#!/usr/bin/env bash
# T37: ServiceEntry/VirtualService exportTo scoping test
# - scoped-mock-se (exportTo: ['.']) should be visible only within its own namespace's sidecars
# - leaky-vs-no-exportto (no exportTo) should leak globally to other namespaces until exportTo: ['.'] is added
set -euo pipefail

NS=istio-vt-t37
NS_B=istio-vt-t37-b
DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

cleanup() {
  echo "--- cleanup: deleting namespace ${NS} (and embedded ${NS_B}) ---"
  kubectl delete namespace "${NS}" --wait=false --ignore-not-found
  kubectl delete namespace "${NS_B}" --wait=false --ignore-not-found
}
trap cleanup EXIT

echo "--- create namespace ${NS} (istio-injection=enabled) ---"
kubectl create namespace "${NS}" --dry-run=client -o yaml | \
  kubectl label --local -f - istio-injection=enabled -o yaml | \
  kubectl apply -f -

echo "--- apply client/echo + client-b namespace ---"
kubectl apply -f "${DIR}/client-echo.yaml" -f "${DIR}/client-b-ns.yaml"
kubectl -n "${NS}" wait --for=condition=Ready pod/client --timeout=90s
kubectl -n "${NS_B}" wait --for=condition=Ready pod/client-b --timeout=90s
kubectl -n "${NS}" rollout status deploy/echo --timeout=120s

echo "--- apply scoped ServiceEntry (exportTo: ['.']) ---"
kubectl apply -f "${DIR}/scoped-mock-se.yaml"
sleep 5

echo "--- check SE visibility (own ns vs cross ns), filtered to port 80 to avoid cross-test noise on the shared external host ---"
echo -n "own ns (expect >0): "
istioctl proxy-config cluster "client.${NS}" --fqdn mock.istio-verify-ext.svc.homelab.local --port 80 -o json 2>/dev/null | jq length
echo -n "cross ns (expect 0): "
istioctl proxy-config cluster "client-b.${NS_B}" --fqdn mock.istio-verify-ext.svc.homelab.local --port 80 -o json 2>/dev/null | jq length

echo "--- baseline cross-ns call before leaky VS (expect 200) ---"
kubectl -n "${NS_B}" exec client-b -c curl -- curl -s -o /dev/null -w 'crossns_before_vs=%{http_code}\n' "http://echo.${NS}.svc.homelab.local/"

echo "--- apply VirtualService with NO exportTo (should leak globally) ---"
kubectl apply -f "${DIR}/leaky-vs-no-exportto.yaml"
sleep 5
kubectl -n "${NS_B}" exec client-b -c curl -- curl -s -o /dev/null -w 'crossns_after_vs_leak=%{http_code}\n' "http://echo.${NS}.svc.homelab.local/"

echo "--- patch VirtualService with exportTo: ['.'] (should stop the leak) ---"
kubectl -n "${NS}" patch virtualservice leaky-vs-no-exportto --type merge -p '{"spec":{"exportTo":["."]}}'
sleep 5
kubectl -n "${NS_B}" exec client-b -c curl -- curl -s -o /dev/null -w 'crossns_after_exportto_dot=%{http_code}\n' "http://echo.${NS}.svc.homelab.local/"

echo "--- done ---"