matrix-docker-ansible-deploy/roles/custom/matrix-livekit-jwt-service/molecule/default/verify.yml

# SPDX-FileCopyrightText: 2026 Slavi Pantaleev
#
# SPDX-License-Identifier: AGPL-3.0-or-later

---
- name: Verify matrix-livekit-jwt-service
  hosts: all
  become: true
  vars_files:
    - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/vars.yml"
    - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/playbook-context.yml"
  vars:
    matrix_livekit_jwt_service_runtime: "{{ (matrix_livekit_jwt_service_container_inspect.stdout | from_json) | first }}"
    matrix_livekit_jwt_service_valid_request:
      room_id: "!call-room:molecule.local"
      slot_id: molecule-slot
      openid_token:
        access_token: known-openid-token
        token_type: Bearer
        matrix_server_name: "matrix-openid-fixture:8443"
        expires_in: 3600
      member:
        id: member-molecule-01
        claimed_user_id: "@alice:matrix-openid-fixture:8443"
        claimed_device_id: DEVICE_MOLECULE
  gather_facts: false

  tasks:
    - name: Load the role's defaults under a separate name
      ansible.builtin.include_vars:
        file: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/defaults/main.yml"
        name: matrix_livekit_jwt_service_role_defaults

    - name: Wait for the LiveKit JWT service to become active
      ansible.builtin.systemd_service:
        name: matrix-livekit-jwt-service.service
      register: matrix_livekit_jwt_service_service
      until: matrix_livekit_jwt_service_service.status.ActiveState == 'active'
      retries: 30
      delay: 5
      failed_when: false

    # Restart=always keeps a crash-looping service nominally active.
    - name: Assert the service is active and has not restarted
      ansible.builtin.assert:
        that:
          - matrix_livekit_jwt_service_service.status.ActiveState == 'active'
          - matrix_livekit_jwt_service_service.status.NRestarts is defined
          - matrix_livekit_jwt_service_service.status.NRestarts | int == 0
        fail_msg: >-
          matrix-livekit-jwt-service.service is
          {{ matrix_livekit_jwt_service_service.status.ActiveState | default('unknown') }} after
          {{ matrix_livekit_jwt_service_service.status.NRestarts | default('?') }} restart(s)
        success_msg: "matrix-livekit-jwt-service.service is active and has not restarted"

    - name: Wait for the live health endpoint on the configured non-default port
      ansible.builtin.command:
        argv:
          - docker
          - run
          - --rm
          - --network={{ matrix_livekit_jwt_service_container_network }}
          - "{{ molecule_shared_image_curl }}"
          - --silent
          - --show-error
          - --output
          - /dev/null
          - --write-out
          - "HTTP_STATUS=%{http_code}"
          - http://matrix-livekit-jwt-service:8097/healthz
      register: matrix_livekit_jwt_service_health
      changed_when: false
      until: matrix_livekit_jwt_service_health.stdout == 'HTTP_STATUS=200'
      retries: 24
      delay: 5
      failed_when: false

    - name: Assert the live service is healthy on the configured port
      ansible.builtin.assert:
        that:
          - matrix_livekit_jwt_service_health.rc == 0
          - matrix_livekit_jwt_service_health.stdout == 'HTTP_STATUS=200'
        fail_msg: "The LiveKit JWT service did not answer /healthz on port 8097"
        success_msg: "The LiveKit JWT service is healthy on its non-default port"

    - name: Exercise the get_token CORS preflight
      ansible.builtin.command:
        argv:
          - docker
          - run
          - --rm
          - --network={{ matrix_livekit_jwt_service_container_network }}
          - "{{ molecule_shared_image_curl }}"
          - --silent
          - --show-error
          - --include
          - --request
          - OPTIONS
          - --write-out
          - "\nHTTP_STATUS=%{http_code}"
          - http://matrix-livekit-jwt-service:8097/get_token
      register: matrix_livekit_jwt_service_cors
      changed_when: false
      failed_when: false

