---
- name: Verify Audita installation
  hosts: localhost
  gather_facts: false
  tasks:
    - name: Confirm selected source commit
      become: true
      ansible.builtin.command:
        argv:
          - git
          - -C
          - /usr/local/src/audita
          - rev-parse
          - HEAD
      register: audita_commit
      changed_when: false

    - name: Check selected source commit
      ansible.builtin.assert:
        that:
          - audita_commit.stdout == audita_expected_commit

    - name: Inspect source ownership
      become: true
      ansible.builtin.command:
        argv:
          - find
          - /usr/local/src/audita
          - -not
          - -user
          - root
          - -o
          - -not
          - -group
          - root
      register: audita_source_ownership
      changed_when: false

    - name: Check source ownership
      ansible.builtin.assert:
        that:
          - audita_source_ownership.stdout == ""

    - name: Inspect binary metadata
      become: true
      ansible.builtin.stat:
        path: /usr/local/bin/audita
      register: audita_binary_metadata

    - name: Check binary metadata
      ansible.builtin.assert:
        that:
          - audita_binary_metadata.stat.isreg
          - audita_binary_metadata.stat.pw_name == "root"
          - audita_binary_metadata.stat.gr_name == "root"
          - audita_binary_metadata.stat.mode == "0755"
          - audita_binary_metadata.stat.executable

    - name: Inspect configuration metadata
      become: true
      ansible.builtin.stat:
        path: /usr/local/etc/audita/config.yml
      register: audita_config_metadata

    - name: Check configuration metadata
      ansible.builtin.assert:
        that:
          - audita_config_metadata.stat.pw_name == "root"
          - audita_config_metadata.stat.gr_name == "root"
          - audita_config_metadata.stat.mode == "0644"

    - name: Read default configuration
      become: true
      ansible.builtin.slurp:
        src: /usr/local/etc/audita/config.yml
      register: audita_default_config

    - name: Check default configuration
      ansible.builtin.assert:
        that:
          - '(audita_default_config.content | b64decode | from_yaml) == {"version": 1}'

    - name: Validate Audita configuration
      ansible.builtin.command:
        argv:
          - /usr/local/bin/audita
          - config
          - validate
          - --config
          - /usr/local/etc/audita/config.yml
      register: audita_config_validation
      changed_when: false

    - name: Check configuration validation output
      ansible.builtin.assert:
        that:
          - audita_config_validation.stdout == "config is valid"