#!/usr/bin/env bash
set -euo pipefail

root="${AGENTTEAM_GLOBAL_EXTENSION_EGRESS_GUARD_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd -P)}"
prefix="AGENTTEAM_EXTENSION_EGRESS_ALLOWED_"
origin_key="${prefix}ORIGINS"
cidr_key="${prefix}CIDRS"
allowed_origins_field="AllowedOrigins"
allowed_cidrs_field="AllowedCIDRs"
validator_name="ValidateOperatorAllowlist"

matches="$(
  rg -n -F \
    -e "${origin_key}" \
    -e "${cidr_key}" \
    -e "${allowed_origins_field}" \
    -e "${allowed_cidrs_field}" \
    -e "${validator_name}" \
    --glob '!docs/superpowers/**' \
    --glob '!guardrails/repository/no-global-extension-egress.sh' \
    --glob '!guardrails/repository/no-global-extension-egress-test.sh' \
    "${root}" 2>/dev/null || true
)"
if [[ -n "${matches}" ]]; then
  printf 'Global Extension egress exception guard failed:\n%s\n' "${matches}" >&2
  exit 1
fi

echo "Global Extension egress exception guard passed."