    - name: Assert get_token exposes its CORS contract
      ansible.builtin.assert:
        that:
          - matrix_livekit_jwt_service_cors.rc == 0
          - "'HTTP_STATUS=200' in matrix_livekit_jwt_service_cors.stdout_lines"
          - "'access-control-allow-origin: *' in matrix_livekit_jwt_service_cors.stdout | lower"
          - "'access-control-allow-methods: post' in matrix_livekit_jwt_service_cors.stdout | lower"
          - "'access-control-allow-headers: accept, content-type, content-length, accept-encoding, x-csrf-token' in matrix_livekit_jwt_service_cors.stdout | lower"
        fail_msg: "OPTIONS /get_token did not return the service's expected CORS headers"
        success_msg: "OPTIONS /get_token exposes the expected CORS contract"

    - name: Submit malformed JSON to get_token
      ansible.builtin.command:
        argv:
          - docker
          - run
          - --rm
          - --network={{ matrix_livekit_jwt_service_container_network }}
          - "{{ molecule_shared_image_curl }}"
          - --silent
          - --show-error
          - --header
          - "Content-Type: application/json"
          - --data-binary
          - "{not-json"
          - --write-out
          - "\nHTTP_STATUS=%{http_code}"
          - http://matrix-livekit-jwt-service:8097/get_token
      register: matrix_livekit_jwt_service_malformed
      changed_when: false
      failed_when: false

    - name: Assert malformed JSON is rejected structurally
      ansible.builtin.assert:
        that:
          - matrix_livekit_jwt_service_malformed.rc == 0
          - matrix_livekit_jwt_service_malformed.stdout_lines[-1] == 'HTTP_STATUS=400'
          - matrix_livekit_jwt_service_malformed_document.errcode == 'M_NOT_JSON'
          - matrix_livekit_jwt_service_malformed_document.error == 'Error reading request'
        fail_msg: "Malformed JSON did not produce the expected Matrix error response"
        success_msg: "Malformed JSON is rejected with M_NOT_JSON"
      vars:
        matrix_livekit_jwt_service_malformed_document: >-
          {{ matrix_livekit_jwt_service_malformed.stdout | regex_replace('(?s)\s*HTTP_STATUS=[0-9]+\s*$', '') | from_json }}

    - name: Ask get_token to validate an unknown OpenID token
      ansible.builtin.command:
        argv:
          - docker
          - run
          - --rm
          - --network={{ matrix_livekit_jwt_service_container_network }}
          - "{{ molecule_shared_image_curl }}"
          - --silent
          - --show-error
          - --header
          - "Content-Type: application/json"
          - --data-binary
          - "{{ matrix_livekit_jwt_service_unknown_token_request | to_json }}"
          - --write-out
          - "\nHTTP_STATUS=%{http_code}"
          - http://matrix-livekit-jwt-service:8097/get_token
      register: matrix_livekit_jwt_service_unknown_token
      changed_when: false
      failed_when: false
      vars:
        matrix_livekit_jwt_service_unknown_token_request: >-
          {{ matrix_livekit_jwt_service_valid_request | combine({'openid_token': matrix_livekit_jwt_service_valid_request.openid_token | combine({'access_token': 'unknown-openid-token'})}, recursive=True) }}

    - name: Assert an unknown OpenID token is unauthorized
      ansible.builtin.assert:
        that:
          - matrix_livekit_jwt_service_unknown_token.rc == 0
          - matrix_livekit_jwt_service_unknown_token.stdout_lines[-1] == 'HTTP_STATUS=401'
          - matrix_livekit_jwt_service_unknown_token_document.errcode == 'M_UNAUTHORIZED'
          - matrix_livekit_jwt_service_unknown_token_document.error == 'The request could not be authorised.'
        fail_msg: "An unknown OpenID token was not rejected as unauthorized"
        success_msg: "The live service rejects an unknown OpenID token"
      vars:
        matrix_livekit_jwt_service_unknown_token_document: >-
          {{ matrix_livekit_jwt_service_unknown_token.stdout | regex_replace('(?s)\s*HTTP_STATUS=[0-9]+\s*$', '') | from_json }}

