---
# Assertions, not hope. Each of these has failed in practice for a different
# reason, so each gets its own check and its own error message.

- name: Verify | Daemon reports running
  ansible.builtin.command:
    argv: "{{ _multica_cmd + ['daemon', 'status', '--output', 'json'] }}"
  become: true
  become_user: "{{ multica_user }}"
  environment: "{{ _multica_user_env }}"
  register: _multica_verify_daemon
  until:
    - _multica_verify_daemon.rc == 0
    - (_multica_verify_daemon.stdout | from_json).status | default('') == 'running'
  retries: "{{ multica_verify_retries }}"
  delay: "{{ multica_verify_delay }}"
  changed_when: false
  check_mode: false

- name: Verify | Daemon is the pinned version and sees the configured workspaces root
  ansible.builtin.assert:
    that:
      - (_multica_verify_daemon.stdout | from_json).cli_version == multica_version
      - (_multica_verify_daemon.stdout | from_json).server_url | regex_replace('/$', '')
        == multica_server_url | regex_replace('/$', '')
    fail_msg: >-
      Daemon is running but does not match declared state:
      {{ _multica_verify_daemon.stdout }}
    quiet: true

- name: Verify | Every selected agent CLI is registered as an online runtime
  ansible.builtin.command:
    argv: "{{ _multica_cmd + ['runtime', 'list', '--output', 'json'] }}"
  become: true
  become_user: "{{ multica_user }}"
  environment: "{{ _multica_user_env }}"
  register: _multica_verify_runtimes
  until:
    - _multica_verify_runtimes.rc == 0
    - _multica_expected_providers
      | difference(_multica_verify_runtimes.stdout | from_json
          | selectattr('daemon_id', 'equalto', (_multica_verify_daemon.stdout | from_json).daemon_id)
          | selectattr('status', 'equalto', 'online')
          | map(attribute='provider') | list)
      | length == 0
  retries: "{{ multica_verify_retries }}"
  delay: "{{ multica_verify_delay }}"
  changed_when: false
  check_mode: false
  vars:
    _multica_expected_providers: >-
      {{ multica_agent_clis | map('extract', multica_agent_cli_catalog, 'provider') | list }}

- name: Verify | Runtimes name this host
  ansible.builtin.assert:
    that:
      - _multica_verify_runtimes.stdout | from_json
        | selectattr('daemon_id', 'equalto', (_multica_verify_daemon.stdout | from_json).daemon_id)
        | rejectattr('device_info', 'search', '^' ~ (multica_device_name | regex_escape))
        | list | length == 0
    fail_msg: >-
      Runtimes registered under this daemon do not report device_name
      "{{ multica_device_name }}".
    quiet: true

- name: Verify | Stat the workspaces root
  ansible.builtin.stat:
    path: "{{ multica_workspaces_root }}"
  register: _multica_verify_ws
  become: true

- name: Verify | Re-prove the daemon user can write to the workspaces root
  ansible.builtin.command:
    argv:
      - /bin/sh
      - -c
      - 'd="$1"; f="$d/.multica-write-test.$$"; : > "$f" && rm -f "$f"'
      - sh
      - "{{ multica_workspaces_root }}"
  become: true
  become_user: "{{ multica_user }}"
  register: _multica_verify_ws_write
  changed_when: false
  failed_when: false
  check_mode: false

- name: Verify | Workspaces root assertions
  ansible.builtin.assert:
    that:
      - _multica_verify_ws.stat.exists
      - _multica_verify_ws.stat.isdir
      - _multica_verify_ws.stat.pw_name == multica_user
      - _multica_verify_ws_write.rc == 0
    fail_msg: >-
      {{ multica_workspaces_root }} is missing, not a directory, or not
      owned/writable by {{ multica_user }}.
    quiet: true

- name: Verify | Workspaces root is on the expected mount
  ansible.builtin.assert:
    that:
      - multica_workspaces_root_mount in (ansible_facts['mounts'] | map(attribute='mount') | list)
    fail_msg: "{{ multica_workspaces_root_mount }} is not mounted."
    quiet: true
  when: multica_workspaces_root_mount | length > 0

- name: Verify | Report what still needs a human
  ansible.builtin.debug:
    msg: >-
      {{ multica_device_name }} is provisioned: multica {{ multica_version }},
      daemon running, runtimes online for
      {{ multica_agent_clis | join(', ') }}.
      Remaining manual step(s):
      {{ multica_agent_clis
         | select('in', multica_agent_cli_catalog)
         | map('extract', multica_agent_cli_catalog)
         | selectattr('manual_login', 'defined')
         | selectattr('manual_login')
         | map(attribute='manual_login_hint')
         | list | join('; ') | default('none', true) }}