---
- name: ILI - Add sudo access from Jira ticket
  hosts: all
  gather_facts: false
  connection: local
  collections:
    - community.general

  # lookforjira_issue_key is provided by the AAP survey as an extra variable
  # Credentials (service_user_ccta/clcta/dmz23/dmz24, schrodingers_password,
  # lookforjira_api_token) are injected by AAP credential types.

  roles:
    - lookforjira

  tasks:
    - name: Extract fields from Jira description
      ansible.builtin.set_fact:
        # Servers and users: values are on the same line as the label.
        # (?i) handles inconsistent capitalisation of "Servernavne" in the form.
        # Users are extracted by matching the exact username pattern, so any
        # separator (comma, space, or both) between multiple usernames is handled.
        server_ccta: >-
          {{ jira_result.meta.fields.description
             | regex_findall('(?i)Oplys Servernavne - CCTA:[ ]*([^\n]+)')
             | first | default('') | trim }}
        server_clcta: >-
          {{ jira_result.meta.fields.description
             | regex_findall('(?i)Oplys Servernavne - CLCTA:[ ]*([^\n]+)')
             | first | default('') | trim }}
        server_dmz23: >-
          {{ jira_result.meta.fields.description
             | regex_findall('(?i)Oplys Servernavne - DMZ23:[ ]*([^\n]+)')
             | first | default('') | trim }}
        server_dmz24: >-
          {{ jira_result.meta.fields.description
             | regex_findall('(?i)Oplys Servernavne - DMZ24:[ ]*([^\n]+)')
             | first | default('') | trim }}
        users_ccta: >-
          {{ (jira_result.meta.fields.description
              | regex_findall('Oplys admin users[^\n]* - CCTA:[ ]*([^\n]+)')
              | first | default(''))
             | regex_findall('(?i)w\d{5}adm') }}
        users_clcta: >-
          {{ (jira_result.meta.fields.description
              | regex_findall('Oplys admin users[^\n]* - CLCTA:[ ]*([^\n]+)')
              | first | default(''))
             | regex_findall('(?i)w\d{5}adm') }}
        users_dmz23: >-
          {{ (jira_result.meta.fields.description
              | regex_findall('Oplys admin users[^\n]* - DMZ23:[ ]*([^\n]+)')
              | first | default(''))
             | regex_findall('(?i)z23w\d{5}adm') }}
        users_dmz24: >-
          {{ (jira_result.meta.fields.description
              | regex_findall('Oplys admin users[^\n]* - DMZ24:[ ]*([^\n]+)')
              | first | default(''))
             | regex_findall('(?i)z24w\d{5}adm') }}

    # ── CCTA ─────────────────────────────────────────────────────────────────
    - name: Determine jump host for CCTA
      ansible.builtin.set_fact:
        dc_domain: "EXAMPLE-CORP.COM"
      when: server_ccta != '' and users_ccta | length > 0

    - name: Include determine-jump-host role for CCTA
      ansible.builtin.include_role:
        name: determine-jump-host
      when: server_ccta != '' and users_ccta | length > 0

    - name: Show CCTA sudo access
      ansible.builtin.debug:
        msg: "Users: {{ users_ccta | join(', ') }} -> Group: {{ server_ccta.split('.')[0] }}_sudoers via {{ winjump_host }}"
      when: server_ccta != '' and users_ccta | length > 0

    - name: Add CCTA users to sudoers group
      microsoft.ad.group:
        identity: "{{ server_ccta.split('.')[0] }}_sudoers"
        members:
          add: "{{ users_ccta }}"
      delegate_to: "{{ winjump_host }}"
      vars:
        ansible_user: "{{ service_user_ccta }}"
        ansible_password: "{{ schrodingers_password }}"
        ansible_connection: ssh
        ansible_shell_type: powershell
      when: server_ccta != '' and users_ccta | length > 0

    # ── CLCTA ────────────────────────────────────────────────────────────────
    - name: Determine jump host for CLCTA
      ansible.builtin.set_fact:
        dc_domain: "clcta.dk"
      when: server_clcta != '' and users_clcta | length > 0

    - name: Include determine-jump-host role for CLCTA
      ansible.builtin.include_role:
        name: determine-jump-host
      when: server_clcta != '' and users_clcta | length > 0

    - name: Show CLCTA sudo access
      ansible.builtin.debug:
        msg: "Users: {{ users_clcta | join(', ') }} -> Group: {{ server_clcta.split('.')[0] }}_sudoers via {{ winjump_host }}"
      when: server_clcta != '' and users_clcta | length > 0

    - name: Add CLCTA users to sudoers group
      microsoft.ad.group:
        identity: "{{ server_clcta.split('.')[0] }}_sudoers"
        members:
          add: "{{ users_clcta }}"
      delegate_to: "{{ winjump_host }}"
      vars:
        ansible_user: "{{ service_user_clcta }}"
        ansible_password: "{{ schrodingers_password }}"
        ansible_connection: ssh
        ansible_shell_type: powershell
      when: server_clcta != '' and users_clcta | length > 0

    # ── DMZ23 ────────────────────────────────────────────────────────────────
    - name: Determine jump host for DMZ23
      ansible.builtin.set_fact:
        dc_domain: "DMZ23.EXAMPLE.COM"
      when: server_dmz23 != '' and users_dmz23 | length > 0

    - name: Include determine-jump-host role for DMZ23
      ansible.builtin.include_role:
        name: determine-jump-host
      when: server_dmz23 != '' and users_dmz23 | length > 0

    - name: Show DMZ23 sudo access
      ansible.builtin.debug:
        msg: "Users: {{ users_dmz23 | join(', ') }} -> Group: {{ server_dmz23.split('.')[0] }}_sudoers via {{ winjump_host }}"
      when: server_dmz23 != '' and users_dmz23 | length > 0

    - name: Add DMZ23 users to sudoers group
      microsoft.ad.group:
        identity: "{{ server_dmz23.split('.')[0] }}_sudoers"
        members:
          add: "{{ users_dmz23 }}"
      delegate_to: "{{ winjump_host }}"
      vars:
        ansible_user: "{{ service_user_dmz23 }}"
        ansible_password: "{{ schrodingers_password }}"
        ansible_connection: ssh
        ansible_shell_type: powershell
      when: server_dmz23 != '' and users_dmz23 | length > 0

    # ── DMZ24 ────────────────────────────────────────────────────────────────
    - name: Determine jump host for DMZ24
      ansible.builtin.set_fact:
        dc_domain: "DMZ.EXAMPLE.COM"
      when: server_dmz24 != '' and users_dmz24 | length > 0

    - name: Include determine-jump-host role for DMZ24
      ansible.builtin.include_role:
        name: determine-jump-host
      when: server_dmz24 != '' and users_dmz24 | length > 0

    - name: Show DMZ24 sudo access
      ansible.builtin.debug:
        msg: "Users: {{ users_dmz24 | join(', ') }} -> Group: {{ server_dmz24.split('.')[0] }}_sudoers via {{ winjump_host }}"
      when: server_dmz24 != '' and users_dmz24 | length > 0

    - name: Add DMZ24 users to sudoers group
      microsoft.ad.group:
        identity: "{{ server_dmz24.split('.')[0] }}_sudoers"
        members:
          add: "{{ users_dmz24 }}"
      delegate_to: "{{ winjump_host }}"
      vars:
        ansible_user: "{{ service_user_dmz24 }}"
        ansible_password: "{{ schrodingers_password }}"
        ansible_connection: ssh
        ansible_shell_type: powershell
      when: server_dmz24 != '' and users_dmz24 | length > 0