---
# The zsh role owns the login shell, so this role must not set one.

- name: Create the desired user
  ansible.builtin.user:
    name: "{{ user }}"
    create_home: true
    state: present

- name: Ensure the user's SSH directory exists
  ansible.builtin.file:
    path: "/home/{{ user }}/.ssh"
    state: directory
    owner: "{{ user }}"
    group: "{{ user }}"
    mode: "0700"

- name: Ensure authorized_keys file exists
  ansible.builtin.copy:
    content: ""
    dest: "/home/{{ user }}/.ssh/authorized_keys"
    force: false
    owner: "{{ user }}"
    group: "{{ user }}"
    mode: "0644"

# The second play logs in with this key, so bootstrap installs it here rather
# than relying on a named key below. It uses lineinfile because authorized_key
# redirects to ansible.posix 2.1.0, which imports a deprecated helper and warns on every run.
- name: Authorize the control node's key for the new user
  ansible.builtin.lineinfile:
    dest: "/home/{{ user }}/.ssh/authorized_keys"
    line: "{{ lookup('file', user_key ~ '.pub') | trim }}"
    create: true
    owner: "{{ user }}"
    group: "{{ user }}"
    mode: "0644"

- name: Check Terminus public key
  ansible.builtin.shell: "grep -c \"{{ terminus_key }}\" /home/{{ user }}/.ssh/authorized_keys || true"
  register: terminuskey_test
  changed_when: false

- name: Add Terminus public key
  ansible.builtin.lineinfile:
    dest: "/home/{{ user }}/.ssh/authorized_keys"
    line: "{{ terminus_key }}"
  when: terminuskey_test.stdout == "0"

- name: Check clair public key
  ansible.builtin.shell: "grep -c \"{{ clair_key }}\" /home/{{ user }}/.ssh/authorized_keys || true"
  register: clairkey_test
  changed_when: false

- name: Add clair public key
  ansible.builtin.lineinfile:
    dest: "/home/{{ user }}/.ssh/authorized_keys"
    line: "{{ clair_key }}"
  when: clairkey_test.stdout == "0"

- name: Check Anjin public key
  ansible.builtin.shell: "grep -c \"{{ anjin_key }}\" /home/{{ user }}/.ssh/authorized_keys || true"
  register: anjin_key_test
  changed_when: false

- name: Add Anjin public key
  ansible.builtin.lineinfile:
    dest: "/home/{{ user }}/.ssh/authorized_keys"
    line: "{{ anjin_key }}"
  when: anjin_key_test.stdout == "0"