---
# Read the OPA bearer token from Vault; generate and store it if missing.
# Sets __opa_server_token and __opa_server_token_generated.

- name: Read OPA token from Vault
  community.hashi_vault.vault_kv2_get:
    path: "{{ opa_server_vault_path }}"
    engine_mount_point: "{{ opa_server_vault_mount }}"
  register: __opa_server_vault_read
  failed_when: false
  no_log: "{{ opa_server_no_log }}"

- name: Resolve OPA token (generate if missing)
  ansible.builtin.set_fact:
    __opa_server_token_generated: "{{ ((__opa_server_vault_read.secret | default({})).token | default('')) | length == 0 }}"
    __opa_server_token: >-
      {{ (__opa_server_vault_read.secret | default({})).token
         | default(lookup('community.general.random_string', length=48, special=false)) }}
  no_log: "{{ opa_server_no_log }}"

- name: Write OPA token to Vault
  community.hashi_vault.vault_kv2_write:
    path: "{{ opa_server_vault_path }}"
    engine_mount_point: "{{ opa_server_vault_mount }}"
    data:
      token: "{{ __opa_server_token }}"
  when: __opa_server_token_generated | bool
  no_log: "{{ opa_server_no_log }}"