#!/usr/bin/env bash
# Stub HTTPS client for dispatch.test.sh (STORY-348 T-PB-348c): `egress-probe
# <host>` requests <host> the way a proxy-honouring client in the image would.
# With no proxy, or not on the proxy's network, there is no route (the internal
# network). Through the proxy it applies the proxy's REAL generated filter
# (the ERE lib/sandbox.sh wrote) the way tinyproxy does — case-insensitive,
# FilterDefaultDeny — and logs a refusal in tinyproxy's words.
host="$1"
proxy="${HTTPS_PROXY:-}"
if [[ -z "$proxy" ]]; then echo "egress-probe ${host}: no route to host"; exit 7; fi
name="${proxy#http://}"; name="${name%%:*}"
dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)/containers/${name}"
if [[ ! -d "$dir" ]] || ! grep -qxF "${FAKE_NETWORK:-}" "$dir/networks" 2>/dev/null; then
  echo "egress-probe ${host}: no route to proxy"; exit 7
fi
if grep -qiEf "$(cat "$dir/conf")/filter" <<<"$host"; then
  echo "egress-probe ${host}: 200"
else
  echo "NOTICE   Oct 08 00:00:00 [1]: Proxying refused on filtered domain \"${host}\"" >> "$dir/proxy.log"
  echo "egress-probe ${host}: 403 Filtered"; exit 22
fi
