---
# ── WSL verification ─────────────────────────────────────────────────────

- name: Verify WSL is operational
  ansible.windows.win_shell: wsl.exe --status --default
  register: __wsl_verify
  changed_when: false
  failed_when: __wsl_verify.rc != 0
  tags:
    - roles::windows_containers::verify

# ── Podman verification ──────────────────────────────────────────────────

- name: Verify Podman is installed
  ansible.windows.win_shell: podman version
  register: __podman_version
  changed_when: false
  tags:
    - roles::windows_containers::verify

- name: Verify Podman machine exists
  ansible.windows.win_shell: |
    $machinesJson = (podman machine ls --format json 2>$null | Out-String).Trim()
    if (-not $machinesJson) {
      Write-Error "No Podman machines found"
      exit 1
    }
    $machines = $machinesJson | ConvertFrom-Json
    $machine = $machines | Where-Object { $_.Name -eq "{{ windows_containers_machine_name }}" } | Select-Object -First 1
    if (-not $machine) {
      Write-Error "Podman machine {{ windows_containers_machine_name }} not found"
      exit 1
    }
    Write-Output "__PODMAN_MACHINE_EXISTS__"
  register: __podman_machine_ls
  changed_when: false
  failed_when: "'__PODMAN_MACHINE_EXISTS__' not in (__podman_machine_ls.stdout + __podman_machine_ls.stderr)"
  tags:
    - roles::windows_containers::verify

# ── NSSM service verification ────────────────────────────────────────────

- name: Verify NSSM Podman machine service is installed and running
  ansible.windows.win_shell: |
    $svc = (Get-Service -Name "{{ windows_containers_service_name }}" -ErrorAction SilentlyContinue)
    if (-not $svc) { Write-Error "Service {{ windows_containers_service_name }} not found"; exit 1 }
    if ($svc.StartType -ne 'Automatic') { Write-Error "Service {{ windows_containers_service_name }} is not Automatic"; exit 1 }
    Write-Output "Service: $($svc.DisplayName) | Status: $($svc.Status) | StartType: $($svc.StartType)"
    Write-Output "__NSSM_SERVICE_OK__"
  register: __nssm_verify
  changed_when: false
  failed_when: "__NSSM_SERVICE_OK__ not in (__nssm_verify.stdout + __nssm_verify.stderr)"
  tags:
    - roles::windows_containers::verify

- name: Verify NSSM service runs as dedicated podman user
  ansible.windows.win_shell: |
    $svc = Get-CimInstance -ClassName Win32_Service -Filter "Name='{{ windows_containers_service_name }}'"
    $owner = $svc.StartName
    if ($owner -eq ".\\{{ windows_containers_service_user }}" -or $owner -eq "{{ windows_containers_service_user }}") {
      Write-Output "Service runs as $owner"
      Write-Output "__NSSM_USER_OK__"
    } else {
      Write-Error "Expected service to run as .\\{{ windows_containers_service_user }}, got $owner"
      exit 1
    }
  register: __nssm_user_verify
  changed_when: false
  failed_when: "__NSSM_USER_OK__ not in (__nssm_user_verify.stdout + __nssm_user_verify.stderr)"
  tags:
    - roles::windows_containers::verify

# ── Container verification ───────────────────────────────────────────────

- name: Verify Ubuntu container is running
  ansible.windows.win_shell: podman inspect --format "{{ '{{.State.Running}}' }}" {{ windows_containers_container_name }}
  register: __container_status
  changed_when: false
  failed_when: __container_status.rc != 0 or __container_status.stdout | trim != 'true'
  tags:
    - roles::windows_containers::verify

- name: Verify SSH access to Ubuntu container
  ansible.windows.win_shell: podman exec {{ windows_containers_container_name }} id {{ windows_containers_user }}
  register: __user_check
  changed_when: false
  failed_when: __user_check.rc != 0
  tags:
    - roles::windows_containers::verify

- name: Report SSH connection details
  ansible.windows.win_shell: |
    Write-Output "Podman is installed"
    Write-Output "WSL version: wsl.exe --version"
    Write-Output "NSSM service: {{ windows_containers_service_name }}"
    Write-Output "Ubuntu container: {{ windows_containers_container_name }}"
    Write-Output "SSH access: ssh {{ windows_containers_user }}@localhost -p {{ windows_containers_container_port }}"
  changed_when: false
  tags:
    - roles::windows_containers::verify