vps/ansible/roles/unifi_sso/tasks/main.yml

---
# Reconcile super_sdn.sso_login_enabled on the UniFi controller DB.
# Idempotent: reads the current value, reports compliance when it already
# matches the target, and only mutates with explicit confirmation.

- name: Require a boolean target value
  ansible.builtin.assert:
    that:
      - unifi_sso_target_value | type_debug == 'bool'
    fail_msg: "unifi_sso_target_value must be a boolean (true or false)."

- name: Read current SSO login setting
  ansible.builtin.command:
    argv:
      - docker
      - exec
      - "{{ unifi_container }}"
      - mongo
      - --port
      - "{{ unifi_mongo_port }}"
      - --quiet
      - ace
      - --eval
      - 'db.setting.findOne({key:"super_sdn"}).sso_login_enabled'
  register: unifi_sso_current
  changed_when: false
  failed_when: unifi_sso_current.rc != 0
  check_mode: false

- name: Report current setting
  ansible.builtin.debug:
    msg: >-
      sso_login_enabled={{ unifi_sso_current.stdout | trim }}
      (target={{ unifi_sso_target_value | string | lower }})

- name: Report already compliant
  ansible.builtin.debug:
    msg: "Already compliant; no change needed."
  when: unifi_sso_current.stdout | trim | lower == unifi_sso_target_value | string | lower

- name: Refuse to change without explicit confirmation
  ansible.builtin.fail:
    msg: >-
      Change required (sso_login_enabled={{ unifi_sso_current.stdout | trim }}
      != target {{ unifi_sso_target_value | string | lower }}) but
      unifi_sso_confirm is not true. Supply unifi_sso_confirm=true to apply.
  when:
    - unifi_sso_current.stdout | trim | lower != unifi_sso_target_value | string | lower
    - not (unifi_sso_confirm | bool)

- name: Apply SSO login setting change
  ansible.builtin.command:
    argv:
      - docker
      - exec
      - "{{ unifi_container }}"
      - mongo
      - --port
      - "{{ unifi_mongo_port }}"
      - --quiet
      - ace
      - --eval
      - >-
        db.setting.updateOne({key:"super_sdn"},
        {$set:{sso_login_enabled: {{ unifi_sso_target_value | string | lower }}}})
  when:
    - unifi_sso_confirm | bool
    - unifi_sso_current.stdout | trim | lower != unifi_sso_target_value | string | lower
  changed_when: true
  register: unifi_sso_update

- name: Restart controller to apply setting when requested
  ansible.builtin.command:
    argv: [docker, restart, "{{ unifi_container }}"]
  when:
    - unifi_sso_restart_controller | bool
    - unifi_sso_current.stdout | trim | lower != unifi_sso_target_value | string | lower
  changed_when: true

- name: Verify setting after change
  ansible.builtin.command:
    argv:
      - docker
      - exec
      - "{{ unifi_container }}"
      - mongo
      - --port
      - "{{ unifi_mongo_port }}"
      - --quiet
      - ace
      - --eval
      - 'db.setting({key:"super_sdn"}).sso_login_enabled'
  register: unifi_sso_verify
  changed_when: false
  check_mode: false
  when:
    - unifi_sso_current.stdout | trim | lower != unifi_sso_target_value | string | lower
    - not ansible_check_mode

- name: Assert verified value matches target
  ansible.builtin.assert:
    that:
      - unifi_sso_verify.stdout | trim | lower == unifi_sso_target_value | string | lower
    fail_msg: >-
      Verification failed: sso_login_enabled is
      {{ unifi_sso_verify.stdout | trim }} but expected
      {{ unifi_sso_target_value | string | lower }}.
  when:
    - unifi_sso_current.stdout | trim | lower != unifi_sso_target_value | string | lower
    - not ansible_check_mode