemon user
# can read. It deliberately stops there: nothing here puts the token into the
# daemon's environment. The daemon's systemd user unit belongs to the multica
# CLI, so the role must not edit it, and exporting the token to the daemon
# would hand it to every agent process too. See the README.

# no_log: a failed assert would otherwise render the token it inspected.
- name: 1Password token | Require a service account token
  ansible.builtin.assert:
    that:
      - multica_op_service_account_token | length > 0
      - multica_op_service_account_token is match('^ops_')
    fail_msg: >-
      multica_op_deliver_token is true but multica_op_service_account_token is
      not a 1Password service account token (ops_...).
    quiet: true
  no_log: true

- name: 1Password token | Create the token directory
  ansible.builtin.file:
    path: "{{ multica_op_token_file | dirname }}"
    state: directory
    owner: "{{ multica_user }}"
    group: "{{ multica_group }}"
    mode: "0700"
  become: true

- name: 1Password token | Write the token file
  ansible.builtin.copy:
    dest: "{{ multica_op_token_file }}"
    content: "{{ multica_op_service_account_token }}\n"
    owner: "{{ multica_user }}"
    group: "{{ multica_group }}"
    mode: "0600"
  no_log: true
  become: true

# --- op shim -----------------------------------------------------------------
# `op` reads the token only from OP_SERVICE_ACCOUNT_TOKEN. The shim, first on
# the daemon unit's PATH, exports it for the real binary alone, so agents call
# plain `op` and the token never enters their shell environment. The daemon
# unit itself stays the CLI's (WDWL-18).

- name: 1Password token | Create the daemon user's bin directory
  ansible.builtin.file:
    path: "{{ multica_op_shim_path | dirname }}"
    state: directory
    owner: "{{ multica_user }}"
    group: "{{ multica_group }}"
    mode: "0755"
  become: true
  when: multica_op_shim | bool

- name: 1Password token | Install the op shim
  ansible.builtin.template:
    src: op-shim.sh.j2
    dest: "{{ multica_op_shim_path }}"
    owner: root
    group: root
    mode: "0755"
  become: true
  when: multica_op_shim | bool

# As the daemon user, through its own environment: plain `op` must resolve to
# the shim, and the token must not be in that environment.
- name: 1Password token | Check op resolves to the shim as the daemon user
  ansible.builtin.shell:
    cmd: 'command -v op; env | grep -c "^OP_SERVICE_ACCOUNT_TOKEN=" || true'
  become: true
  become_user: "{{ multica_user }}"
  environment: "{{ _multica_user_env }}"
  register: _multica_op_shim_check
  changed_when: false
  check_mode: false
  failed_when: >-
    _multica_op_shim_check.rc != 0
    or _multica_op_shim_check.stdout_lines != [multica_op_shim_path, '0']
  when:
    - multica_op_shim | bool
    - not ansible_check_mode