#!/usr/bin/env python3
"""Record private-Space access boundaries without recording any credential."""
from datetime import datetime,timezone
import json
from pathlib import Path
import httpx
from huggingface_hub import HfApi,get_token

space='Mike0021/qwen-image';token=get_token()
if not token:raise SystemExit('Existing authentication required')
api=HfApi(token=token);info=api.space_info(space)
host=info.runtime.raw['domains'][0]['domain'];url='https://'+host
anonymous=httpx.get(url+'/config',timeout=30)
authenticated=httpx.get(url+'/config',headers={'Authorization':'Bearer '+token},timeout=30)
r={'at':datetime.now(timezone.utc).isoformat(),'space':space,'hub_commit':info.sha,
 'private':info.private,'runtime_stage':str(info.runtime.stage),'hardware':str(info.runtime.hardware),
 'anonymous_config_http':anonymous.status_code,'authenticated_config_http':authenticated.status_code}
assert r['private'] and r['runtime_stage']=='RUNNING' and r['hardware']=='zero-a10g'
assert r['anonymous_config_http'] in (401,403,404) and r['authenticated_config_http']==200
out=Path('artifacts/deployment');out.mkdir(parents=True,exist_ok=True)
(out/(datetime.now(timezone.utc).strftime('%Y%m%dT%H%M%S')+'-access.json')).write_text(json.dumps(r,indent=2))
print(json.dumps(r))