---
- name: Query existing PTR records
  ansible.builtin.command:
    cmd: samba-tool dns query {{ samba_dns_server }} {{ lan_reverse_zone }} {{ item.last_octet }} PTR -U Administrator --password={{ samba_dns_admin_pass }}
  register: ptr_query
  changed_when: false
  failed_when: false

# Double-quoted scalar (not ">-"): in a block scalar '\\s'/'\\.' reach the regex
# as a literal backslash and never match, so PTR parsing silently returned [] —
# stale records were never pruned. samba-tool prints PTR targets fully-qualified
# with a trailing dot, which we strip for comparison against item.fqdn.
- name: Parse existing PTR records
  ansible.builtin.set_fact:
    ptr_existing_values: "{{ ptr_query.stdout | default('') | regex_findall('PTR:\\s+([A-Za-z0-9.-]+)') | map('regex_replace', '\\.$', '') | list }}"

- name: Remove stale PTR records
  ansible.builtin.command:
    cmd: samba-tool dns delete {{ samba_dns_server }} {{ lan_reverse_zone }} {{ item.last_octet }} PTR {{ ptr_value }} -U Administrator --password={{ samba_dns_admin_pass }}
  loop: "{{ ptr_existing_values | reject('equalto', item.fqdn) | list }}"
  loop_control:
    loop_var: ptr_value
  when: (ptr_existing_values | reject('equalto', item.fqdn) | list | length) > 0

- name: Add expected PTR record
  ansible.builtin.command:
    cmd: samba-tool dns add {{ samba_dns_server }} {{ lan_reverse_zone }} {{ item.last_octet }} PTR {{ item.fqdn }} -U Administrator --password={{ samba_dns_admin_pass }}
  register: ptr_add
  changed_when: ptr_add.rc == 0
  failed_when: >
    ptr_add.rc != 0 and
    ('WERR_DNS_ERROR_RECORD_ALREADY_EXISTS' not in (ptr_add.stderr | default(''))) and
    ('Record already exists' not in (ptr_add.stderr | default('')))
  when: item.fqdn not in ptr_existing_values

- name: Verify PTR record resolves
  ansible.builtin.command:
    cmd: samba-tool dns query {{ samba_dns_server }} {{ lan_reverse_zone }} {{ item.last_octet }} PTR -U Administrator --password={{ samba_dns_admin_pass }}
  register: ptr_verify
  changed_when: false
  failed_when: false

- name: Assert expected PTR record is present
  ansible.builtin.assert:
    that:
      - item.fqdn in ptr_verify_values
    fail_msg: >-
      PTR {{ item.last_octet }} in zone {{ lan_reverse_zone }} does not contain
      expected target '{{ item.fqdn }}' after apply (got {{ ptr_verify_values }}).
  vars:
    ptr_verify_values: "{{ ptr_verify.stdout | default('') | regex_findall('PTR:\\s+([A-Za-z0-9.-]+)') | map('regex_replace', '\\.$', '') | list }}"