# SPDX-License-Identifier: MIT-0
---
- name: Validate deployment settings
  ansible.builtin.assert:
    that:
      - wikideck_image is string and wikideck_image | length > 0
      - wikideck_image is match('^[^\s@]+(:[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}|@sha256:[a-f0-9]{64})$')
      - wikideck_name is string and wikideck_name is match('^[a-z]([a-z0-9-]*[a-z0-9])?$')
      - wikideck_name | length <= 50
      - wikideck_namespace is string and wikideck_namespace is match('^[a-z0-9]([a-z0-9-]*[a-z0-9])?$')
      - wikideck_namespace | length <= 63
      - wikideck_image_pull_policy in ['Always', 'IfNotPresent', 'Never']
      - wikideck_wait_timeout | string is match('^[1-9][0-9]*$')
      - wikideck_startup_probe_failure_threshold is integer and wikideck_startup_probe_failure_threshold > 0
      - wikideck_resources is mapping
      - wikideck_resources.requests is defined and wikideck_resources.requests is mapping
      - wikideck_resources.limits is defined and wikideck_resources.limits is mapping
      - wikideck_resources.requests.cpu is defined and wikideck_resources.requests.memory is defined
      - wikideck_resources.limits.cpu is defined and wikideck_resources.limits.memory is defined
      - wikideck_node_selector is mapping
      - wikideck_affinity is mapping
      - wikideck_ingress_annotations is mapping
      - wikideck_storage_size is string and wikideck_storage_size | length > 0
      - wikideck_storage_access_modes | length > 0
      - wikideck_storage_access_modes | difference(['ReadWriteOnce', 'ReadWriteOncePod']) | length == 0
      - wikideck_storage_class is none or wikideck_storage_class is string
      - wikideck_existing_claim is string
      - wikideck_existing_claim | length == 0 or wikideck_existing_claim is match('^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$')
      - wikideck_public_origin is string
      - wikideck_public_origin | length == 0 or wikideck_public_origin is match('^https://[a-z0-9.-]+(:[0-9]+)?$')
      - wikideck_mainnet_launch is string
      - wikideck_mainnet_launch | length == 0 or wikideck_mainnet_launch is match('^[a-f0-9]{64}$')
      - wikideck_mainnet_risk_ack is string
      - wikideck_mainnet_risk_ack in ['', 'operator-accepts-unaudited-risk']
      - wikideck_trusted_proxies is sequence and wikideck_trusted_proxies is not string and wikideck_trusted_proxies is not mapping
      - wikideck_trusted_proxies | length <= 16
      - wikideck_trusted_proxies | select('string') | list | length == wikideck_trusted_proxies | length
      - wikideck_trusted_proxies | select('match', '^[0-9a-fA-F:.]+(/[0-9]{1,3})?$') | list | length == wikideck_trusted_proxies | length
      - wikideck_ops_port is string or wikideck_ops_port is integer
      - wikideck_ops_port | string | length == 0 or ((wikideck_ops_port | string) is match('^[1-9][0-9]{0,4}$') and wikideck_ops_port | int <= 65535)
      - wikideck_ingress_enabled is boolean
      - wikideck_network_policy_enabled is boolean
      - wikideck_allow_private_peers is boolean
      - wikideck_create_namespace is boolean
      - wikideck_wait is boolean
    fail_msg: >-
      Provide a tagged or digest-pinned wikideck_image and valid Kubernetes names.
      Resources need CPU/memory requests and limits; storage must be single-writer.
      PUBLIC_ORIGIN must be an HTTPS origin without a path or trailing slash.

- name: Validate TLS ingress settings
  ansible.builtin.assert:
    that:
      - wikideck_ingress_host is string and wikideck_ingress_host | length > 0
      - wikideck_ingress_host | length <= 253
      - wikideck_ingress_host is match('^([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)*[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$')
      - wikideck_tls_secret_name is string and wikideck_tls_secret_name | length > 0
      - wikideck_public_origin == 'https://' ~ wikideck_ingress_host
    fail_msg: >-
      Ingress requires a DNS hostname, a TLS Secret name, and wikideck_public_origin
      set to https:// followed by exactly wikideck_ingress_host.
  when: wikideck_ingress_enabled | bool

- name: Validate list settings
  ansible.builtin.assert:
    that:
      - lookup('ansible.builtin.vars', item) is sequence
      - lookup('ansible.builtin.vars', item) is not string
      - lookup('ansible.builtin.vars', item) is not mapping
    fail_msg: "{{ item }} must be a list."
  loop:
    - wikideck_image_pull_secrets
    - wikideck_tolerations
    - wikideck_storage_access_modes
    - wikideck_network_policy_ingress_from
    - wikideck_network_policy_dns_to
    - wikideck_network_policy_https_to
    - wikideck_network_policy_https_ports
    - wikideck_network_policy_peer_egress
    - wikideck_peers
    - wikideck_trusted_proxies

- name: Validate the static peer allowlist
  ansible.builtin.assert:
    that:
      - wikideck_peers | length <= 16
    fail_msg: Wikideck supports at most 16 configured peer origins.

- name: Validate peer origins without credentials or paths
  ansible.builtin.assert:
    that:
      - item is string
      - item | length <= 2048
      - item is match('^https?://([a-zA-Z0-9]([a-zA-Z0-9.-]*[a-zA-Z0-9])?|\[[0-9a-fA-F:]+\])(:[0-9]{1,5})?$')
      - wikideck_allow_private_peers or item is match('^https://')
    fail_msg: >-
      Peers must be HTTPS origins without credentials, paths, commas, queries or
      fragments. Private/HTTP test peers require wikideck_allow_private_peers=true.
      Wikideck additionally validates ports and public DNS/IP addresses at runtime.
  loop: "{{ wikideck_peers }}"

- name: Validate public peer egress ports
  ansible.builtin.assert:
    that:
      - item is integer and item > 0 and item <= 65535
    fail_msg: HTTPS egress ports must be integers in the range 1..65535.
  loop: "{{ wikideck_network_policy_https_ports }}"

- name: Validate explicit peer egress rules
  ansible.builtin.assert:
    that:
      - item is mapping
      - item.to is defined and item.to is sequence and item.to is not string and item.to is not mapping
      - item.to | length > 0
      - item.ports is defined and item.ports is sequence and item.ports is not string and item.ports is not mapping
      - item.ports | length > 0
    fail_msg: Peer egress rules require explicit nonempty to and ports lists.
  loop: "{{ wikideck_network_policy_peer_egress }}"

- name: Validate explicit peer egress TCP ports
  ansible.builtin.assert:
    that:
      - item is mapping
      - item.protocol | default('TCP') == 'TCP'
      - item.port is defined and item.port is integer and item.port > 0 and item.port <= 65535
      - item.endPort is not defined
    fail_msg: Peer egress ports must be individual numeric TCP ports in the range 1..65535.
  loop: "{{ wikideck_network_policy_peer_egress | map(attribute='ports') | flatten }}"

- name: Require explicit network policy peers
  ansible.builtin.assert:
    that:
      - item is mapping
      - item | length > 0
    fail_msg: Use an explicit podSelector, namespaceSelector, or ipBlock rather than an empty peer.
  loop: >-
    {{ wikideck_network_policy_ingress_from + wikideck_network_policy_dns_to
       + wikideck_network_policy_https_to
       + (wikideck_network_policy_peer_egress | map(attribute='to') | flatten) }}
  when: wikideck_network_policy_enabled | bool