# SPDX-License-Identifier: MIT-0
---
- name: Validate deployment settings
  ansible.builtin.assert:
    that:
      - wikideck_image is string and wikideck_image | length > 0
      - wikideck_image is match('^[^\s@]+(:[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}|@sha256:[a-f0-9]{64})$')
      - wikideck_name is string and wikideck_name is match('^[a-z]([a-z0-9-]*[a-z0-9])?$')
      - wikideck_name | length <= 50
      - wikideck_namespace is string and wikideck_namespace is match('^[a-z0-9]([a-z0-9-]*[a-z0-9])?$')
      - wikideck_namespace | length <= 63
      - wikideck_image_pull_policy in ['Always', 'IfNotPresent', 'Never']
      - wikideck_wait_timeout | string is match('^[1-9][0-9]*$')
      - wikideck_resources is mapping
      - wikideck_resources.requests is defined and wikideck_resources.requests is mapping
      - wikideck_resources.limits is defined and wikideck_resources.limits is mapping
      - wikideck_resources.requests.cpu is defined and wikideck_resources.requests.memory is defined
      - wikideck_resources.limits.cpu is defined and wikideck_resources.limits.memory is defined
      - wikideck_node_selector is mapping
      - wikideck_affinity is mapping
      - wikideck_ingress_annotations is mapping
      - wikideck_storage_size is string and wikideck_storage_size | length > 0
      - wikideck_storage_access_modes | length > 0
      - wikideck_storage_access_modes | difference(['ReadWriteOnce', 'ReadWriteOncePod']) | length == 0
      - wikideck_storage_class is none or wikideck_storage_class is string
      - wikideck_existing_claim is string
      - wikideck_existing_claim | length == 0 or wikideck_existing_claim is match('^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$')
      - wikideck_public_origin is string
      - wikideck_public_origin | length == 0 or wikideck_public_origin is match('^https://[a-z0-9.-]+(:[0-9]+)?$')
      - wikideck_ingress_enabled is boolean
      - wikideck_network_policy_enabled is boolean
      - wikideck_offline is boolean
      - wikideck_create_namespace is boolean
      - wikideck_wait is boolean
    fail_msg: >-
      Provide a tagged or digest-pinned wikideck_image and valid Kubernetes names.
      Resources need CPU/memory requests and limits; storage must be single-writer.
      PUBLIC_ORIGIN must be an HTTPS origin without a path or trailing slash.

- name: Validate TLS ingress settings
  ansible.builtin.assert:
    that:
      - wikideck_ingress_host is string and wikideck_ingress_host | length > 0
      - wikideck_ingress_host | length <= 253
      - wikideck_ingress_host is match('^([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)*[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$')
      - wikideck_tls_secret_name is string and wikideck_tls_secret_name | length > 0
      - wikideck_public_origin == 'https://' ~ wikideck_ingress_host
    fail_msg: >-
      Ingress requires a DNS hostname, a TLS Secret name, and wikideck_public_origin
      set to https:// followed by exactly wikideck_ingress_host.
  when: wikideck_ingress_enabled | bool

- name: Validate list settings
  ansible.builtin.assert:
    that:
      - lookup('ansible.builtin.vars', item) is sequence
      - lookup('ansible.builtin.vars', item) is not string
      - lookup('ansible.builtin.vars', item) is not mapping
    fail_msg: "{{ item }} must be a list."
  loop:
    - wikideck_image_pull_secrets
    - wikideck_tolerations
    - wikideck_storage_access_modes
    - wikideck_network_policy_ingress_from
    - wikideck_network_policy_dns_to
    - wikideck_network_policy_https_to

- name: Require explicit network policy peers
  ansible.builtin.assert:
    that:
      - item is mapping
      - item | length > 0
    fail_msg: Use an explicit podSelector, namespaceSelector, or ipBlock rather than an empty peer.
  loop: >-
    {{ wikideck_network_policy_ingress_from + wikideck_network_policy_dns_to
       + wikideck_network_policy_https_to }}
  when: wikideck_network_policy_enabled | bool