#!/bin/bash
set -euo pipefail

# The maintenance terminal, for the one person who is allowed one.
#
# Normal administration is over SSH. This exists for the case where
# somebody is standing at a classroom machine and SSH is not available,
# and it is reached only by a deliberately awkward chord that no teacher
# will find by accident.
#
# Why it is a wrapper rather than plain Konsole:
#
#   the classroom's Kiosk policy sets shell_access=false, and Konsole
#   honours it — measured: with the classroom configuration in its
#   cascade it starts and prints "Program to run not set." rather than
#   opening a shell. That restriction is worth keeping for everything
#   else, so it is lifted for this one process by leaving the classroom's
#   configuration directory out of its cascade. Nothing is patched and no
#   binary is replaced; XDG_CONFIG_DIRS is the documented way to say
#   which configuration an application sees.
#
# The terminal therefore looks like stock KDE rather than like the
# classroom, which is fair: it is not part of the classroom.
#
# This grants no privilege. The classroom user has no sudo rule, and
# anything that needs root still needs the administrator's own account
# and password. The Kiosk restriction was always a barrier in the
# interface, never a privilege boundary.

exec env XDG_CONFIG_DIRS=/etc/xdg konsole "$@"