FROM python:3.11-slim

WORKDIR /app

# Playwright/Chromium system deps + virtual display (Xvfb) + noVNC for interactive MFA
RUN apt-get update && apt-get install -y --no-install-recommends \
    libnss3 libnspr4 libatk1.0-0 libatk-bridge2.0-0 libcups2 libdrm2 \
    libxkbcommon0 libxcomposite1 libxdamage1 libxfixes3 libxrandr2 \
    libgbm1 libasound2 libpango-1.0-0 libcairo2 libatspi2.0-0 \
    fonts-liberation ca-certificates \
    xvfb x11vnc novnc websockify fluxbox \
    && rm -rf /var/lib/apt/lists/*

# Install deps first (better layer cache). Context is filtered by .dockerignore.
COPY backend/requirements.txt backend/requirements.txt
RUN pip install --no-cache-dir -r backend/requirements.txt \
    && playwright install chromium

# App only — no .env, no backend/data, no pts-data, no host secrets (see .dockerignore)
COPY backend/ backend/
COPY frontend/ frontend/
COPY extension/ extension/
COPY docker/entrypoint.sh /entrypoint.sh
COPY .env.example .env.example

# Ensure no accidental local data was copied (belt-and-suspenders)
RUN rm -rf /app/backend/data \
    && mkdir -p /app/backend/data \
    && chmod +x /entrypoint.sh

ENV PTS_DATA_DIR=/data
ENV PTS_RELOAD=false
ENV PTS_IN_DOCKER=true
# Headed Chromium on Xvfb for MFA; login API still requests headless=false
ENV TEAMS_HEADLESS=false
ENV DISPLAY=:99
ENV TEAMS_VNC_PORT=6080
ENV PYTHONUNBUFFERED=1
# Playwright/Chromium in container
ENV PLAYWRIGHT_BROWSERS_PATH=/root/.cache/ms-playwright

EXPOSE 8765 6080

WORKDIR /app/backend

ENTRYPOINT ["/entrypoint.sh"]
CMD ["python", "-m", "uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8765"]