---
- name: Verify Notarius installation
  hosts: localhost
  gather_facts: false
  tasks:
    - name: Read the selected source commit
      become: true
      ansible.builtin.command:
        argv:
          - git
          - -C
          - /usr/local/src/notarius
          - rev-parse
          - HEAD
      register: notarius_commit
      changed_when: false

    - name: Inspect source ownership
      become: true
      ansible.builtin.command:
        argv:
          - find
          - /usr/local/src/notarius
          - -not
          - -user
          - root
          - -o
          - -not
          - -group
          - root
      register: notarius_source_ownership
      changed_when: false

    - name: Inspect binary metadata
      become: true
      ansible.builtin.stat:
        path: /usr/local/bin/notarius
      register: notarius_binary_metadata

    - name: Inspect configuration metadata
      become: true
      ansible.builtin.stat:
        path: /usr/local/etc/notarius/config.yml
      register: notarius_config_metadata

    - name: Read default configuration
      become: true
      ansible.builtin.slurp:
        src: /usr/local/etc/notarius/config.yml
      register: notarius_default_config

    - name: Read the installed version
      ansible.builtin.command:
        argv:
          - /usr/local/bin/notarius
          - --version
      register: notarius_version_output
      changed_when: false

    - name: Validate Notarius configuration
      ansible.builtin.command:
        argv:
          - /usr/local/bin/notarius
          - config
          - validate
          - --config
          - /usr/local/etc/notarius/config.yml
      changed_when: false

    - name: Assert the installation contract
      ansible.builtin.assert:
        that:
          - notarius_commit.stdout == notarius_expected_commit
          - notarius_source_ownership.stdout == ""
          - notarius_binary_metadata.stat.isreg
          - notarius_binary_metadata.stat.pw_name == "root"
          - notarius_binary_metadata.stat.gr_name == "root"
          - notarius_binary_metadata.stat.mode == "0755"
          - notarius_config_metadata.stat.pw_name == "root"
          - notarius_config_metadata.stat.gr_name == "root"
          - notarius_config_metadata.stat.mode == "0644"
          - '(notarius_default_config.content | b64decode | from_yaml) == {"version": 4}'
          - notarius_version_output.stdout == "notarius " ~ notarius_expected_version