---
- name: Add the AuthForge PPA
  ansible.builtin.apt_repository:
    repo: "{{ authforge_ppa }}"
    state: present
    update_cache: true

- name: Install AuthForge headless components
  ansible.builtin.apt:
    name:
      - authforge-daemon
      - authforge-pam
      - authforge-cli
    state: present
    update_cache: true

- name: Install AuthForge GUI (optional)
  ansible.builtin.apt:
    name: authforge-gui
    state: present
  when: authforge_install_gui | bool

- name: Ensure /etc/authforge/policy.d exists
  ansible.builtin.file:
    path: /etc/authforge/policy.d
    state: directory
    owner: root
    group: root
    mode: "0755"

- name: Render fleet policy file
  ansible.builtin.template:
    src: policy.conf.j2
    dest: /etc/authforge/policy.d/90-fleet.conf
    owner: root
    group: root
    mode: "0644"
  notify: restart authforge-daemon

- name: Mark users as pending-enrollment
  ansible.builtin.command:
    argv:
      - authforgectl
      - pending
      - set
      - "{{ item.user }}"
      - --methods
      - "{{ item.methods | join(',') }}"
  loop: "{{ authforge_pending_users }}"
  loop_control:
    label: "{{ item.user }}"
  changed_when: true