"""Install guarded boot wiring only after successful local enrollment/application."""
import json
import os
from pathlib import Path
import subprocess

ROOT=Path('/workspace/contextra')
STAGE=Path('/storage/contextra/deploy/ai2-20261006-r01')
UUID='e49118da-66c6-49c3-b180-1d9146742b0e'

def cmd(args,timeout=30):
    return subprocess.check_output(args,text=True,stderr=subprocess.STDOUT,timeout=timeout)

def put(path,text,mode=0o644):
    if path.exists():
        assert path.read_text()==text and (path.stat().st_mode&0o777)==mode, 'Changed target preserved: '+str(path)
        return
    with path.open('x') as f:f.write(text)
    path.chmod(mode)

def main():
    os.umask(0o077)
    assert cmd(['hostname']).strip()=='icertirnd-ai'
    assert cmd(['findmnt','-n','-o','UUID','-T','/storage']).strip()==UUID
    active=json.loads((ROOT/'runtime/state/active.json').read_text())
    assert active['enrolled'] is True
    server=json.loads(Path('/etc/contextra-maintenance/server.json').read_text())
    assert server['server']=='icerti-ai2' and server['operator']=='si'
    assert not (Path(server['paths']['state'])/'apply-pending.json').exists()
    units=[]
    for name in ('models','artifacts','training'):
        dest=ROOT/'data'/name;dest.mkdir(exist_ok=True,mode=0o755)
        if os.path.ismount(dest):
            assert os.path.samefile(dest,Path('/storage/contextra')/name)
        else:
            assert not any(dest.iterdir())
        unit='workspace-contextra-data-'+name+'.mount'
        put(Path('/etc/systemd/system')/unit,
            '[Unit]\nDescription=Contextra AI2 '+name+' view\nRequires=storage.mount\nAfter=storage.mount\n'
            'Before=contextra-ai2-runtime.service\n\n[Mount]\nWhat=/storage/contextra/'+name+'\nWhere='+str(dest)+'\nType=none\nOptions=bind\nTimeoutSec=30\n\n[Install]\nWantedBy=multi-user.target\n')
        units.append(unit)
    guard=ROOT/'runtime/boot_storage_guard.py'
    put(guard,"import subprocess\nfrom pathlib import Path\nexpected="+repr(UUID)+"\nactual=subprocess.check_output(['findmnt','-n','-o','UUID','-T','/storage'],text=True,timeout=5).strip()\nif actual!=expected or not Path('/storage').is_mount():raise SystemExit('Required storage UUID missing; no Runtime start')\n",0o644)
    fw=Path('/etc/systemd/system/contextra-ai2-redis-access.service')
    put(fw,'[Unit]\nDescription=Contextra AI2 Redis peer protection\nAfter=docker.service storage.mount\nRequires=docker.service storage.mount\nPartOf=docker.service\n\n[Service]\nType=oneshot\nExecStart=/usr/bin/python3 '+server['firewall']['script']+'\nRemainAfterExit=yes\nTimeoutStartSec=60\n\n[Install]\nWantedBy=docker.service\n')
    runtime=Path('/etc/systemd/system/contextra-ai2-runtime.service')
    put(runtime,'[Unit]\nDescription=Contextra AI2 guarded Runtime\nRequires=docker.service storage.mount contextra-ai2-redis-access.service\n'
        'Wants=network-online.target\nAfter=docker.service storage.mount network-online.target contextra-ai2-redis-access.service\nPartOf=docker.service\n'
        'RequiresMountsFor=/storage/contextra/models /storage/contextra/artifacts /storage/contextra/training\n\n'
        '[Service]\nType=oneshot\nRemainAfterExit=yes\nExecStartPre=/usr/bin/python3 '+str(guard)+'\n'
        'ExecStart=/usr/local/bin/ct start\nExecStop=/usr/local/bin/ct stop\nTimeoutStartSec=300\nTimeoutStopSec=420\n\n'
        '[Install]\nWantedBy=multi-user.target docker.service\n')
    storage_unit=Path(cmd(['systemctl','show','storage.mount','-p','FragmentPath','--value']).strip())
    assert storage_unit.is_file() and ('Where=/storage' in storage_unit.read_text())
    cmd(['systemd-analyze','verify',str(storage_unit),*[str(Path('/etc/systemd/system')/u) for u in units],str(fw),str(runtime)],30)
    cmd(['systemctl','daemon-reload'])
    cmd(['systemctl','enable',*units,fw.name,runtime.name])
    cmd(['systemctl','start',*units],90)
    cmd(['python3',str(guard)])
    for name in ('models','artifacts','training'):
        assert os.stat(ROOT/'data'/name).st_dev==os.stat(Path('/storage/contextra')/name).st_dev
    # Allow operator traversal of the data views, not access to private enrollment/session files.
    cmd(['setfacl','-m','u:si:r-x',str(ROOT/'data'),str(ROOT/'source')])
    receipt={'boot_unit':runtime.name,'enabled':cmd(['systemctl','is-enabled',runtime.name]).strip(),
             'storage_uuid':UUID,'views':units,'actual_reboot_tested':False,'camera_autostart':False}
    put(STAGE/'boot-ready.json',json.dumps(receipt,indent=2)+'\n',0o600)
    print(json.dumps(receipt))

if __name__=='__main__':main()