#!/usr/bin/env bash
# T61: ports 스코프 없는 HTTP 전용 attribute(methods)를 가진 DENY 정책이
# 순수 TCP(비-HTTP) 트래픽에서 "조건 없는 DENY"로 붕괴해 전체 연결을 차단하는지 검증.
set -euo pipefail

NS="istio-vt-t61"
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
MANIFEST="${SCRIPT_DIR}/manifest.yaml"

cleanup() {
  echo "=== cleanup: deleting namespace ${NS} ==="
  kubectl delete namespace "${NS}" --wait=false --ignore-not-found
}
trap cleanup EXIT

echo "=== create namespace ${NS} (istio-injection=enabled) ==="
kubectl create namespace "${NS}"
kubectl label namespace "${NS}" istio-injection=enabled

echo "=== apply manifest ==="
kubectl apply -f "${MANIFEST}"

echo "=== wait for pods Ready ==="
kubectl -n "${NS}" wait --for=condition=Ready pod/client pod/raw-tcp-svc --timeout=90s
kubectl -n "${NS}" rollout status deploy/echo --timeout=90s

echo "=== settle ==="
sleep 5

echo "=== observe: GET to raw-tcp-svc (non-HTTP TCP port) while DENY policy only specifies operation.methods (no ports) ==="
kubectl -n "${NS}" exec client -c curl -- curl -s -o /dev/null \
  -w 'blocked_even_though_it_is_a_get=%{http_code}\n' --max-time 4 \
  "http://raw-tcp-svc.${NS}.svc.homelab.local:9191/" ; echo "exit=$?"

# Expected (per doc claim under test): exit != 0, http_code=000 -> connection itself
# was dropped by the TCP proxy filter chain, confirming the HTTP-only attribute
# collapses to an unconditional DENY on raw TCP traffic.