---
# `multica auth status` prints the server and user when authenticated and exits
# non-zero otherwise, so it is the idempotency guard for login.
- name: Auth | Read the current authentication state
  ansible.builtin.command:
    argv: "{{ _multica_cmd + ['auth', 'status'] }}"
  become: true
  become_user: "{{ multica_user }}"
  environment: "{{ _multica_user_env }}"
  register: _multica_auth_status
  changed_when: false
  failed_when: false
  check_mode: false

- name: Auth | Decide whether a login is needed
  ansible.builtin.set_fact:
    _multica_needs_login: >-
      {{ multica_force_relogin | bool
         or _multica_auth_status.rc != 0
         or multica_server_url.rstrip('/') not in (_multica_auth_status.stdout | default('')) }}

# no_log is mandatory: without it Ansible records the full argv — including the
# PAT — in play output, CI logs, and every callback plugin.
- name: Auth | Log in with the personal access token
  ansible.builtin.command:
    argv: "{{ _multica_cmd + ['login', '--token', multica_pat] }}"
  become: true
  become_user: "{{ multica_user }}"
  environment: "{{ _multica_user_env }}"
  when: _multica_needs_login | bool
  changed_when: true
  no_log: true
  notify: restart multica daemon

- name: Auth | Pin the default workspace
  ansible.builtin.command:
    argv: "{{ _multica_cmd + ['workspace', 'switch', multica_workspace_id] }}"
  become: true
  become_user: "{{ multica_user }}"
  environment: "{{ _multica_user_env }}"
  when: multica_workspace_id | length > 0
  register: _multica_ws_switch
  changed_when: _multica_needs_login | bool
  notify: restart multica daemon