#!/bin/sh
set -eu
fail=0
expect_denied() { if "$@" >/dev/null 2>&1; then echo "UNEXPECTED SUCCESS: $*" >&2; fail=1; fi; }

test "$(id -u)" -eq 1200
test "$DOCKER_HOST" = unix:///run/user/1200/docker.sock
touch /srv/le-app-codex/tmp/phase2b-write-test
rm /srv/le-app-codex/tmp/phase2b-write-test
expect_denied ls /var/www
expect_denied ls /root
expect_denied ls /home
expect_denied ls /srv/directus-archive
expect_denied ls /srv/codex-work
expect_denied stat /run/docker.sock
expect_denied stat /var/run/docker.sock
expect_denied stat /run/containerd/containerd.sock
expect_denied stat /dev/sda
expect_denied stat /proc/1/root
expect_denied sh -c 'echo x > /etc/phase2b-write-test'
expect_denied sh -c 'echo x > /srv/phase2b-write-test'
expect_denied curl -4fsS --connect-timeout 2 http://127.0.0.1
expect_denied curl -4fsS --connect-timeout 2 http://10.200.120.1
expect_denied curl -4fsS --connect-timeout 2 http://192.168.10.151
expect_denied nc -w2 -z 192.168.10.1 53
expect_denied curl -4fsS --connect-timeout 2 http://10.98.0.2
expect_denied curl -4fsS --connect-timeout 2 http://74.67.173.56
expect_denied curl -4fsS --connect-timeout 2 http://169.254.169.254/latest/meta-data/
expect_denied curl -6fsS --connect-timeout 2 https://[::1]/
expect_denied nc -w2 -z 1.1.1.1 25
expect_denied nc -w2 -z 1.1.1.1 465
expect_denied nc -w2 -z 1.1.1.1 587
test "$(ps -e --no-headers | wc -l)" -lt 32
test -w /dev/fuse
test -w /dev/net/tun
grep -q '^nameserver 9\.9\.9\.9$' /etc/resolv.conf
grep -q '^nameserver 149\.112\.112\.112$' /etc/resolv.conf
getent ahostsv4 example.com >/dev/null
test -r /sys/fs/cgroup/cpu.max
test -r /sys/fs/cgroup/memory.max
exit "$fail"