# syntax=docker/dockerfile:1
FROM node:22.19.0-bookworm-slim@sha256:4a4884e8a44826194dff92ba316264f392056cbe243dcc9fd3551e71cea02b90 AS node-runtime
WORKDIR /opt/pi-runtime
COPY docker/pi-runtime/package.json docker/pi-runtime/package-lock.json ./
RUN npm ci --omit=dev --ignore-scripts --no-audit --no-fund \
    && ./node_modules/.bin/pi --version

FROM node:22.19.0-bookworm-slim@sha256:4a4884e8a44826194dff92ba316264f392056cbe243dcc9fd3551e71cea02b90 AS backend-build
WORKDIR /src/backend
COPY backend/package.json backend/package-lock.json ./
RUN npm ci --no-audit --no-fund
COPY backend/ ./
RUN npm run build \
    && npm prune --omit=dev

FROM node:22.19.0-bookworm-slim@sha256:4a4884e8a44826194dff92ba316264f392056cbe243dcc9fd3551e71cea02b90 AS gate-deps
WORKDIR /src/harness
COPY harness/package.json harness/package-lock.json ./
RUN npm ci --no-audit --no-fund

FROM python:3.12.11-slim-bookworm@sha256:519591d6871b7bc437060736b9f7456b8731f1499a57e22e6c285135ae657bf7 AS runtime

RUN apt-get update \
    && apt-get install --yes --no-install-recommends ca-certificates curl \
    && rm -rf /var/lib/apt/lists/* \
    && useradd --create-home --uid 10001 thoth \
    && mkdir -p /app/backend /app/docker/smoke /data/settings \
    && chown -R thoth:thoth /data

COPY --from=node-runtime /usr/local/bin/node /usr/local/bin/node
COPY --from=node-runtime /opt/pi-runtime /opt/pi-runtime
RUN ln -s /opt/pi-runtime/node_modules/.bin/pi /usr/local/bin/pi \
    && node --version \
    && pi --version

WORKDIR /app
COPY harness/ /app/harness/
COPY --from=gate-deps /src/harness/node_modules /app/harness/node_modules
COPY docker/python-runtime/requirements.lock /app/docker/python-runtime/requirements.lock
RUN python -m venv /opt/venv \
    && /opt/venv/bin/pip install --no-cache-dir --require-hashes \
      --requirement /app/docker/python-runtime/requirements.lock \
    && /opt/venv/bin/pip install --no-cache-dir --no-deps --no-build-isolation /app/harness

COPY --from=backend-build /src/backend/dist /app/backend/dist
COPY --from=backend-build /src/backend/node_modules /app/backend/node_modules
COPY docker/core-entrypoint.sh /app/docker/core-entrypoint.sh
COPY docker/smoke/core-smoke.sh /app/docker/smoke/core-smoke.sh
RUN chmod 0555 /app/docker/core-entrypoint.sh /app/docker/smoke/core-smoke.sh \
    && test ! -e /app/harness/.env \
    && test ! -d /app/harness/workspaces

ENV PATH="/opt/venv/bin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" \
    HOST=0.0.0.0 \
    PORT=8787 \
    THT_HARNESS_DIR=/app/harness \
    THT_BIN=/opt/venv/bin/tht \
    PI_BIN=/usr/local/bin/pi \
    THT_DATA_ROOT=/data \
    SETTINGS_FILE=/data/settings/settings.json \
    HOME=/home/thoth

WORKDIR /app/harness
EXPOSE 8787
USER 10001:10001
ENTRYPOINT ["/app/docker/core-entrypoint.sh"]
CMD ["server"]