#!/usr/bin/env bash
# Mock `nft`. linux.sh's capability-aware $NFT selection runs `nft list
# ruleset` at TOP LEVEL, unconditionally, on every single invocation
# regardless of verb — so unlike a normal hard-fail tripwire mock, that one
# call must succeed-or-fail plausibly rather than abort the test. It answers
# with a plain "no capability" (exit 1 — the same as what an unprivileged
# caller without CAP_NET_ADMIN gets for real), which sends the script down
# its ordinary `sudo nft` fallback exactly as it would on any dev machine.
#
# Nothing in this test suite exercises redirect-on/off/status's nft path
# (install-launcher and status's launcher/node-ca sections never touch it),
# so anything else is unexpected here and is a hard-fail tripwire, matching
# the convention Locke's own uninstall.sh test harness uses for commands no
# test should reach.
if [ "$1" = "list" ] && [ "$2" = "ruleset" ]; then
  exit 1
fi
echo "MOCK-nft: refusing unexpected invocation: $*" >&2
exit 97
