{
  "id": "starter-networking",
  "name": "Disable and restore Starter public networking",
  "start": { "path": "/tidbs/{{starterClusterId}}/networking" },
  "risk": "mutating",
  "goal": [
    "Wait for Networking to finish loading and for the Public Endpoint action to be enabled, then observe its initial state. If it is already Disabled, enable it and finish after Enabled with a Disable action is visible.",
    "If it is initially Enabled, disable it, confirm the warning dialog, and wait until Disabled with an Enable action is visible.",
    "Re-enable it immediately and wait until Enabled with a Disable action is visible so the safe state is restored."
  ],
  "success": {
    "evidence": [
      { "kind": "url", "matches": "/tidbs/[^/]+/networking(?:[/?]|$)" },
      { "kind": "testIdVisible", "testId": "networking-public-endpoint-toggle" },
      { "kind": "absentText", "matches": "Disable Public Endpoint|Failed|Error" }
    ]
  },
  "recovery": [
    "After each accepted toggle, wait for both the status badge and action label to change before continuing; never click the toggle twice while it is loading.",
    "If the disable step succeeds but a later action is interrupted, prioritize restoring the Public Endpoint to Enabled before stopping."
  ],
  "limits": { "maxDurationMs": 180000, "maxActions": 18 },
  "safety": {
    "deny": ["Do not leave networking disabled or modify firewall rules, IP access lists, or private endpoints."],
    "networkGuards": [
      {
        "id": "starter-public-endpoint-toggle",
        "method": "PATCH",
        "pathMatches": "^/api/v2023/serverless/v1beta1/clusters/([^/]+)$",
        "bodyEquals": { "updateMask": "endpoints.public.disabled" },
        "bodyMatches": { "cluster.endpoints.public.disabled": "^(?:true|false)$" },
        "finalResponseBodyEquals": { "endpoints.public.disabled": false },
        "deduplicateBy": ["cluster.endpoints.public.disabled"],
        "minRequests": 1,
        "maxRequests": 2,
        "required": true,
        "resourceIdentity": {
          "requestPathMatches": "^/api/v2023/serverless/v1beta1/clusters/([^/]+)$",
          "capturedVariable": "starterClusterId"
        }
      }
    ]
  }
}