---
- name: Validate rendering case inputs
  ansible.builtin.include_tasks: ../tasks/validate.yml

- name: Reset rendered resources
  ansible.builtin.set_fact:
    wikideck_test_manifests: {}

- name: Render and parse all Kubernetes templates
  ansible.builtin.set_fact:
    wikideck_test_manifests: >-
      {{ wikideck_test_manifests | combine({item: lookup('ansible.builtin.template',
         playbook_dir ~ '/../templates/' ~ item ~ '.yml.j2') | from_yaml}) }}
  loop: [deployment, service, serviceaccount, pvc, ingress, networkpolicy]

- name: Check safety and wiring invariants
  ansible.builtin.assert:
    that:
      - deployment.spec.replicas == 1
      - deployment.spec.strategy.type == 'Recreate'
      - deployment.spec.template.metadata.annotations == wikideck_pod_annotations
      - deployment.spec.selector.matchLabels == deployment.spec.template.metadata.labels
      - wikideck_test_manifests.service.spec.selector == deployment.spec.selector.matchLabels
      - wikideck_test_manifests.networkpolicy.spec.podSelector.matchLabels == deployment.spec.selector.matchLabels
      - wikideck_test_manifests.service.spec.type == 'ClusterIP'
      - wikideck_test_manifests.service.spec.ports[0].targetPort == 'http'
      - pod.serviceAccountName == wikideck_name
      - not pod.automountServiceAccountToken
      - not wikideck_test_manifests.serviceaccount.automountServiceAccountToken
      - pod.securityContext.runAsNonRoot and pod.securityContext.runAsUser == 1000
      - pod.securityContext.fsGroup == 1000
      - pod.securityContext.seccompProfile.type == 'RuntimeDefault'
      - container.securityContext.readOnlyRootFilesystem
      - not container.securityContext.allowPrivilegeEscalation
      - container.securityContext.capabilities.drop == ['ALL']
      - container.image == wikideck_image
      - container.imagePullPolicy == wikideck_image_pull_policy
      - container.resources == wikideck_resources
      - container.ports[0].containerPort == 3001
      - container.startupProbe.httpGet.path == '/healthz'
      - container.startupProbe.failureThreshold == wikideck_startup_probe_failure_threshold
      - container.startupProbe.periodSeconds == 5
      - container.readinessProbe.httpGet.path == '/healthz'
      - container.livenessProbe.httpGet.path == '/healthz'
      - pod.terminationGracePeriodSeconds >= 30
      - pod.volumes[0].persistentVolumeClaim.claimName == expected_claim
      - pod.volumes[1].emptyDir.medium == 'Memory'
      - container.volumeMounts[0].mountPath == '/app/data'
      - env.HOST == '0.0.0.0' and env.PORT == '3001'
      - env.WIKIDECK_DATA_DIR == '/app/data' and env.NODE_ENV == 'production'
      - env.WIKIDECK_PEERS == wikideck_peers | join(',')
      - env.WIKIDECK_ALLOW_PRIVATE_PEERS == ('1' if wikideck_allow_private_peers else '0')
      - env.WIKIDECK_MAINNET_LAUNCH == wikideck_mainnet_launch
      - env.WIKIDECK_MAINNET_RISK_ACK == wikideck_mainnet_risk_ack
      - (env.WIKIDECK_TRUSTED_PROXIES | default('')) == wikideck_trusted_proxies | join(',')
      - (env.WIKIDECK_OPS_PORT | default('')) == (wikideck_ops_port | string)
      - env.WIKIDECK_OFFLINE is not defined
      - env.RANDOMX_BINARY is not defined
      - container.command is not defined and container.args is not defined
      - pod.containers | length == 1
      - (env.PUBLIC_ORIGIN | default('')) == wikideck_public_origin
      - wikideck_test_manifests.pvc.spec.accessModes == wikideck_storage_access_modes
      - wikideck_test_manifests.ingress.spec.tls[0].secretName == wikideck_tls_secret_name
      - wikideck_test_manifests.ingress.spec.rules[0].host == wikideck_ingress_host
      - wikideck_test_manifests.ingress.spec.rules[0].http.paths[0].backend.service.name == wikideck_name
      - wikideck_test_manifests.ingress.metadata.annotations == wikideck_ingress_annotations
      - (wikideck_test_manifests.ingress.spec.ingressClassName | default('')) == wikideck_ingress_class_name
      - (pod.imagePullSecrets | default([]) | map(attribute='name') | list) == wikideck_image_pull_secrets
      - wikideck_test_manifests.networkpolicy.spec.policyTypes == ['Ingress', 'Egress']
      - wikideck_test_manifests.networkpolicy.spec.ingress | length == (1 if wikideck_network_policy_ingress_from | length > 0 else 0)
      - wikideck_test_manifests.networkpolicy.spec.egress | length == expected_egress_count | int
      - wikideck_resources.requests.memory == '512Mi'
      - wikideck_resources.limits.memory == '1Gi'
  vars:
    deployment: "{{ wikideck_test_manifests.deployment }}"
    pod: "{{ deployment.spec.template.spec }}"
    container: "{{ pod.containers[0] }}"
    env: "{{ dict(container.env | map(attribute='name') | zip(container.env | map(attribute='value'))) }}"
    expected_claim: "{{ wikideck_existing_claim if wikideck_existing_claim | length > 0 else wikideck_name ~ '-data' }}"
    expected_egress_count: >-
      {{ (1 if wikideck_network_policy_dns_to | length > 0 else 0)
         + (1 if wikideck_peers | length > 0 and wikideck_network_policy_https_to | length > 0
                 and wikideck_network_policy_https_ports | length > 0 else 0)
         + (wikideck_network_policy_peer_egress | length if wikideck_peers | length > 0 else 0) }}

- name: Check public peer egress destinations and ports
  ansible.builtin.assert:
    that:
      - public_rule.to == wikideck_network_policy_https_to
      - public_rule.ports | map(attribute='port') | list == wikideck_network_policy_https_ports
      - public_rule.ports | map(attribute='protocol') | unique | list == ['TCP']
  vars:
    public_rule: "{{ wikideck_test_manifests.networkpolicy.spec.egress[1 if wikideck_network_policy_dns_to | length > 0 else 0] }}"
  when:
    - wikideck_peers | length > 0
    - wikideck_network_policy_https_to | length > 0
    - wikideck_network_policy_https_ports | length > 0

- name: Check explicit peer egress survives unchanged
  ansible.builtin.assert:
    that: wikideck_test_manifests.networkpolicy.spec.egress[-(wikideck_network_policy_peer_egress | length):] == wikideck_network_policy_peer_egress
  when:
    - wikideck_peers | length > 0
    - wikideck_network_policy_peer_egress | length > 0

- name: Check omitted default StorageClass
  ansible.builtin.assert:
    that: wikideck_test_manifests.pvc.spec.storageClassName is not defined
  when: wikideck_storage_class is none

- name: Check explicit StorageClass including empty string
  ansible.builtin.assert:
    that: wikideck_test_manifests.pvc.spec.storageClassName == wikideck_storage_class
  when: wikideck_storage_class is not none