<commit_before>---
- name: Validate OSSEC Admin email address.
  assert:
    that:
      - "'@' in ossec_alert_email"
      - ossec_alert_email != "<EMAIL>"
    msg: >-
      OSSEC Admin email address must be valid.
      This address is used to receive OSSEC notifications.
      {{ securedrop_validate_error_msg_start }} the `ossec_alert_email` var
      is set correctly.

- name: Validate SASL username for OSSEC config.
  assert:
    that:
      # Ensure not the dummy value specified in example vars file.
      - sasl_username != "test"
      - "'@' not in sasl_username"
    msg: >-
      The SASL username should not include the domain name.
      {{ securedrop_validate_error_msg_start }} the `sasl_username` var
      is set correctly.

- name: Validate SASL password for OSSEC config.
  assert:
    that:
      # Ensure not the dummy value specified in example vars file.
      - sasl_password != "<PASSWORD>"
      - sasl_password|length >= 8
    msg: >-
      Password for OSSEC email account must be strong.
      {{ securedrop_validate_error_msg_start }} the `sasl_password` var
      is set correctly.

# We can't simply call `host <domain>` under Tails, we need to support
# the tor-only config and specify a nameserver to use for the call
# (since Tails defaults to localhost as nameserver).
- name: Determine SMTP relay query strategy.
  set_fact:
    _smtp_hostname_query_command: >-
      {% if ansible_lsb.id == "Tails" %}
      torify host -T -4 {{ smtp_relay }} 8.8.8.8
      {% else %}
      host {{ smtp_relay }}
      {% endif %}

- name: Determine SASL domain query strategy.
  set_fact:
    _sasl_hostname_query_command: >-
      {% if ansible_lsb.id == "Tails" %}
      torify host -T -4 {{ sasl_domain }} 8.8.8.8
      {% else %}
      host {{ smtp_relay }}
      {% endif %}

- name: Validate SMTP relay.
  assert:
    that:
      - smtp_relay is defined
      # The pipe lookup will fail if command returns non-zero.
      - lookup('pipe', _smtp_hostname_query_command)
    msg: >-
      The SMTP relay domain failed during lookup. This domain
      is the server contacted for authentication in order to send
      OSSEC email notifications.
      {{ securedrop_validate_error_msg_start }} the `smtp_relay` var
      is set correctly.

- name: Validate SASL domain.
  assert:
    that:
      - sasl_domain is defined
      # The pipe lookup will fail if command returns non-zero.
      - lookup('pipe', _sasl_hostname_query_command)
    msg: >-
      The SASL domain failed during lookup. This is typically the
      portion of the email address after the '@' symbol, although
      configurations may vary.
      {{ securedrop_validate_error_msg_start }} the `sasl_domain` var
      is set correctly.<commit_msg>Consolidates definedness checks for email validation<commit_after>---
- name: Validate OSSEC Admin email address.
  assert:
    that:
      - "'@' in ossec_alert_email"
      - ossec_alert_email != "<EMAIL>"
    msg: >-
      OSSEC Admin email address must be valid.
      This address is used to receive OSSEC notifications.
      {{ securedrop_validate_error_msg_start }} the `ossec_alert_email` var
      is set correctly.

- name: Validate SASL username for OSSEC config.
  assert:
    that:
      # Ensure not the dummy value specified in example vars file.
      - sasl_username != "test"
      - "'@' not in sasl_username"
    msg: >-
      The SASL username should not include the domain name.
      {{ securedrop_validate_error_msg_start }} the `sasl_username` var
      is set correctly.

- name: Validate SASL password for OSSEC config.
  assert:
    that:
      # Ensure not the dummy value specified in example vars file.
      - sasl_password != "<PASSWORD>"
      - sasl_password|length >= 8
    msg: >-
      Password for OSSEC email account must be strong.
      {{ securedrop_validate_error_msg_start }} the `sasl_password` var
      is set correctly.

# Validating that vars are defined before using them to build
# service-checking commands.
- name: Ensure mail config vars are defined.
  assert:
    that:
      - smtp_relay is defined
      - sasl_domain is defined

# We can't simply call `host <domain>` under Tails, we need to support
# the tor-only config and specify a nameserver to use for the call
# (since Tails defaults to localhost as nameserver).
- name: Determine query strategy for mail config checks.
  set_fact:
    _smtp_hostname_query_command: >-
      {% if ansible_lsb.id == "Tails" %}
      torify host -T -4 {{ smtp_relay }} 8.8.8.8
      {% else %}
      host {{ smtp_relay }}
      {% endif %}
    _sasl_hostname_query_command: >-
      {% if ansible_lsb.id == "Tails" %}
      torify host -T -4 {{ sasl_domain }} 8.8.8.8
      {% else %}
      host {{ smtp_relay }}
      {% endif %}

- name: Validate SMTP relay.
  assert:
    that:
      # The pipe lookup will fail if command returns non-zero.
      - lookup('pipe', _smtp_hostname_query_command)
    msg: >-
      The SMTP relay domain failed during lookup. This domain
      is the server contacted for authentication in order to send
      OSSEC email notifications.
      {{ securedrop_validate_error_msg_start }} the `smtp_relay` var
      is set correctly.

- name: Validate SASL domain.
  assert:
    that:
      # The pipe lookup will fail if command returns non-zero.
      - lookup('pipe', _sasl_hostname_query_command)
    msg: >-
      The SASL domain failed during lookup. This is typically the
      portion of the email address after the '@' symbol, although
      configurations may vary.
      {{ securedrop_validate_error_msg_start }} the `sasl_domain` var
      is set correctly.
{'fraction_non_alphanumeric': 0.08556244464127546, 'fraction_numerical': 0.0038972542072630645, 'mean_word_length': 2.656735751295337, 'pattern_counts': {'":': 0, '<': 9, '<?xml version=': 0, '>': 25, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 4, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '7152047', 'n_tokens_mistral': 1752, 'n_tokens_neox': 1705, 'n_words': 598}