module

Krikri::PluginHelpers::GroupState

GroupState - pure logic for parsing getent group output and deciding what (if anything) needs to change to reconcile a group with its desired state. No I/O here: the plugin itself calls getent/groupadd/ etc and hands the results in as plain strings.

Class methods

groupadd_args(name : String, gid : String | Nil, system : Bool, non_unique : Bool = false, gid_min : String | Nil = nil, gid_max : String | Nil = nil, local : Bool = false) : Array(String)

groupadd/lgroupadd argument list for a brand new group. Desired values that are nil are simply omitted, letting groupadd apply its own defaults. Flag order matches the real module's group_add exactly (live-verified: groupadd -g 1234 -o -r -K GID_MIN=500 -K GID_MAX=1000 g1): -g gid, then -o (non_unique - only ever meaningful alongside a -g, same nesting real Ansible uses), then -r (system - passed unconditionally on the local path too, lgroupadd accepts it: lgroupadd -r g1-sys-xyz), then the -K GID_MIN/GID_MAX pairs.

The -K pairs never ride along on the local path - real Ansible refuses gid_min/gid_max + local outright before any command runs (live-verified: "'gid_min' can not be used with 'local'"), and even without that gate its local branch never emits them.

Source
groupmod_flags(current : Group, desired_gid : String | Nil, non_unique : Bool = false) : Array(String)

groupmod/lgroupmod flags needed to reconcile an existing group with the desired gid. Empty array means nothing to change. -o (non_unique) only ever rides along with a gid that's actually changing - real Ansible nests it inside its own gid-differs branch (live-verified: groupmod -g 4711 -o root, and nothing when the gid already matches).

Source
local_gid_conflict(content : String, name : String, gid : String) : String | Nil

local: true's gid-in-use pre-check - real Ansible's own _local_check_gid_exists runs before every lgroupadd/lgroupmod with a gid and fails when any NSS-visible group (grp.getgrall, so the full listing, not a single-key lookup) already owns that gid under a DIFFERENT name, even with non_unique: (live-verified: local create with gid 4 fails "GID '4' already exists with group 'adm'" while the same request without local is left to lgroupadd/groupadd's own duplicate-gid handling). Returns the conflicting group's name, or nil when the gid is free. Faithfully replicates the real module's Python-truthiness quirk: if self.gid: means gid 0 skips the check entirely (live-verified - gid 0 with a different name does NOT fail).

Source
local_parse(content : String, name : String) : Group | Nil

local: true's existence check - real Ansible's own group_exists reads /etc/group directly (its own comment: the grp module "does not distinguish between local and directory accounts") instead of any NSS query, scanning the file's lines REVERSED so the LAST matching "name:" line wins. nil when the name isn't in the file at all.

Source
parse(line : String) : Group | Nil

Parses a single getent group <name> line: "name:password:gid:members"

Source

Nested types