    - name: Ask get_token to validate a mismatched claimed user
      ansible.builtin.command:
        argv:
          - docker
          - run
          - --rm
          - --network={{ matrix_livekit_jwt_service_container_network }}
          - "{{ molecule_shared_image_curl }}"
          - --silent
          - --show-error
          - --header
          - "Content-Type: application/json"
          - --data-binary
          - "{{ matrix_livekit_jwt_service_mismatched_user_request | to_json }}"
          - --write-out
          - "\nHTTP_STATUS=%{http_code}"
          - http://matrix-livekit-jwt-service:8097/get_token
      register: matrix_livekit_jwt_service_mismatched_user
      changed_when: false
      failed_when: false
      vars:
        matrix_livekit_jwt_service_mismatched_user_request: >-
          {{ matrix_livekit_jwt_service_valid_request | combine({'member': matrix_livekit_jwt_service_valid_request.member | combine({'claimed_user_id': '@mallory:matrix-openid-fixture:8443'})}, recursive=True) }}

    - name: Assert a valid token cannot impersonate another Matrix user
      ansible.builtin.assert:
        that:
          - matrix_livekit_jwt_service_mismatched_user.rc == 0
          - matrix_livekit_jwt_service_mismatched_user.stdout_lines[-1] == 'HTTP_STATUS=401'
          - matrix_livekit_jwt_service_mismatched_user_document.errcode == 'M_UNAUTHORIZED'
        fail_msg: "The OpenID subject and claimed Matrix user mismatch was not rejected"
        success_msg: "The live service rejects a claimed-user mismatch"
      vars:
        matrix_livekit_jwt_service_mismatched_user_document: >-
          {{ matrix_livekit_jwt_service_mismatched_user.stdout | regex_replace('(?s)\s*HTTP_STATUS=[0-9]+\s*$', '') | from_json }}

    # The request's server is not in FULL_ACCESS, so this validates OpenID and
    # signs a join token without trying to create a room on the absent SFU.
    - name: Request a real restricted-user LiveKit JWT
      ansible.builtin.command:
        argv:
          - docker
          - run
          - --rm
          - --network={{ matrix_livekit_jwt_service_container_network }}
          - "{{ molecule_shared_image_curl }}"
          - --silent
          - --show-error
          - --header
          - "Content-Type: application/json"
          - --data-binary
          - "{{ matrix_livekit_jwt_service_valid_request | to_json }}"
          - --write-out
          - "\nHTTP_STATUS=%{http_code}"
          - http://matrix-livekit-jwt-service:8097/get_token
      register: matrix_livekit_jwt_service_token_response
      changed_when: false
      failed_when: false

    - name: Parse the successful token response
      ansible.builtin.set_fact:
        matrix_livekit_jwt_service_token_document: >-
          {{ matrix_livekit_jwt_service_token_response.stdout | regex_replace('(?s)\s*HTTP_STATUS=[0-9]+\s*$', '') | from_json }}

    - name: Assert the live service returns a JWT for the configured SFU URL
      ansible.builtin.assert:
        that:
          - matrix_livekit_jwt_service_token_response.rc == 0
          - matrix_livekit_jwt_service_token_response.stdout_lines[-1] == 'HTTP_STATUS=200'
          - matrix_livekit_jwt_service_token_document.keys() | sort == ['jwt', 'url']
          - matrix_livekit_jwt_service_token_document.url == matrix_livekit_jwt_service_environment_variable_livekit_url
          - matrix_livekit_jwt_service_token_document.jwt.split('.') | length == 3
        fail_msg: "The restricted-user exchange did not return a JWT and configured SFU URL"
        success_msg: "The restricted-user exchange returns a real JWT for the configured SFU"

