From ec3e5dc9eb3dc23204243dd3b8b0daca29a334b1 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Sun, 21 Jun 2026 21:47:35 +0200
Subject: [PATCH] feat(dev): include firewall capabilities in flux defaults

---
 app/Console/Commands/FluxDev.php     | 4 ++++
 tests/Feature/FluxDevCommandTest.php | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/app/Console/Commands/FluxDev.php b/app/Console/Commands/FluxDev.php
index ed8c015c4..2451fac77 100644
--- a/app/Console/Commands/FluxDev.php
+++ b/app/Console/Commands/FluxDev.php
@@ -39,6 +39,10 @@ class FluxDev extends Command
             'containers.healthcheck.run',
             'ingress.apply',
             'ingress.stop',
+            'firewall.allow',
+            'firewall.revoke',
+            'firewall.list',
+            'firewall.reconcile',
         ];
     }
 
diff --git a/tests/Feature/FluxDevCommandTest.php b/tests/Feature/FluxDevCommandTest.php
index f3bdc98fd..1bc905fd6 100644
--- a/tests/Feature/FluxDevCommandTest.php
+++ b/tests/Feature/FluxDevCommandTest.php
@@ -44,6 +44,10 @@ it('mints a host jwt with primitive capabilities by default', function () {
 
     expect($claims->caps)->toContain('containers.list')
         ->and($claims->caps)->toContain('ingress.apply')
+        ->and($claims->caps)->toContain('firewall.allow')
+        ->and($claims->caps)->toContain('firewall.revoke')
+        ->and($claims->caps)->toContain('firewall.list')
+        ->and($claims->caps)->toContain('firewall.reconcile')
         ->and($claims->caps)->not->toContain('coold');
 });