---
# ============================================================================
# Sophos Firewall Rules Role - Main Tasks
# ============================================================================

- name: Display firewall rules configuration overview
  ansible.builtin.debug:
    msg:
      - "======================================"
      - "Configuring Firewall Rules"
      - "======================================"
      - "Firewall: {{ inventory_hostname }}"
      - "Common Rules: {{ sophos_common_firewall_rules | default([]) | length }}"
      - "Custom Rules: {{ sophos_firewall_rules | default([]) | length }}"
  tags: ['always']

- name: Get current firewall rules from firewall
  ansible.builtin.uri:
    url: "https://{{ sophos_mgmt_host }}:{{ sophos_mgmt_port }}/webconsole/APIController?reqxml=<Request><Login><Username>{{ sophos_api_username }}</Username><Password>{{ sophos_api_password }}</Password></Login><Get><FirewallRule/></Get></Request>"
    method: POST
    validate_certs: "{{ sophos_validate_certs }}"
    headers:
      Content-Type: "application/x-www-form-urlencoded"
    return_content: true
    status_code: [200]
  register: current_firewall_rules
  no_log: "{{ sophos_no_log_sensitive }}"
  tags: ['rules']

- name: Parse current firewall rule names
  ansible.builtin.set_fact:
    existing_firewall_rules: "{{ current_firewall_rules.content | regex_findall('<Name>(.*?)</Name>') }}"
  tags: ['rules']

- name: Combine common and custom firewall rules
  ansible.builtin.set_fact:
    all_firewall_rules: "{{ sophos_common_firewall_rules | default([]) + sophos_firewall_rules | default([]) }}"
  tags: ['rules']

- name: Configure firewall rule {{ item.name }}
  ansible.builtin.uri:
    url: "https://{{ sophos_mgmt_host }}:{{ sophos_mgmt_port }}/webconsole/APIController"
    method: POST
    validate_certs: "{{ sophos_validate_certs }}"
    headers:
      Content-Type: "application/x-www-form-urlencoded"
    body: "reqxml={{ lookup('template', 'firewall_rule.json.j2') | urlencode }}"
    status_code: [200, 201]
    timeout: "{{ sophos_api_timeout }}"
  loop: "{{ all_firewall_rules }}"
  loop_control:
    label: "{{ item.name }}"
  register: fw_rule_result
  no_log: "{{ sophos_no_log_sensitive }}"
  changed_when: "'successful' in fw_rule_result.content | lower"
  tags: ['rules']

- name: Firewall rules configuration completed
  ansible.builtin.debug:
    msg: "Configured {{ all_firewall_rules | length }} firewall rules successfully"
  tags: ['always']