---

#
# Validate the user-provided cert/key/caCert fields are non-empty when top-level spec.tls.enabled is false
# Note: there are three TLS sections we need to verify: hive.spec.metastore.tls, hive.spec.server.tls, hive.spec.server.metastoreTLS
#
- name: Validate that the user-provided Hive Metastore TLS fields are not empty
  block:
  - name: Validate that the user provided a non-empty Hive Metastore TLS certificate value
    assert:
      that:
        - meteringconfig_spec.hive.spec.metastore.config.tls.certificate != ""
      msg: "hive.spec.metastore.config.tls.certificate cannot be empty if createSecret: true and secretName != ''"

  - name: Validate that the user provided a non-empty Hive Metastore TLS CA certificate value
    assert:
      that:
        - meteringconfig_spec.hive.spec.metastore.config.tls.caCertificate != ""
      msg: "hive.spec.metastore.config.tls.caCertificate cannot be empty if createSecret: true and secretName != ''"

  - name: Validate that the user provided a non-empty Hive Metastore TLS key value
    assert:
      that:
        - meteringconfig_spec.hive.spec.metastore.config.tls.key != ""
      msg: "hive.spec.metastore.config.tls.key cannot be empty if createSecret: true and secretName != ''"

  - name: Validate that TLS is enabled when auth is enabled
    assert:
      that:
        - meteringconfig_spec.hive.spec.metastore.config.tls.enabled and meteringconfig_spec.hive.spec.metastore.config.auth.enabled
      msg: "Invalid configuration for hive.spec.metastore.config.tls: you cannot enable auth but disable TLS."
  when: meteringconfig_template_hive_metastore_tls_secret

- name: Validate user-provided Hive Server TLS fields are non-empty
  block:
  - name: Validate that the user provided a non-empty Hive Server TLS certificate value
    assert:
      that:
        - meteringconfig_spec.hive.spec.server.config.tls.certificate != ""
      msg: "hive.spec.server.config.tls.certificate cannot be empty if createSecret: true and secretName != ''"

  - name: Validate that the user provided a non-empty Hive Server TLS CA certificate value
    assert:
      that:
        - meteringconfig_spec.hive.spec.server.config.tls.caCertificate != ""
      msg: "hive.spec.server.config.tls.caCertificate cannot be empty if createSecret: true and secretName != ''"

  - name: Validate that the user provided a non-empty Hive Server TLS key value
    assert:
      that:
        - meteringconfig_spec.hive.spec.server.config.tls.key != ""
      msg: "hive.spec.server.config.tls.key cannot be empty if createSecret: true and secretName != ''"

  - name: Validate that TLS is enabled when auth is enabled
    assert:
      that:
        - meteringconfig_spec.hive.spec.server.config.tls.enabled and meteringconfig_spec.hive.spec.server.config.auth.enabled
      msg: "Invalid configuration for hive.spec.server.config.tls: you cannot enable auth but disable TLS."
  when: meteringconfig_template_hive_server_tls_secret

- name: Validate user-provided Hive Server Auth (metastoreTLS) fields are non-empty
  block:
  - name: Validate that the user provided a non-empty Hive Server client TLS certificate value
    assert:
      that:
        - meteringconfig_spec.hive.spec.server.config.metastoreTLS.certificate != ""
      msg: "hive.spec.server.config.metastoreTLS.certificate cannot be empty if createSecret: true and secretName != ''"

  - name: Validate that the user provided a non-empty Hive Server client TLS CA certificate value
    assert:
      that:
        - meteringconfig_spec.hive.spec.server.config.metastoreTLS.caCertificate != ""
      msg: "hive.spec.server.config.metastoreTLS.caCertificate cannot be empty if createSecret: true and secretName != ''"

  - name: Validate that the user provided a non-empty Hive Server client TLS key value
    assert:
      that:
        - meteringconfig_spec.hive.spec.server.config.metastoreTLS.key != ""
      msg: "hive.spec.server.config.metastoreTLS.key cannot be empty if createSecret: true and secretName != ''"
  when: meteringconfig_template_hive_server_auth_secret
