# Path: ansible/module_utils/hashivault.py
# def hashivault_auth_client(params):
#     client = hashivault_client(params)
#     return hashivault_auth(client, params)
# 
# Path: ansible/module_utils/hashivault.py
# def hashivault_argspec():
#     argument_spec = dict(
#         url=dict(required=False, default=os.environ.get('VAULT_ADDR', ''), type='str'),
#         ca_cert=dict(required=False, default=os.environ.get('VAULT_CACERT', ''), type='str'),
#         ca_path=dict(required=False, default=os.environ.get('VAULT_CAPATH', ''), type='str'),
#         client_cert=dict(required=False, default=os.environ.get('VAULT_CLIENT_CERT', ''), type='str'),
#         client_key=dict(required=False, default=os.environ.get('VAULT_CLIENT_KEY', ''), type='str'),
#         verify=dict(required=False, default=(not os.environ.get('VAULT_SKIP_VERIFY', '')), type='bool'),
#         authtype=dict(required=False, default=os.environ.get('VAULT_AUTHTYPE', 'token'), type='str'),
#         login_mount_point=dict(required=False, default=os.environ.get('VAULT_LOGIN_MOUNT_POINT', None), type='str'),
#         token=dict(required=False, fallback=(hashivault_default_token, ''), type='str', no_log=True),
#         username=dict(required=False, default=os.environ.get('VAULT_USER', ''), type='str'),
#         password=dict(required=False, fallback=(env_fallback, ['VAULT_PASSWORD']), type='str', no_log=True),
#         role_id=dict(required=False, fallback=(env_fallback, ['VAULT_ROLE_ID']), type='str', no_log=True),
#         secret_id=dict(required=False, fallback=(env_fallback, ['VAULT_SECRET_ID']), type='str', no_log=True),
#         aws_header=dict(required=False, fallback=(env_fallback, ['VAULT_AWS_HEADER']), type='str', no_log=True),
#         namespace=dict(required=False, default=os.environ.get('VAULT_NAMESPACE', None), type='str')
#     )
#     return argument_spec
# 
# Path: ansible/module_utils/hashivault.py
# def hashivault_init(argument_spec, supports_check_mode=False, required_if=None, required_together=None,
#                     required_one_of=None, mutually_exclusive=None):
#     module = AnsibleModule(argument_spec=argument_spec, supports_check_mode=supports_check_mode,
#                            required_if=required_if, required_together=required_together,
#                            required_one_of=required_one_of, mutually_exclusive=mutually_exclusive)
#     module.no_log_values.discard('0')
#     module.no_log_values.discard(0)
#     module.no_log_values.discard('1')
#     module.no_log_values.discard(1)
#     module.no_log_values.discard(True)
#     module.no_log_values.discard(False)
#     module.no_log_values.discard('ttl')
#     return module
# 
# Path: ansible/module_utils/hashivault.py
# def hashiwrapper(function):
#     def wrapper(*args, **kwargs):
#         result = {"changed": False, "rc": 0}
#         result.update(function(*args, **kwargs))
#         return result
#     return wrapper


from ansible.module_utils.hashivault import hashivault_auth_client
from ansible.module_utils.hashivault import hashivault_argspec
from ansible.module_utils.hashivault import hashivault_init
from ansible.module_utils.hashivault import hashiwrapper
ANSIBLE_METADATA = {'status': ['preview'], 'supported_by': 'community', 'version': '1.1'}
DOCUMENTATION = r'''
---
module: hashivault_pki_cert_sign
version_added: "4.5.0"
short_description: Hashicorp Vault PKI Sign CSR ( Certificate / Intermediate / Verbatim )
description:
    - This module signs a new certificate based upon the provided CSR and the supplied parameters.
options:
    csr:
        recuired: true
        description:
            - Specifies the PEM-encoded CSR.
    role:
        description:
            - Specifies the name of the role to create.
            - 'For *verbatim* type if set, the following parameters from the role will have effect: `ttl`, `max_ttl`,
              `generate_lease`, and `no_store`.'
    common_name:
        description:
            - Specifies the requested CN for the certificate. If the CN is allowed by role policy, it will be issued.
    mount_point:
        default: pki
        description:
            - location where secrets engine is mounted. also known as path
    type:
        type: str
        description:
            - Sign a new certificate with `certificate` based upon the provided CSR and the supplied parameters, subject
              to the restrictions contained in the role named in the endpoint. The issuing CA certificate is returned as

