---
# Run an approved script already present on a confirmed maintenance wave.
- name: Run operator script
  hosts: "{{ operation_wave | default('invalid-wave', true) }}"
  gather_facts: false
  become: true
  vars:
    approved_operation_waves: [lab, pilot_1, pilot_2, wave_1, wave_2, production]
    production_override: false
    script_path: ""
    script_args: ""
    script_allowed_dirs:
      - /opt/blueforce/bin
      - /usr/local/sbin
    script_allowlist: []
  pre_tasks:
    - name: Require confirmed approved operation wave scope
      ansible.builtin.assert:
        that:
          - operation_wave in approved_operation_waves
          - operation_confirmed | bool
          - operation_wave in groups
          - ansible_play_hosts_all | length > 0
          - ansible_play_hosts_all | difference(groups[operation_wave]) | length == 0
        fail_msg: "Set operation_wave to one inventory wave and operation_confirmed=true; full-fleet scope is refused."
      run_once: true

    - name: Require separate production override
      ansible.builtin.assert:
        that:
          - operation_wave != 'production' or production_override | bool
        fail_msg: "Production operation requires production_override=true in addition to operation_confirmed=true."
      run_once: true
  tasks:
    - name: Canonicalize requested script path
      ansible.builtin.command:
        argv: [readlink, -f, --, "{{ script_path }}"]
      register: canonical_script
      changed_when: false
      failed_when: canonical_script.rc != 0

    - name: Canonicalize approved directory prefixes
      ansible.builtin.command:
        argv: [readlink, -f, --, "{{ item }}"]
      loop: "{{ script_allowed_dirs }}"
      register: canonical_dirs
      changed_when: false

    - name: Validate exact approved path boundary or explicit allowlist
      ansible.builtin.assert:
        that:
          - canonical_script.stdout is match('^/.+')
          - canonical_script.stdout in script_allowlist or (canonical_dirs.results | map(attribute='stdout') | select('match', '^/.+') | map('regex_replace', '$', '/') | select('in', canonical_script.stdout + '/') | list | length > 0)
        fail_msg: "Refused root execution of '{{ script_path }}': canonical path '{{ canonical_script.stdout }}' is not in an approved directory or explicit allowlist."

    - name: Check canonical script is a regular executable file
      ansible.builtin.stat:
        path: "{{ canonical_script.stdout }}"
      register: script_stat

    - name: Validate canonical script metadata
      ansible.builtin.assert:
        that:
          - script_stat.stat.exists
          - script_stat.stat.isreg
          - script_stat.stat.executable

    - name: Execute approved canonical script
      ansible.builtin.command:
        argv: "{{ [canonical_script.stdout] + (script_args | default('') | split()) }}"
      register: script_out
      changed_when: true

    - name: Show script output
      ansible.builtin.debug:
        msg: "{{ inventory_hostname }} exit={{ script_out.rc }}\n{{ script_out.stdout | default('') }}{{ script_out.stderr | default('') }}"