- name: "Setup block"
  vars:
    is_default_path: "{{ this_path == default_path }}"
    path_key: "{{ this_path | replace('-','_') }}"
  block:
    - name: 'Enable the AppRole auth method'
      vault_ci_enable_auth:
        url: "{{ vault_addr }}"
        token: "{{ vault_dev_root_token_id }}"
        method_type: approle
        path: '{{ omit if is_default_path else this_path }}'

    - name: 'Create an approle policy'
      vault_ci_policy_put:
        url: "{{ vault_addr }}"
        token: "{{ vault_dev_root_token_id }}"
        name: approle-policy
        policy: |
          path "auth/{{ this_path }}/login" {
          capabilities = [ "create", "read" ]
          }

    - name: 'Create a named role'
      vault_ci_write:
        url: "{{ vault_addr }}"
        token: "{{ vault_dev_root_token_id }}"
        path: 'auth/{{ this_path }}/role/test-role'
        data:
          # in docs, this is token_policies (changed in Vault 1.2)
          # use 'policies' to support older versions
          policies: "{{ 'test-policy' if is_default_path else 'alt-policy' }},approle-policy"
          secret_id_ttl: 60m

    - name: 'Fetch the RoleID of the AppRole'
      vault_ci_read:
        url: "{{ vault_addr }}"
        token: "{{ vault_dev_root_token_id }}"
        path: 'auth/{{ this_path }}/role/test-role/role-id'
      register: role_id_cmd

    - name: 'Get a SecretID issued against the AppRole'
      vault_ci_write:
        url: "{{ vault_addr }}"
        token: "{{ vault_dev_root_token_id }}"
        path: 'auth/{{ this_path }}/role/test-role/secret-id'
        data: {}
      register: secret_id_cmd

    - name: register path-specific variables
      set_fact:
        '{{ path_key }}_role_id': "{{ role_id_cmd.result.data.role_id }}"
        '{{ path_key }}_secret_id': "{{ secret_id_cmd.result.data.secret_id }}"
