#!/usr/bin/env bash
# T59: AuthorizationPolicy ALLOW asymmetry — 0 policies = default-allow,
# 1 unrelated-path ALLOW policy = deny-by-default flip.
set -euo pipefail

NS="istio-vt-t59"
DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

cleanup() {
  kubectl delete namespace "$NS" --wait=false --ignore-not-found
}
trap cleanup EXIT

kubectl create namespace "$NS"
kubectl label namespace "$NS" istio-injection=enabled

kubectl apply -f "$DIR/client-echo.yaml"
kubectl -n "$NS" wait --for=condition=Ready pod/client --timeout=90s
kubectl -n "$NS" rollout status deployment/echo --timeout=120s

echo "=== before any AuthorizationPolicy ==="
kubectl -n "$NS" exec client -c curl -- curl -s -o /dev/null \
  -w 'no_allow_policy=%{http_code}\n' \
  "http://echo.${NS}.svc.homelab.local/anything"

kubectl apply -f "$DIR/unrelated-allow.yaml"
sleep 5

echo "=== after one unrelated-path ALLOW policy ==="
kubectl -n "$NS" exec client -c curl -- curl -s -o /dev/null \
  -w 'after_one_unrelated_allow=%{http_code}\n' \
  "http://echo.${NS}.svc.homelab.local/anything"