---
# Offline tests: no Kubernetes credentials or API calls.
- name: Validate role configuration and rendered Kubernetes resources
  hosts: localhost
  connection: local
  gather_facts: false
  vars_files:
    - ../defaults/main.yml
  tasks:
    - name: Test rendering variants
      ansible.builtin.include_tasks: render_case.yml
      vars:
        wikideck_image: "{{ render_case.image | default('registry.example.com/wikideck:1.0.0') }}"
        wikideck_name: "{{ render_case.name | default('wikideck') }}"
        wikideck_namespace: "{{ render_case.namespace | default('wikideck') }}"
        wikideck_offline: "{{ render_case.offline | default(false) }}"
        wikideck_ingress_enabled: "{{ render_case.ingress | default(false) }}"
        wikideck_ingress_host: wikideck.example.com
        wikideck_public_origin: "{{ 'https://wikideck.example.com' if render_case.ingress | default(false) else '' }}"
        wikideck_ingress_class_name: "{{ render_case.ingress_class | default('') }}"
        wikideck_ingress_annotations: "{{ render_case.annotations | default({}) }}"
        wikideck_storage_class: "{{ render_case.storage_class | default(none) }}"
        wikideck_existing_claim: "{{ render_case.existing_claim | default('') }}"
        wikideck_image_pull_secrets: "{{ render_case.pull_secrets | default([]) }}"
        wikideck_network_policy_ingress_from: "{{ render_case.ingress_from | default([{'podSelector': {}}]) }}"
        wikideck_network_policy_dns_to: "{{ render_case.dns_to | default([{'namespaceSelector': {}}]) }}"
        wikideck_network_policy_https_to: "{{ render_case.https_to | default([{'ipBlock': {'cidr': '0.0.0.0/0'}}]) }}"
      loop:
        - label: defaults
        - label: TLS ingress and existing storage
          ingress: true
          ingress_class: nginx
          annotations:
            cert-manager.io/cluster-issuer: letsencrypt-prod
          existing_claim: existing-chain
          storage_class: fast-encrypted
          pull_secrets: [registry-credentials]
          name: custom-deck
          namespace: games
        - label: offline and no storage class
          offline: true
          storage_class: ""
        - label: default-deny all traffic
          ingress_from: []
          dns_to: []
          https_to: []
        - label: DNS-only offline mode
          offline: true
        - label: digest-pinned image
          image: registry.example.com/wikideck@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
      loop_control:
        loop_var: render_case
        label: "{{ render_case.label }}"

    - name: Test invalid settings are rejected
      ansible.builtin.include_tasks: invalid_case.yml
      loop:
        - label: missing image
          image: ""
        - label: untagged image
          image: registry.example.com/wikideck
        - label: registry port is not an image tag
          image: registry.example.com:5000/wikideck
        - label: malformed image digest
          image: registry.example.com/wikideck@sha256:abcd
        - label: invalid resource name
          name: Invalid_Name
        - label: unsafe multi-writer storage
          access_modes: [ReadWriteMany]
        - label: missing ingress origin
          ingress: true
        - label: mismatched ingress origin
          ingress: true
          origin: https://another.example.com
        - label: insecure public origin
          origin: http://wikideck.example.com
        - label: origin with path
          origin: https://wikideck.example.com/path
        - label: invalid ingress hostname
          ingress: true
          host: invalid_host
          origin: https://wikideck.example.com
        - label: missing resource limits
          resources:
            requests: {cpu: 100m, memory: 128Mi}
        - label: ambiguous boolean
          offline: "false"
        - label: wrong list type
          pull_secrets: not-a-list
        - label: empty peer allows all traffic
          ingress_from: [{}]
      loop_control:
        loop_var: invalid_case
        label: "{{ invalid_case.label }}"