# syntax=docker/dockerfile:1
FROM python:3.12-slim AS base

ENV PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    PIP_NO_CACHE_DIR=1 \
    PIP_DISABLE_PIP_VERSION_CHECK=1

WORKDIR /app

# System deps kept minimal; reportlab/asyncpg/bcrypt ship manylinux wheels.
RUN apt-get update \
    && apt-get install -y --no-install-recommends curl \
    && rm -rf /var/lib/apt/lists/*

# Install Python dependencies first for better layer caching.
COPY pyproject.toml ./
RUN pip install --upgrade pip setuptools wheel \
    && pip install .

# Application source
COPY . .

# Normalize the entrypoint regardless of the source checkout: strip any CRLF
# line endings (Windows checkouts) and ensure the +x bit (git archive may drop it).
RUN sed -i 's/\r$//' entrypoint.sh && chmod +x entrypoint.sh

# Run as a non-root user (defense in depth).
RUN useradd --create-home --uid 10001 appuser \
    && mkdir -p /data/evidence \
    && chown -R appuser:appuser /app /data
USER appuser

# --- Build provenance (issue #22) --------------------------------------------
# CI/compose pass these; a local arg-less build keeps the historical defaults
# (build=local / git_commit=unknown) so dev workflows are unchanged. The app
# reads the ENV back via Settings and serves it at /version + /version/build.
ARG GIT_COMMIT=unknown
ARG BUILD_ID=local
ARG VERSION=dev
ARG BUILD_DATE=unknown
ENV GIT_COMMIT=$GIT_COMMIT \
    BUILD=$BUILD_ID \
    BUILD_VERSION=$VERSION \
    BUILD_DATE=$BUILD_DATE
LABEL org.opencontainers.image.revision=$GIT_COMMIT \
      org.opencontainers.image.version=$VERSION \
      org.opencontainers.image.created=$BUILD_DATE

EXPOSE 8000

ENTRYPOINT ["./entrypoint.sh"]
CMD ["api"]
