---
- name: Inspect Matrix bootstrap directory without reading secrets
  ansible.builtin.stat:
    path: "{{ matrix_bootstrap_dir }}"
  register: matrix_secret_bootstrap_dir

- name: Assert Matrix bootstrap directory is root-only
  ansible.builtin.assert:
    that:
      - matrix_secret_bootstrap_dir.stat.exists
      - matrix_secret_bootstrap_dir.stat.isdir
      - matrix_secret_bootstrap_dir.stat.pw_name == 'root'
      - matrix_secret_bootstrap_dir.stat.gr_name == 'root'
      - matrix_secret_bootstrap_dir.stat.mode == '0700'
    fail_msg: "{{ matrix_bootstrap_dir }} must be a root:root 0700 directory."

- name: Inspect required individual bootstrap secret files without reading them
  ansible.builtin.stat:
    path: "{{ matrix_bootstrap_dir }}/{{ item }}"
  loop: "{{ matrix_required_bootstrap_files }}"
  register: matrix_secret_bootstrap_files
  no_log: true

- name: Assert required bootstrap secret file permissions
  ansible.builtin.assert:
    that:
      - item.stat.exists
      - item.stat.isreg
      - item.stat.pw_name == 'root'
      - item.stat.gr_name == 'root'
      - item.stat.mode == '0600'
    fail_msg: A required root-only Matrix bootstrap file is missing or has unsafe permissions.
  loop: "{{ matrix_secret_bootstrap_files.results }}"
  no_log: true

- name: Inspect Kubernetes Secret metadata without retrieving values
  ansible.builtin.command:
    argv:
      - k3s
      - kubectl
      - describe
      - secret
      - "{{ item.name }}"
      - --namespace={{ matrix_namespace }}
  changed_when: false
  loop: "{{ matrix_required_kubernetes_secrets }}"
  register: matrix_secret_kubernetes_metadata
  no_log: true

- name: Assert required Kubernetes Secret keys exist
  ansible.builtin.assert:
    that:
      - item.stdout is search('(?m)^' ~ key ~ ':')
    fail_msg: Required Matrix Kubernetes Secret key is missing.
  loop: "{{ matrix_secret_kubernetes_metadata.results | subelements('item.keys') }}"
  loop_control:
    loop_var: matrix_secret_key_check
  vars:
    item: "{{ matrix_secret_key_check.0 }}"
    key: "{{ matrix_secret_key_check.1 }}"
  no_log: true