{{- if .Values.networkPolicy.enabled }}
{{- $np := .Values.networkPolicy -}}
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: {{ include "claude-code.fullname" . }}-session
  namespace: {{ include "claude-code.sessionsNamespace" . }}
  labels:
    {{- include "claude-code.labels" . | nindent 4 }}
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: claude-code
      app.kubernetes.io/component: session
  policyTypes:
    - Ingress
    - Egress
  ingress:
    # 制御プレーン（gateway）からの ttyd 接続のみ許可
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: {{ .Release.Namespace }}
          podSelector:
            matchLabels:
              {{- include "claude-code.selectorLabels" . | nindent 14 }}
              app.kubernetes.io/component: control-plane
      ports:
        - protocol: TCP
          port: {{ .Values.session.ttydPort }}
  egress:
    # DNS
    - to:
        - namespaceSelector:
            matchLabels:
              {{- toYaml $np.dnsNamespaceSelector | nindent 14 }}
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53
    {{- if $np.allowInternetHttps }}
    # HTTPS（git over HTTPS + api.anthropic.com）。内部レンジは except で遮断。
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
            {{- with $np.blockedEgressCIDRs }}
            except:
              {{- toYaml . | nindent 14 }}
            {{- end }}
      ports:
        - protocol: TCP
          port: 443
    {{- end }}
    {{- if $np.allowSshGit }}
    # SSH git（port 22）
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
            {{- with $np.blockedEgressCIDRs }}
            except:
              {{- toYaml . | nindent 14 }}
            {{- end }}
      ports:
        - protocol: TCP
          port: 22
    {{- end }}
    {{- range $np.sessionEgressExtra }}
    - to:
        - ipBlock:
            cidr: {{ .cidr }}
      ports:
        {{- toYaml .ports | nindent 8 }}
    {{- end }}
{{- end }}