    - name: Decode and authenticate the returned LiveKit JWT
      ansible.builtin.command:
        argv:
          - python3
          - -c
          - >-
            import base64, hashlib, hmac, json, sys;
            parts = sys.argv[1].split('.');
            decode = lambda value: json.loads(base64.urlsafe_b64decode(value + '=' * (-len(value) % 4)));
            signature = base64.urlsafe_b64decode(parts[2] + '=' * (-len(parts[2]) % 4));
            expected = hmac.new(sys.argv[2].encode(), (parts[0] + '.' + parts[1]).encode(), hashlib.sha256).digest();
            print(json.dumps({'header': decode(parts[0]), 'claims': decode(parts[1]), 'signature_valid': hmac.compare_digest(signature, expected)}))
          - "{{ matrix_livekit_jwt_service_token_document.jwt }}"
          - "{{ matrix_livekit_jwt_service_environment_variable_livekit_secret }}"
      register: matrix_livekit_jwt_service_jwt_decode
      changed_when: false
      no_log: true

    - name: Assert the JWT signature, identity, room and restricted grant
      ansible.builtin.assert:
        that:
          - matrix_livekit_jwt_service_jwt.signature_valid is sameas true
          - matrix_livekit_jwt_service_jwt.header.alg == 'HS256'
          - matrix_livekit_jwt_service_jwt.claims.iss == matrix_livekit_jwt_service_environment_variable_livekit_key
          - matrix_livekit_jwt_service_jwt.claims.sub == 'BE7ZK/J/c3LsogjI1JLni7qtWV/DP6c+ev68BvHem0Y'
          - matrix_livekit_jwt_service_jwt.claims.video.room == 'diNaPECp1jHt2l0dLdiDxi+dgNzgucxPYMD0lCs1tEQ'
          - matrix_livekit_jwt_service_jwt.claims.video.roomJoin is sameas true
          - "'roomCreate' not in matrix_livekit_jwt_service_jwt.claims.video"
          - matrix_livekit_jwt_service_jwt.claims.video.canPublish is sameas true
          - matrix_livekit_jwt_service_jwt.claims.video.canSubscribe is sameas true
          - matrix_livekit_jwt_service_jwt.claims.video.canUpdateOwnMetadata is sameas true
          - matrix_livekit_jwt_service_jwt.claims.exp | int - matrix_livekit_jwt_service_jwt.claims.nbf | int == 3600
        fail_msg: "The returned JWT lost its authenticated MSC4195 identity, room or restricted join grant"
        success_msg: "The returned JWT has a valid signature and restricted MSC4195 grant"
      vars:
        matrix_livekit_jwt_service_jwt: "{{ matrix_livekit_jwt_service_jwt_decode.stdout | from_json }}"

    - name: Read the OpenID fixture's observed requests
      ansible.builtin.command:
        argv:
          - docker
          - run
          - --rm
          - --network={{ matrix_livekit_jwt_service_container_network }}
          - "{{ molecule_shared_image_curl }}"
          - --silent
          - --show-error
          - --insecure
          - https://matrix-livekit-jwt-openid-fixture:8443/_molecule/requests
      register: matrix_livekit_jwt_service_openid_requests_command
      changed_when: false

    - name: Assert the live service exercised both OpenID fixture outcomes
      ansible.builtin.assert:
        that:
          - matrix_livekit_jwt_service_openid_requests.requests | length >= 3
          - matrix_livekit_jwt_service_openid_requests.requests | map(attribute='path') | unique | list == ['/_matrix/federation/v1/openid/userinfo']
          - matrix_livekit_jwt_service_openid_requests.requests[-3:] | map(attribute='access_token') | list == ['unknown-openid-token', 'known-openid-token', 'known-openid-token']
        fail_msg: "The OpenID fixture did not observe the expected unknown and known token exchanges"
        success_msg: "The service exercised both HTTPS OpenID fixture outcomes"
      vars:
        matrix_livekit_jwt_service_openid_requests: "{{ matrix_livekit_jwt_service_openid_requests_command.stdout | from_json }}"

    - name: Read the environment file the role rendered
      ansible.builtin.slurp:
        src: "{{ matrix_livekit_jwt_service_base_path }}/env"
      register: matrix_livekit_jwt_service_env_file

    - name: Initialize the parsed environment
      ansible.builtin.set_fact:
        matrix_livekit_jwt_service_env_parsed: {}

