---
- name: SSO OIDC (occ, en www-data avec TLS PG)
  become: true
  become_user: "{{ serveur_nextcloud_utilisateur }}"
  environment:
    PGSSLMODE: "{{ serveur_nextcloud_pg_sslmode }}"
    PGSSLROOTCERT: "{{ serveur_nextcloud_ca_racine }}"
  when: not ansible_check_mode
  block:
    - name: Installer + activer l'app user_oidc (idempotent)
      ansible.builtin.shell:
        executable: /bin/bash
        cmd: |
          set -eo pipefail
          OCC="php {{ serveur_nextcloud_racine }}/occ"
          if $OCC app:list | grep -qw user_oidc; then echo SETOPS_OK; else $OCC app:install user_oidc && echo SETOPS_CHANGED; fi
      register: serveur_nextcloud_oidc_app
      changed_when: "'SETOPS_CHANGED' in serveur_nextcloud_oidc_app.stdout"

    - name: Configurer le fournisseur OIDC Keycloak (upsert idempotent)
      ansible.builtin.command:
        argv:
          - php
          - "{{ serveur_nextcloud_racine }}/occ"
          - "user_oidc:provider"
          - "{{ serveur_nextcloud_oidc_nom }}"
          - "--clientid={{ serveur_nextcloud_oidc_client_id }}"
          - "--clientsecret={{ serveur_nextcloud_oidc_client_secret }}"
          - "--discoveryuri={{ serveur_nextcloud_oidc_discovery }}"
          - "--scope=openid email profile"
          - "--mapping-uid=preferred_username"
          - "--mapping-email=email"
          - "--mapping-display-name=name"
          - "--unique-uid=0"
      changed_when: false
      no_log: true