from pathlib import Path

# Harden briefing selection branches so it cannot create/refresh downstream fields
p=Path('/opt/struktur/social-media-radar/content_briefing.py'); s=p.read_text()
s=s.replace('''            "SELECT * FROM signals WHERE director_action = ? ORDER BY director_score DESC LIMIT ?",''','''            "SELECT * FROM signals WHERE director_action = ? AND mas_relevant=1 AND COALESCE(content_blocked,0)=0 ORDER BY director_score DESC LIMIT ?",''')
s=s.replace('''              AND (COALESCE(mallorca_relevance, 0) > 0 OR COALESCE(mas_relevant, 0) = 1)
              AND (? OR COALESCE(briefing_winkel, '') = '')''','''              AND mas_relevant=1 AND COALESCE(content_blocked,0)=0
              AND (? OR COALESCE(briefing_winkel, '') = '')''')
s=s.replace('''        "SELECT * FROM signals ORDER BY director_score DESC LIMIT 2000"''','''        "SELECT * FROM signals WHERE mas_relevant=1 AND COALESCE(content_blocked,0)=0 ORDER BY director_score DESC LIMIT 2000"''')
p.write_text(s)

# Harden status and draft state-changing endpoints
p=Path('/opt/struktur/social-media-agent/app.py'); s=p.read_text()
old='''    now = _dt.now(_tz.utc).isoformat()
    try:
        conn = _pw_conn()
        conn.execute(
            "UPDATE signals SET publish_status=?, publish_status_at=? WHERE signal_id=?",
            (new_ps, now, signal_id)
        )
'''
new='''    now = _dt.now(_tz.utc).isoformat()
    try:
        conn = _pw_conn()
        gate = conn.execute("SELECT mas_relevant, COALESCE(content_blocked,0) FROM signals WHERE signal_id=?", (signal_id,)).fetchone()
        if not gate or gate[0] != 1 or gate[1] != 0:
            conn.close()
            return jsonify({"error": "Signal ist nicht für MAS-Content zugelassen"}), 403
        conn.execute(
            "UPDATE signals SET publish_status=?, publish_status_at=? WHERE signal_id=?",
            (new_ps, now, signal_id)
        )
'''
assert old in s; s=s.replace(old,new,1)
# Add a common draft gate function before approve route
needle='''@app.route("/api/content-draft/<draft_id>/approve", methods=["POST"])
def api_draft_approve(draft_id):
    conn = _signals_conn()
'''
repl='''def _draft_gate(conn, draft_id):
    return conn.execute("""SELECT d.draft_id FROM content_drafts d JOIN signals s ON s.signal_id=d.signal_id
                          WHERE d.draft_id=? AND s.mas_relevant=1 AND COALESCE(s.content_blocked,0)=0""", (draft_id,)).fetchone()

@app.route("/api/content-draft/<draft_id>/approve", methods=["POST"])
def api_draft_approve(draft_id):
    conn = _signals_conn()
    if not _draft_gate(conn, draft_id):
        conn.close()
        return jsonify({"error": "Draft-Signal ist nicht für MAS-Content zugelassen"}), 403
'''
assert needle in s; s=s.replace(needle,repl,1)
for name in ['reject','published','update']:
    marker=f'''def api_draft_{name}(draft_id):\n    conn = _signals_conn()'''
    replacement=f'''def api_draft_{name}(draft_id):\n    conn = _signals_conn()\n    if not _draft_gate(conn, draft_id):\n        conn.close()\n        return jsonify({{"error": "Draft-Signal ist nicht für MAS-Content zugelassen"}}), 403'''
    assert marker in s, name
    s=s.replace(marker,replacement,1)
p.write_text(s)