---
- name: Test netgroup
  hosts: "{{ ipa_test_host | default('ipaserver') }}"
  become: no
  gather_facts: no

  tasks:
  - name: Test netgroup
    block:
    # CLEANUP TEST ITEMS
    - name: Ensure netgroups are absent
      ipanetgroup:
        ipaadmin_password: SomeADMINpassword
        ipaapi_context: "{{ ipa_context | default(omit) }}"
        name:
          - my_netgroup1
          - my_netgroup2
          - my_netgroup3
        state: absent

    # CREATE TEST ITEMS
    - name: Get Domain from server name
      ansible.builtin.set_fact:
        ipaserver_domain: "{{ ansible_facts['fqdn'].split('.')[1:] | join ('.') }}"
      when: ipaserver_domain is not defined

    - name: Ensure netgroup my_netgroup2 is present
      ipanetgroup:
        ipaadmin_password: SomeADMINpassword
        ipaapi_context: "{{ ipa_context | default(omit) }}"
        name: my_netgroup2

    - name: Ensure netgroup my_netgroup3 is present
      ipanetgroup:
        ipaadmin_password: SomeADMINpassword
        ipaapi_context: "{{ ipa_context | default(omit) }}"
        name: my_netgroup3

    # TESTS

    - name: Ensure netgroup my_netgroup1 is present
      ipanetgroup:
        ipaadmin_password: SomeADMINpassword
        ipaapi_context: "{{ ipa_context | default(omit) }}"
        name: my_netgroup1
      register: result
      failed_when: not result.changed or result.failed

    - name: Ensure netgroup my_netgroup1 is present again
      ipanetgroup:
        ipaadmin_password: SomeADMINpassword
        ipaapi_context: "{{ ipa_context | default(omit) }}"
        name: my_netgroup1
      register: result
      failed_when: result.changed or result.failed

    - name: Ensure netgroup my_netgroup1 is present with description and
        nisdomain
      ipanetgroup:
        ipaadmin_password: SomeADMINpassword
        ipaapi_context: "{{ ipa_context | default(omit) }}"
        name: my_netgroup1
        description: My netgroup 1
        nisdomain: domain.test
      register: result
      failed_when: not result.changed or result.failed

    - name: Ensure netgroup my_netgroup1 is present with new description
        and new nisdomain
      ipanetgroup:
        ipaadmin_password: SomeADMINpassword
        ipaapi_context: "{{ ipa_context | default(omit) }}"
        name: my_netgroup1
        description: New description
        nisdomain: new-domain.test
      register: result
      failed_when: not result.changed or result.failed

    - name: Ensure netgroup my_netgroup1 is present with description and
        nisdomain again
      ipanetgroup:
        ipaadmin_password: SomeADMINpassword
        ipaapi_context: "{{ ipa_context | default(omit) }}"
        name: my_netgroup1
        description: New description
        nisdomain: new-domain.test
      register: result
      failed_when: result.changed or result.failed

    - name: Ensure 2 netgroups aren't present
      ipanetgroup:
        ipaadmin_password: SomeADMINpassword
        ipaapi_context: "{{ ipa_context | default(omit) }}"
        name:
          - my_netgroup1
          - my_netgroup2
      register: result
      failed_when: result.changed or not result.failed or
        "Only one netgroup can be added at a time." not in result.msg

    - name: Ensure netgroup my_netgroup1 is absent
      ipanetgroup:
        ipaadmin_password: SomeADMINpassword
        ipaapi_context: "{{ ipa_context | default(omit) }}"
        name: my_netgroup1
        state: absent
      register: result
      failed_when: not result.changed or result.failed

    - name: Ensure netgroup my_netgroup1 is absent again
      ipanetgroup:
        ipaadmin_password: SomeADMINpassword
        ipaapi_context: "{{ ipa_context | default(omit) }}"
        name: my_netgroup1
        state: absent
      register: result
      failed_when: result.changed or result.failed

    # netgroup and hostgroup with the same name are deprecated
    - name: Ensure hostgroup my_netgroup2 isn't present
      ipahostgroup:
        ipaadmin_password: SomeADMINpassword
        ipaapi_context: "{{ ipa_context | default(omit) }}"
        name: my_netgroup2
      register: result
      failed_when: result.changed or not result.failed or
        "Hostgroups and netgroups share a common namespace" not in result.msg

    - name: Ensure netgroups my_netgroup2, my_netgroup3 are absent
      ipanetgroup:
        ipaadmin_password: SomeADMINpassword
        ipaapi_context: "{{ ipa_context | default(omit) }}"
        name:
          - my_netgroup2
          - my_netgroup3
        state: absent
      register: result
      failed_when: not result.changed

    always:
    # cleanup
    - name: Ensure netgroups are absent
      ipanetgroup:
        ipaadmin_password: SomeADMINpassword
        ipaapi_context: "{{ ipa_context | default(omit) }}"
        name:
          - my_netgroup1
          - my_netgroup2
          - my_netgroup3
        state: absent