---
users_fixture_system:
  type: virtual
  os: debian
  version: "13"
  cpus: 2
  memory: 2048
  disks:
    - size: 30
  network:
    interfaces:
      - bridge: br0
        ip: 192.0.2.10
        prefix: 24
        gateway: 192.0.2.1
  root:
    password: rootpw

# precomputed: hand system_cfg over the way deploy_iac does, skipping the raw input checks.
users_fixtures:
  - name: dict-first-password-wins
    system:
      users:
        keyonly:
          keys:
            - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFixture keyonly
        blank:
          password: ""
        ops:
          password: pw
          sudo: true
        later:
          password: pw2
    expect:
      primary: ops

  - name: dict-first-password-wins-precomputed
    precomputed: true
    system:
      users:
        keyonly:
          keys:
            - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFixture keyonly
        ops:
          password: pw
    expect:
      primary: ops

  - name: list-rejected
    system:
      users:
        - name: ops
          password: pw
    expect:
      fail: "system.users: expected dict, got list"

  - name: list-rejected-precomputed
    precomputed: true
    system:
      users:
        - name: ops
          password: pw
    expect:
      fail: "system.users: expected dict, got list"

  - name: scalar-entry-rejected
    system:
      users:
        ops: pw
    expect:
      fail: "system.users.ops: expected dict, got str"

  - name: scalar-entry-rejected-precomputed
    precomputed: true
    system:
      users:
        ops: pw
    expect:
      fail: "system.users.ops: expected dict, got str"

  - name: keys-string-rejected
    system:
      users:
        ops:
          password: pw
          keys: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFixture ops
    expect:
      fail: "system.users.ops.keys: expected list, got str"

  - name: no-password-rejected
    system:
      users:
        ops:
          keys:
            - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFixture ops
    expect:
      fail: needs a non-empty password

  - name: autologin-user-accepted
    system:
      users:
        ops:
          password: pw
      features:
        desktop:
          enabled: true
          environment: gnome
          autologin: ops
    expect:
      primary: ops

  - name: autologin-unknown-user-rejected
    system:
      users:
        ops:
          password: pw
      features:
        desktop:
          enabled: true
          environment: gnome
          autologin: ghost
    expect:
      fail: desktop.autologin must be false or a username