- name: compile list of users using connect_perfact
  set_fact:
    perfact_users: "{{ users | map_dict_values_to_subkey('ssh_keys') | map_dict_values_to_subkey('laptop') }}"
  changed_when: False

- name: create perfact_employees group
  become: true
  group:
    name: perfact_employees

- name: create users for perfact-employees
  become: true
  user:
    name: "{{ item }}"
    groups: perfact_employees
  with_items: "{{ perfact_users.keys() | list }}"

- name: create authorized_key for perfact-employees
  become: true
  authorized_key:
    user: "{{ item.key }}"
    key: "{{ item.value | ssh_key_enforce_no_pty | join('\n') }}"
    exclusive: true
  with_items: "{{ perfact_users | dict2items }}"

- name: list users on the system
  shell: "grep '^perfact_employees:.*$' /etc/group | cut -d: -f4"
  register:
    users_on_system
  changed_when: False

#  FIXME  - this is not working
#  - name: delete users that are no longer there
#    become: true
#    user:
#      name: "{{ item }}"
#      remove: true
#    with_items: "{{ users_on_system.stdout_lines[0].split(',') | difference(perfact_users.keys()) }}"