    - name: Parse the rendered environment
      ansible.builtin.set_fact:
        matrix_livekit_jwt_service_env_parsed: >-
          {{ matrix_livekit_jwt_service_env_parsed | combine({item.split('=', 1)[0]: item.split('=', 1)[1]}) }}
      loop: "{{ (matrix_livekit_jwt_service_env_file.content | b64decode).splitlines() | reject('equalto', '') }}"
      when: "'=' in item"
      no_log: true

    - name: Assert the rendered environment carries every scenario setting
      ansible.builtin.assert:
        that:
          - matrix_livekit_jwt_service_env_parsed.LIVEKIT_JWT_BIND == ':8097'
          - matrix_livekit_jwt_service_env_parsed.LIVEKIT_KEY == 'molecule-livekit-api-key'
          - matrix_livekit_jwt_service_env_parsed.LIVEKIT_SECRET == 'molecule-livekit-signing-secret-32-bytes-long'
          - matrix_livekit_jwt_service_env_parsed.LIVEKIT_URL == 'wss://sfu.livekit.molecule.invalid:7881/rtc'
          - matrix_livekit_jwt_service_env_parsed.LIVEKIT_FULL_ACCESS_HOMESERVERS == 'full-access.molecule.local,second-full-access.molecule.local'
          - matrix_livekit_jwt_service_env_parsed.LIVEKIT_CS_API_URL_OVERRIDES == 'matrix-openid-fixture:8443=https://client-api.override.molecule.invalid'
          - matrix_livekit_jwt_service_env_parsed.LIVEKIT_INSECURE_SKIP_VERIFY_TLS == 'YES_I_KNOW_WHAT_I_AM_DOING'
          - matrix_livekit_jwt_service_env_parsed.LIVEKIT_LOG_LEVEL == 'debug'
          - matrix_livekit_jwt_service_env_parsed.MOLECULE_LIVEKIT_MARKER == 'environment-reached'
        fail_msg: "The parsed environment file does not carry the scenario's complete contract"
        success_msg: "The parsed environment file carries every scenario setting"
      no_log: true

    - name: Read the labels file the role rendered
      ansible.builtin.slurp:
        src: "{{ matrix_livekit_jwt_service_base_path }}/labels"
      register: matrix_livekit_jwt_service_labels_file

    - name: Initialize the parsed labels
      ansible.builtin.set_fact:
        matrix_livekit_jwt_service_labels_parsed: {}

    - name: Parse the rendered labels
      ansible.builtin.set_fact:
        matrix_livekit_jwt_service_labels_parsed: >-
          {{ matrix_livekit_jwt_service_labels_parsed | combine({item.split('=', 1)[0]: item.split('=', 1)[1]}) }}
      loop: "{{ (matrix_livekit_jwt_service_labels_file.content | b64decode).splitlines() | reject('equalto', '') }}"
      when: "'=' in item"
      no_log: true

    - name: Assert the rendered labels carry the public routing contract
      ansible.builtin.assert:
        that:
          - matrix_livekit_jwt_service_labels_parsed['traefik.enable'] == 'true'
          - matrix_livekit_jwt_service_labels_parsed['traefik.docker.network'] == matrix_livekit_jwt_service_container_network
          - matrix_livekit_jwt_service_labels_parsed['traefik.http.services.matrix-livekit-jwt-service.loadbalancer.server.port'] == '8097'
          - matrix_livekit_jwt_service_labels_parsed['traefik.http.routers.matrix-livekit-jwt-service.rule'] == 'Host(`jwt.livekit.molecule.local`) && PathPrefix(`/matrix-rtc/jwt`)'
          - matrix_livekit_jwt_service_labels_parsed['traefik.http.routers.matrix-livekit-jwt-service.priority'] == '847'
          - matrix_livekit_jwt_service_labels_parsed['traefik.http.routers.matrix-livekit-jwt-service.entrypoints'] == 'web'
          - matrix_livekit_jwt_service_labels_parsed['traefik.http.routers.matrix-livekit-jwt-service.tls'] == 'false'
          - matrix_livekit_jwt_service_labels_parsed['traefik.http.routers.matrix-livekit-jwt-service.middlewares'] == 'matrix-livekit-jwt-service-slashless-redirect,matrix-livekit-jwt-service-strip-prefix,matrix-livekit-jwt-service-add-headers'
          - matrix_livekit_jwt_service_labels_parsed['traefik.http.middlewares.matrix-livekit-jwt-service-add-headers.headers.customresponseheaders.X-Molecule-LiveKit'] == 'jwt-service'
          - matrix_livekit_jwt_service_labels_parsed['molecule.livekit-jwt.coverage'] == 'enabled'
        fail_msg: "The parsed labels do not carry the scenario's routing contract"
        success_msg: "The parsed labels carry the scenario's complete routing contract"

