#!/usr/bin/env bash
set -euo pipefail

root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd -P)"
guard="${root}/guardrails/repository/no-global-extension-egress.sh"
fixture="$(mktemp -d)"
trap 'rm -rf "${fixture}"' EXIT

expect_failure() {
  local label="$1"
  if AGENTTEAM_GLOBAL_EXTENSION_EGRESS_GUARD_ROOT="${fixture}" bash "${guard}" >/dev/null 2>&1; then
    echo "expected ${label} fixture to fail" >&2
    exit 1
  fi
}

AGENTTEAM_GLOBAL_EXTENSION_EGRESS_GUARD_ROOT="${fixture}" bash "${guard}" >/dev/null

mkdir -p "${fixture}/internal/config"
printf 'key := %s%s\n' "AGENTTEAM_EXTENSION_EGRESS_ALLOWED_" "ORIGINS" \
  >"${fixture}/internal/config/stale.go"
expect_failure "retired origin environment variable"

printf 'type Config struct { %s []string }\n' "AllowedCIDRs" \
  >"${fixture}/internal/config/stale.go"
expect_failure "retired CIDR configuration field"

echo "Global Extension egress exception guard tests passed."