---
- name: Validate Dex deployment configuration
  ansible.builtin.assert:
    that:
      - dex_issuer is match('^https://[^/@]+')
      - dex_hostname is match('^[a-z0-9][a-z0-9.-]*[a-z0-9]$')
      - dex_postgres_password | length > 0
      - dex_ldap_bind_password | length > 0
      - not (dex_ldap_insecure_no_ssl | bool and dex_ldap_start_tls | bool)
      - not dex_postgres_manage or dex_postgres_chart_version | length > 0
      - not dex_postgres_manage or dex_postgres_admin_password | length > 0
      - not dex_matrix_client_enabled or matrix_dex_oidc_client_secret | default('') | length > 0
    fail_msg: Configure database/LDAP credentials, client secrets and explicit database chart version if managing PostgreSQL.
  no_log: true

- name: Validate explicit OIDC clients
  ansible.builtin.assert:
    that:
      - item.id | default('') | length > 0
      - item.name | default('') | length > 0
      - item.redirectURIs | default([]) | length > 0
      - item.public | default(false) or ((item.secret | default('') | length > 0) != (item.secretEnv | default('') | length > 0))
    fail_msg: Every confidential client needs an ID, name, exact callback URI and either a secret or secretEnv, but not both.
  loop: "{{ dex_static_clients }}"
  no_log: true

- name: Reject duplicate explicit client IDs
  ansible.builtin.assert:
    that:
      - dex_static_clients | map(attribute='id') | unique | length == dex_static_clients | length
  no_log: true

- name: Ensure Dex namespace
  kubernetes.core.k8s:
    state: present
    definition:
      apiVersion: v1
      kind: Namespace
      metadata:
        name: "{{ dex_namespace }}"

- name: Register Dex Helm repository
  kubernetes.core.helm_repository:
    name: dex
    repo_url: https://charts.dexidp.io

- name: Manage PostgreSQL only when explicitly requested
  ansible.builtin.include_tasks: postgres.yml
  when: dex_postgres_manage | bool

- name: Deploy Catppuccin theme assets
  kubernetes.core.k8s:
    state: present
    definition:
      apiVersion: v1
      kind: ConfigMap
      metadata:
        name: "{{ dex_theme_configmap_name }}"
        namespace: "{{ dex_namespace }}"
      data:
        styles.css: "{{ lookup('ansible.builtin.file', role_path ~ '/files/styles.css') }}"
        logo.svg: "{{ lookup('ansible.builtin.file', role_path ~ '/files/logo.svg') }}"
  when: dex_theme_enabled | bool

- name: Deploy Dex using its existing Helm release
  kubernetes.core.helm:
    name: "{{ dex_release_name }}"
    chart_ref: dex/dex
    chart_version: "{{ dex_chart_version }}"
    release_namespace: "{{ dex_namespace }}"
    create_namespace: true
    update_repo_cache: true
    reset_values: true
    wait: true
    timeout: "{{ dex_wait_timeout }}"
    values: "{{ lookup('ansible.builtin.template', 'values.yml.j2') | from_yaml }}"
  no_log: true
  diff: false