    - name: Inspect the running LiveKit JWT service container
      ansible.builtin.command:
        argv:
          - docker
          - container
          - inspect
          - matrix-livekit-jwt-service
      register: matrix_livekit_jwt_service_container_inspect
      changed_when: false

    - name: Assert the configured environment reached the running container
      ansible.builtin.assert:
        that:
          - "'LIVEKIT_JWT_BIND=:8097' in matrix_livekit_jwt_service_runtime.Config.Env"
          - "'LIVEKIT_FULL_ACCESS_HOMESERVERS=full-access.molecule.local,second-full-access.molecule.local' in matrix_livekit_jwt_service_runtime.Config.Env"
          - "'LIVEKIT_CS_API_URL_OVERRIDES=matrix-openid-fixture:8443=https://client-api.override.molecule.invalid' in matrix_livekit_jwt_service_runtime.Config.Env"
          - "'LIVEKIT_INSECURE_SKIP_VERIFY_TLS=YES_I_KNOW_WHAT_I_AM_DOING' in matrix_livekit_jwt_service_runtime.Config.Env"
          - "'MOLECULE_LIVEKIT_MARKER=environment-reached' in matrix_livekit_jwt_service_runtime.Config.Env"
        fail_msg: "The running container environment lost role-rendered settings"
        success_msg: "The role-rendered environment reached the running container"

    - name: Assert the configured labels reached the running container
      ansible.builtin.assert:
        that:
          - matrix_livekit_jwt_service_runtime.Config.Labels['traefik.enable'] == 'true'
          - matrix_livekit_jwt_service_runtime.Config.Labels['traefik.docker.network'] == matrix_livekit_jwt_service_container_network
          - matrix_livekit_jwt_service_runtime.Config.Labels['traefik.http.routers.matrix-livekit-jwt-service.priority'] == '847'
          - matrix_livekit_jwt_service_runtime.Config.Labels['molecule.livekit-jwt.coverage'] == 'enabled'
          - matrix_livekit_jwt_service_runtime.Config.Labels['molecule.livekit-jwt.extra-argument'] == 'reached'
        fail_msg: "The running container lost role-rendered or extra-argument labels"
        success_msg: "The configured labels reached the running container"

    - name: Assert the running container uses the exact image and version the role pins
      ansible.builtin.assert:
        that:
          - matrix_livekit_jwt_service_runtime.Config.Image == matrix_livekit_jwt_service_expected_image
        fail_msg: >-
          The running container uses {{ matrix_livekit_jwt_service_runtime.Config.Image }},
          expected {{ matrix_livekit_jwt_service_expected_image }}
        success_msg: "The running container uses the exact image and version defaults/main.yml pins"
      vars:
        matrix_livekit_jwt_service_expected_image: >-
          {{ matrix_livekit_jwt_service_role_defaults.matrix_livekit_jwt_service_container_image_registry_prefix_upstream_default }}element-hq/lk-jwt-service:{{ matrix_livekit_jwt_service_role_defaults.matrix_livekit_jwt_service_version }}

