"""Open only the approved workspace/source/setup boundary for si."""
import json
import os
from pathlib import Path
import subprocess

if os.geteuid() != 0:
    raise SystemExit("sudo required")
record = Path("/var/lib/contextra-maintenance/access-before.json")
if record.exists():
    raise SystemExit("Access already prepared; no repeated ACL change")
paths = [Path("/workspace"),Path("/workspace/contextra"),Path("/workspace/contextra/source")]
before = {}
for path in paths:
    if path.is_symlink() or not path.is_dir():
        raise RuntimeError("Expected directory missing")
    before[str(path)] = subprocess.check_output(["getfacl","-p",str(path)],text=True,timeout=10)
record.parent.mkdir(parents=True,exist_ok=True,mode=0o700)
record.write_text(json.dumps(before,indent=2))
record.chmod(0o600)
subprocess.run(["setfacl","-m","u:si:--x","/workspace"],check=True,timeout=10)
subprocess.run(["setfacl","-m","u:si:r-x","/workspace/contextra"],check=True,timeout=10)
subprocess.run(["setfacl","-m","u:si:rwx,d:u:si:rwx","/workspace/contextra/source"],check=True,timeout=10)
setup = Path("/workspace/contextra/setup")
if setup.exists():
    raise RuntimeError("Existing setup directory requires review")
setup.mkdir(mode=0o750)
os.chown(setup,0,1001)
for name in ("inbox","outbox","notes"):
    p=setup/name
    p.mkdir(mode=0o2770)
    os.chown(p,1001,1001)
    subprocess.run(["setfacl","-m","d:u:si:rwx,d:g::rwx,d:o::---",str(p)],check=True,timeout=10)
print("Source/setup access prepared; auth/DB/ledger/media permissions unchanged")