#!/usr/bin/env bash
# Live, rerunnable acceptance proof for the installed buildbox sandbox. It checks
# the complete policy shape: an allowlisted host works, while both a DNS name and
# a literal address outside the allowlist cannot connect.
set -euo pipefail

SANDBOX_RUN="${SANDBOX_RUN:-$HOME/.local/share/overdeck-sandbox/bin/sandbox-run}"
ID="egress-proof-$$"

[ -x "$SANDBOX_RUN" ] || {
  echo "egress enforcement test: sandbox-run not installed at $SANDBOX_RUN" >&2
  exit 2
}

"$SANDBOX_RUN" --id "$ID" -- /bin/bash -ceu '
probe_allowed() {
  code="$(curl --connect-timeout 8 --max-time 20 -sS -o /dev/null -w "%{http_code}" https://pypi.org/simple/)"
  [[ "$code" =~ ^(2|3) ]] || { echo "FAIL allowlisted pypi.org returned HTTP $code"; exit 1; }
  echo "PASS allowlisted-domain pypi.org HTTP $code"
}
probe_blocked() {
  local label=$1 url=$2 output rc
  set +e
  output="$(curl --connect-timeout 3 --max-time 6 -sS -o /dev/null -w "%{http_code}" "$url" 2>&1)"
  rc=$?
  set -e
  if [ "$rc" -eq 0 ]; then
    echo "FAIL $label unexpectedly connected: $output"
    exit 1
  fi
  echo "PASS $label blocked curl_rc=$rc"
}
probe_allowed
probe_blocked non-allowlisted-domain https://example.com/
probe_blocked non-allowlisted-ip https://1.1.1.1/
'