# Path: ansible/module_utils/hashivault.py
# def hashivault_auth_client(params):
#     client = hashivault_client(params)
#     return hashivault_auth(client, params)
# 
# Path: ansible/module_utils/hashivault.py
# def hashivault_argspec():
#     argument_spec = dict(
#         url=dict(required=False, default=os.environ.get('VAULT_ADDR', ''), type='str'),
#         ca_cert=dict(required=False, default=os.environ.get('VAULT_CACERT', ''), type='str'),
#         ca_path=dict(required=False, default=os.environ.get('VAULT_CAPATH', ''), type='str'),
#         client_cert=dict(required=False, default=os.environ.get('VAULT_CLIENT_CERT', ''), type='str'),
#         client_key=dict(required=False, default=os.environ.get('VAULT_CLIENT_KEY', ''), type='str'),
#         verify=dict(required=False, default=(not os.environ.get('VAULT_SKIP_VERIFY', '')), type='bool'),
#         authtype=dict(required=False, default=os.environ.get('VAULT_AUTHTYPE', 'token'), type='str'),
#         login_mount_point=dict(required=False, default=os.environ.get('VAULT_LOGIN_MOUNT_POINT', None), type='str'),
#         token=dict(required=False, fallback=(hashivault_default_token, ''), type='str', no_log=True),
#         username=dict(required=False, default=os.environ.get('VAULT_USER', ''), type='str'),
#         password=dict(required=False, fallback=(env_fallback, ['VAULT_PASSWORD']), type='str', no_log=True),
#         role_id=dict(required=False, fallback=(env_fallback, ['VAULT_ROLE_ID']), type='str', no_log=True),
#         secret_id=dict(required=False, fallback=(env_fallback, ['VAULT_SECRET_ID']), type='str', no_log=True),
#         aws_header=dict(required=False, fallback=(env_fallback, ['VAULT_AWS_HEADER']), type='str', no_log=True),
#         namespace=dict(required=False, default=os.environ.get('VAULT_NAMESPACE', None), type='str')
#     )
#     return argument_spec
# 
# Path: ansible/module_utils/hashivault.py
# def hashivault_init(argument_spec, supports_check_mode=False, required_if=None, required_together=None,
#                     required_one_of=None, mutually_exclusive=None):
#     module = AnsibleModule(argument_spec=argument_spec, supports_check_mode=supports_check_mode,
#                            required_if=required_if, required_together=required_together,
#                            required_one_of=required_one_of, mutually_exclusive=mutually_exclusive)
#     module.no_log_values.discard('0')
#     module.no_log_values.discard(0)
#     module.no_log_values.discard('1')
#     module.no_log_values.discard(1)
#     module.no_log_values.discard(True)
#     module.no_log_values.discard(False)
#     module.no_log_values.discard('ttl')
#     return module
# 
# Path: ansible/module_utils/hashivault.py
# def hashiwrapper(function):
#     def wrapper(*args, **kwargs):
#         result = {"changed": False, "rc": 0}
#         result.update(function(*args, **kwargs))
#         return result
#     return wrapper


# Path: ansible/modules/hashivault/hashivault_pki_cert_sign.py
from ansible.module_utils.hashivault import hashivault_auth_client
from ansible.module_utils.hashivault import hashivault_argspec
from ansible.module_utils.hashivault import hashivault_init
from ansible.module_utils.hashivault import hashiwrapper

ANSIBLE_METADATA = {'status': ['preview'], 'supported_by': 'community', 'version': '1.1'}
DOCUMENTATION = r'''
---
module: hashivault_pki_cert_sign
version_added: "4.5.0"
short_description: Hashicorp Vault PKI Sign CSR ( Certificate / Intermediate / Verbatim )
description:
    - This module signs a new certificate based upon the provided CSR and the supplied parameters.
options:
    csr:
        recuired: true
        description:
            - Specifies the PEM-encoded CSR.
    role:
        description:
            - Specifies the name of the role to create.
            - 'For *verbatim* type if set, the following parameters from the role will have effect: `ttl`, `max_ttl`,
              `generate_lease`, and `no_store`.'
    common_name:
        description:
            - Specifies the requested CN for the certificate. If the CN is allowed by role policy, it will be issued.
    mount_point:
        default: pki
        description:
            - location where secrets engine is mounted. also known as path
    type:
        type: str
        description:
            - Sign a new certificate with `certificate` based upon the provided CSR and the supplied parameters, subject
              to the restrictions contained in the role named in the endpoint. The issuing CA certificate is returned as

              well, so that only the root CA need be in a client's trust store.