    - name: Assert the running container identity and image command
      ansible.builtin.assert:
        that:
          - matrix_livekit_jwt_service_runtime.Config.User == (matrix_user_uid | string) ~ ':' ~ (matrix_user_gid | string)
          - matrix_livekit_jwt_service_runtime.Config.Entrypoint | default([], true) | length == 0
          - matrix_livekit_jwt_service_runtime.Config.Cmd == ['/lk-jwt-service']
          - matrix_livekit_jwt_service_runtime.HostConfig.RestartPolicy.Name == 'no'
          - matrix_livekit_jwt_service_runtime.HostConfig.AutoRemove is sameas true
          - matrix_livekit_jwt_service_runtime.HostConfig.LogConfig.Type == 'none'
        fail_msg: "The running container has an unexpected identity, command or Docker lifecycle"
        success_msg: "The running container uses the configured identity, command and Docker lifecycle"

    - name: Assert the running container security and filesystem contract
      ansible.builtin.assert:
        that:
          - matrix_livekit_jwt_service_runtime.HostConfig.Privileged is sameas false
          - matrix_livekit_jwt_service_runtime.HostConfig.CapAdd | default([], true) | length == 0
          - matrix_livekit_jwt_service_runtime.HostConfig.CapDrop == ['ALL']
          - matrix_livekit_jwt_service_runtime.HostConfig.ReadonlyRootfs is sameas false
          - matrix_livekit_jwt_service_runtime.Mounts | length == 0
          - matrix_livekit_jwt_service_runtime.HostConfig.Binds | default([], true) | length == 0
        fail_msg: "The running container differs from the role's capability and mount contract"
        success_msg: "The running container has all capabilities dropped and no mounts"

    - name: Assert the broken upstream healthcheck is disabled
      ansible.builtin.assert:
        that:
          - matrix_livekit_jwt_service_runtime.Config.Healthcheck is mapping
          - matrix_livekit_jwt_service_runtime.Config.Healthcheck.Test == ['NONE']
          - matrix_livekit_jwt_service_runtime.State.Health.Status is not defined
        fail_msg: "The v0.6.0 image healthcheck was not disabled by the role"
        success_msg: "The broken v0.6.0 image healthcheck is disabled"

    - name: Assert the running container is attached only to its dedicated network
      ansible.builtin.assert:
        that:
          - matrix_livekit_jwt_service_runtime.HostConfig.NetworkMode == matrix_livekit_jwt_service_container_network
          - matrix_livekit_jwt_service_runtime.NetworkSettings.Networks is mapping
          - matrix_livekit_jwt_service_runtime.NetworkSettings.Networks | length == 1
          - matrix_livekit_jwt_service_container_network in matrix_livekit_jwt_service_runtime.NetworkSettings.Networks
        fail_msg: >-
          LiveKit JWT service has unexpected network attachments:
          {{ matrix_livekit_jwt_service_runtime.NetworkSettings.Networks.keys() | list }}
        success_msg: "The running container is attached only to its dedicated network"

    - name: Assert the observable extra runtime argument reached Docker
      ansible.builtin.assert:
        that:
          - matrix_livekit_jwt_service_runtime.Config.Hostname == 'livekit-jwt-molecule-runtime'
        fail_msg: "The configured hostname extra argument did not reach Docker"
        success_msg: "The approved container extra-argument setting reached Docker"

    - name: Ask Docker for the service's published ports
      ansible.builtin.command:
        argv:
          - docker
          - container
          - port
          - matrix-livekit-jwt-service
      register: matrix_livekit_jwt_service_published_ports
      changed_when: false
      failed_when: false

    - name: Assert the role publishes no host ports
      ansible.builtin.assert:
        that:
          - matrix_livekit_jwt_service_runtime.Config.ExposedPorts.keys() | list == ['8080/tcp']
          - matrix_livekit_jwt_service_runtime.HostConfig.PortBindings | default({}, true) | length == 0
          - matrix_livekit_jwt_service_published_ports.rc == 0
          - matrix_livekit_jwt_service_published_ports.stdout | trim | length == 0
        fail_msg: >-
          LiveKit JWT service unexpectedly publishes a host port:
          {{ matrix_livekit_jwt_service_published_ports.stdout | default('unknown') }}
        success_msg: "The role leaves the image's declared port unpublished"