# test code update password for the mysql_user module
# (c) 2014,  Wayne Rosario <wrosario@ansible.com>

# This file is part of Ansible
#
# Ansible is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 dof the License, or
# (at your option) any later version.
#
# Ansible is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with Ansible.  If not, see <http://www.gnu.org/licenses/>.

# ============================================================
# Update user password for a user.
# Assert the user password is updated and old password can no longer be used.
#
- name: create user1 state=present with a password 
  mysql_user: name={{ user_name_1 }} password={{ user_password_1 }} priv=*.*:ALL state=present

- name: create user2 state=present with a password 
  mysql_user: name={{ user_name_2 }} password={{ user_password_2 }} priv=*.*:ALL state=present

- name: store user2 grants with old password (mysql 5.7.6 and newer)
  command: mysql "-e SHOW CREATE USER '{{ user_name_2 }}'@'localhost';"
  register: user_password_old_create
  ignore_errors: yes

- name: store user2 grants with old password  (mysql 5.7.5 and older)
  command: mysql "-e SHOW GRANTS FOR '{{ user_name_2 }}'@'localhost';"
  register: user_password_old  
  when: user_password_old_create|failed

# FIXME: not sure why this is failing, but it looks like it should expect changed=true
#- name: update user2 state=present with same password (expect changed=false)
#  mysql_user: name={{ user_name_2 }} password={{ user_password_2 }} priv=*.*:ALL state=present
#  register: result
#
#- name: assert output user2 was not updated 
#  assert: { that: "result.changed == false" }

- include: assert_user.yml user_name={{user_name_2}} priv='ALL PRIVILEGES'
 
- name: update user2 state=present with a new password (expect changed=true)
  mysql_user: name={{ user_name_2 }} password={{ user_password_1 }} state=present
  register: result

- include: assert_user.yml user_name={{user_name_2}} priv='ALL PRIVILEGES'

- name: store user2 grants with old password (mysql 5.7.6 and newer)
  command: mysql "-e SHOW CREATE USER '{{ user_name_2 }}'@'localhost';"
  register: user_password_new_create 
  ignore_errors: yes

- name: store user2 grants with new password 
  command: mysql "-e SHOW GRANTS FOR '{{ user_name_2 }}'@'localhost';"
  register: user_password_new 
  when: user_password_new_create|failed

- name: assert output message password was update for user2 (mysql 5.7.6 and newer)
  assert: { that: "user_password_old_create.stdout != user_password_new_create.stdout" }
  when: not user_password_new_create|failed

- name: assert output message password was update for user2 (mysql 5.7.5 and older)
  assert: { that: "user_password_old.stdout != user_password_new.stdout" }
  when: user_password_new_create|failed

- name: create database using user2 and old password
  mysql_db: name={{ db_name }} state=present login_user={{ user_name_2 }} login_password={{ user_password_2 }}
  ignore_errors: true 
  register: result

- debug: var=result.msg
- name: assert output message that database not create with old password 
  assert:
    that:
       - "result.failed == true"

- name: create database using user2 and new password
  mysql_db: name={{ db_name }} state=present login_user={{ user_name_2 }} login_password={{ user_password_1 }}
  register: result

- name: assert output message that database is created with new password
  assert: { that: "result.changed == true" }

- name: remove database
  mysql_db: name={{ db_name }} state=absent

- include: remove_user.yml user_name={{user_name_1}} user_password={{ user_password_1 }}

- include: remove_user.yml user_name={{user_name_2}} user_password={{ user_password_1 }}

- name: Create user with password1234 using hash. (expect changed=true)
  mysql_user: name=jmainguy password='*D65798AAC0E5C6DF3F320F8A30E026E7EBD73A95' encrypted=yes
  register: encrypt_result

- name: Check that the module made a change
  assert:
    that:
      - "encrypt_result.changed == True"

- name: See if the password needs to be updated. (expect changed=false)
  mysql_user: name=jmainguy password='password1234'
  register: plain_result

- name: Check that the module did not change the password
  assert:
    that:
      - "plain_result.changed == False"

- name: Remove user (cleanup)
  mysql_user: name=jmainguy state=absent
