#!/usr/bin/env bash
set -euo pipefail

# T70: PeerAuthentication absent -> default PERMISSIVE; STRICT vs PERMISSIVE vs
# in-mesh mTLS client behavior against echo.
#
# covers: xds__src-cr-xds-model#C7, blog:security_mtls-spiffe-identity#C13

NS="istio-vt-t70"
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
MANIFEST="${SCRIPT_DIR}/manifest.yaml"

cleanup() {
  echo "cleaning up namespace ${NS}..."
  kubectl delete namespace "${NS}" --wait=false --ignore-not-found
}
trap cleanup EXIT

kubectl create namespace "${NS}"
kubectl label namespace "${NS}" istio-injection=enabled

kubectl apply -f "${MANIFEST}"

kubectl -n "${NS}" wait --for=condition=Ready pod/client pod/plaintext-prober --timeout=90s
kubectl -n "${NS}" rollout status deployment/echo --timeout=120s

ECHO_IP=$(kubectl -n "${NS}" get pod -l app=echo -o jsonpath='{.items[0].status.podIP}')

# Baseline: no PeerAuthentication -> default PERMISSIVE mode
kubectl -n "${NS}" exec plaintext-prober -- curl -s -o /dev/null -w 'default_permissive_plaintext=%{http_code}\n' --max-time 4 "http://${ECHO_IP}:8080/"
kubectl -n "${NS}" exec client -c curl -- curl -s -o /dev/null -w 'mesh_client_default=%{http_code}\n' "http://echo.${NS}.svc.homelab.local/"

# Apply STRICT PeerAuthentication for app=echo
kubectl apply -f - <<YAML
apiVersion: security.istio.io/v1
kind: PeerAuthentication
metadata:
  name: echo-strict-peerauth
  namespace: ${NS}
spec:
  selector:
    matchLabels:
      app: echo
  mtls:
    mode: STRICT
YAML

sleep 8

# Expect plaintext to fail at the listener (no HTTP code, non-zero exit)
kubectl -n "${NS}" exec plaintext-prober -- curl -s -o /dev/null -w 'strict_plaintext=%{http_code}\n' --max-time 4 "http://${ECHO_IP}:8080/" ; echo "strict_plaintext_exit=$?"

# In-mesh mTLS client should still succeed under STRICT
kubectl -n "${NS}" exec client -c curl -- curl -s -o /dev/null -w 'mesh_client_strict=%{http_code}\n' "http://echo.${NS}.svc.homelab.local/"