SASE & private access

curl -sX POST "$BASE/sase/ztna/policies" "${H[@]}" \
  -d '{
    "name": "payments-api",
    "resource": "svc://payments.prod",
    "allow_groups": ["sre", "payments-oncall"],
    "ports": [443],
    "min_trust": 70,
    "require_posture": true
  }'
# → 201 { "id": "ztna-7", "default_action": "deny", "version": 1 }

# Evaluate a request → a recorded session verdict
curl -sX POST "$BASE/sase/ztna/grant" "${H[@]}" \
  -d '{ "policy":"ztna-7", "user":"ada", "groups":["sre"],
        "device":"dev-1", "trust":82, "posture":true,
        "resource":"svc://payments.prod" }'
# → 200 { "decision": "allow", "session": "sess-1a2b", "ttl_s": 900 }

# 1. Author the unified policy (bumps the version)
curl -sX POST "$BASE/upo/policy" "${H[@]}" -d '{
  "name": "corp-baseline",
  "user_groups": ["eng","sales"],
  "segments": ["prod","corp"],
  "applications": ["payments","crm"],
  "access_rules": [{ "user_group":"eng", "segment":"prod", "action":"allow" }],
  "egress_policies": [{ "target":"crm", "action":"inspect", "inspection_level":"deep" }]
}'

# 2. Validate fail-closed (an invalid policy cannot compile)
curl -sX POST "$BASE/upo/policy/validate" "${H[@]}"
# → { "valid": true, "errors": [] }

# 3. Compile → a deterministic ruleset per target
curl -sX POST "$BASE/upo/compile" "${H[@]}" \
  -d '{ "targets": ["ztna","sdwan","firewall"] }'
# → { "ztna": {...}, "sdwan": {...}, "firewall": {...}, "policy_version": 4 }

# 4. Apply firewall → a diff vs the last-applied baseline
curl -sX POST "$BASE/upo/apply" "${H[@]}" -d '{ "target":"firewall" }'
# → { "target":"firewall", "added":["deny corp→prod"],
#     "removed":[], "unchanged_count": 12 }

# Create a tenant mesh (MTU validated 1280–1420 → MSS = MTU − 40)
curl -sX POST "$BASE/mesh" "${H[@]}" \
  -d '{ "name":"corp-overlay", "mtu":1420 }'   # → { "id":"mesh-1", "mss":1380 }

# Enroll a peer by PUBLIC KEY ONLY (private_key → 400)
curl -sX POST "$BASE/mesh/mesh-1/peers" "${H[@]}" \
  -d '{ "name":"laptop", "public_key":"kA", "region":"eu-central" }'

# Pull the zero-knowledge wg-quick config
curl -s "$BASE/mesh/mesh-1/peers/peer-1/wg-config" "${H[@]}"
#   [Interface]
#   # PrivateKey: supplied by the node — control plane is zero-knowledge
#   Address = 100.100.1.1/32   ListenPort = 51820   MTU = 1420