---
- name: "Agents | Resolve catalog entry | {{ _agent_key }}"
  ansible.builtin.set_fact:
    _agent: "{{ multica_agent_cli_catalog[_agent_key] }}"

- name: "Agents | Read the installed version | {{ _agent_key }}"
  ansible.builtin.command:
    argv: ["/bin/sh", "-c", "command -v {{ _agent.binary }} >/dev/null 2>&1 && {{ _agent.version_command }}"]
  become: true
  become_user: "{{ multica_user }}"
  environment: "{{ _multica_user_env }}"
  register: _agent_installed
  changed_when: false
  failed_when: false
  check_mode: false

# Piping a vendor script into a shell is a supply-chain decision, so the role
# refuses rather than making it quietly on the operator's behalf.
- name: "Agents | Refuse to run a remote installer unless allowed | {{ _agent_key }}"
  ansible.builtin.fail:
    msg: >-
      {{ _agent_key }} installs by executing {{ _agent.install_url }}.
      Set multica_allow_remote_install_scripts: true to permit that, vendor the
      installer yourself, or drop {{ _agent_key }} from multica_agent_clis.
  when:
    - _agent_installed.rc != 0
    - not (multica_allow_remote_install_scripts | bool)

- name: "Agents | Install via the vendor script | {{ _agent_key }}"
  when:
    - _agent_installed.rc != 0
    - multica_allow_remote_install_scripts | bool
  block:
    - name: "Agents | Fetch the installer | {{ _agent_key }}"
      ansible.builtin.get_url:
        url: "{{ _agent.install_url }}"
        dest: "{{ multica_user_home }}/.cache/{{ _agent_key }}-install.sh"
        owner: "{{ multica_user }}"
        group: "{{ multica_group }}"
        mode: "0700"
      become: true

    - name: "Agents | Run it as the daemon user | {{ _agent_key }}"
      ansible.builtin.command:
        argv: ["/bin/bash", "{{ multica_user_home }}/.cache/{{ _agent_key }}-install.sh"]
      become: true
      become_user: "{{ multica_user }}"
      environment: "{{ _multica_user_env }}"
      changed_when: true
      notify: restart multica daemon

- name: "Agents | Resolve and link onto the default PATH | {{ _agent_key }}"
  ansible.builtin.include_tasks: _link.yml