windows-ansible/ansible/roles/win_user/tasks/assert.yml

---

- name: Check User Action is valid
  ansible.builtin.assert:
    that: 
      - user_action is defined
      - user_action is string
      - user_action is in valid_actions
    quiet: true

- name: Check User information
  block:
    - name: Check Username
      ansible.builtin.assert:
        that:
          - username is defined
          - username is string
          - username is not none
          - username|length <= 20
        quiet: true

    - name: Check User Info [CREATE]
      ansible.builtin.assert:
        that:
          - study_code is defined
        # - username checked already
          - password is defined 
          - firstname is defined 
          - lastname is defined 
          - email is defined 
          - user_role is defined 
        quiet: true
      when: user_action == 'create'

    - name: Check User Info [RESET]
      ansible.builtin.assert:
        that:
        # - username checked already
          - password is defined
        quiet: true
      when: user_action == 'reset'

    - name: Check User Info [DISABLE]
      ansible.builtin.assert:
        that:
        # - username checked already
          - study_code is defined # so can be removed from group (WIP)
          - user_role is defined  # so can be removed from group (WIP)
        quiet: true
      when: user_action == 'disable'

    - name: Check User Info [ENABLE]
      ansible.builtin.assert:
        that:
        # - username checked already
          - study_code is defined # so can be removed from group (WIP)
          - user_role is defined  # so can be removed from group (WIP)
        quiet: true
      when: user_action == 'disable'

    - name: Check User Info [MODIFY]
      ansible.builtin.assert:
        that:
          - study_code is defined
          - user_role is defined  
        quiet: true
      when: user_action == 'modify'

- name: Check Study folder & group
  block:
    - name: Check AD group exists
      microsoft.ad.group:
        name: "{{ study_code }}"
        description: "{{ study_code }} study"
        path: "ou=Project Groups,dc={{ win_project }},dc=loc"
        scope: domainlocal
        category: security
        state: present
      check_mode: true
      register: group
      failed_when: group.changed == true

    - name: Check if Folder Created
      win_stat:
        path: "{{ study_folder }}"
      register: folder
      delegate_to: "{{ os_project }}-{{ win_project }}-fs01"
      failed_when: folder.stat.exists == false
  when: | 
    user_action == 'create' or
    user_action == 'modify'

- name: Verify User
  block:
    - name: Create user in AD
      microsoft.ad.user:
        name: "{{ username }}"
        path: ou=Project Users,dc={{ win_project }},dc=loc
        state: present
      register: user
      check_mode: true

    - name: Check user doesn't already exist
      ansible.builtin.assert:
        that:
          - user.changed == true
        msg: "Trying to create a user that already exists."
        quiet: true
      when: user_action == 'create'

    - name: Check user exist
      ansible.builtin.assert:
        that:
          - user.changed == false
        msg: "Trying to modify a user that doesn't exists."
        quiet: true
      when: user_action != 'create'