"""Run after root installs firewall. No keys or patient data are accessed."""
import subprocess

blocked_probe = """
import requests,sys
try:
    response=requests.get('http://10.240.70.70:6003/mcp',timeout=4)
    print('FAIL: direct 1C access returned HTTP',response.status_code)
    sys.exit(1)
except requests.exceptions.Timeout:
    print('PASS: direct 1C access timed out')
except requests.exceptions.RequestException as error:
    print('INCONCLUSIVE: upstream unreachable:',type(error).__name__)
    sys.exit(2)
"""
failures = 0
for name in ("dana-medical-api-1", "bright-app"):
    print("Checking container network:", name, flush=True)
    result = subprocess.run([
        "docker", "run", "--rm", "--network", "container:" + name,
        "--read-only", "--cap-drop", "ALL", "--security-opt", "no-new-privileges:true",
        "--entrypoint", "python", "dana-1c-bridge:security-20261020", "-c", blocked_probe,
    ])
    failures += result.returncode != 0
allowed_probe = "import requests,os; r=requests.get(os.environ['ONEC_MCP_URL'],timeout=4); print('Bridge reaches 1C, HTTP:',r.status_code)"
result = subprocess.run(["docker", "exec", "dana-1c-bridge", "python", "-c", allowed_probe])
failures += result.returncode != 0
raise SystemExit(1 if failures else 0)