# Multi-stage build: frontend (Vite) + backend (FastAPI)

FROM node:20-alpine AS front-build
WORKDIR /frontend
COPY frontend/package.json ./
COPY frontend/package-lock.json ./
# Force npm install to regenerate lockfile if needed, avoiding npm ci strict checks
RUN rm -f package-lock.json && npm install
COPY frontend/ .
# Fix permissions for vite binary
RUN chmod +x node_modules/.bin/vite
RUN npm run build

FROM python:3.11-slim-bookworm AS app
ENV PYTHONDONTWRITEBYTECODE=1
ENV PYTHONUNBUFFERED=1
ENV PYTHONPATH=/app
WORKDIR /app

ARG DEBIAN_FRONTEND=noninteractive
RUN set -eux; \
    printf 'deb https://deb.debian.org/debian bookworm main\n' > /etc/apt/sources.list; \
    printf 'deb https://deb.debian.org/debian bookworm-updates main\n' >> /etc/apt/sources.list; \
    printf 'deb https://security.debian.org/debian-security bookworm-security main\n' >> /etc/apt/sources.list; \
    printf 'Acquire::Retries "5";\nAcquire::http::Pipeline-Depth "0";\nAcquire::ForceIPv4 "true";\nAcquire::http::Timeout "30";\nAcquire::https::Timeout "30";\n' > /etc/apt/apt.conf.d/99acquire; \
    (apt-get update || (sleep 5 && apt-get update)) && \
    apt-get install -y --no-install-recommends ca-certificates curl gnupg tini build-essential libgl1 libglib2.0-0 && \
    rm -rf /var/lib/apt/lists/*

# Ensure pip does not enforce hashes globally
RUN printf "[global]\nrequire-hashes = false\n" > /etc/pip.conf

COPY backend/requirements.txt /app/requirements.txt
ENV PIP_DISABLE_PIP_VERSION_CHECK=1 PIP_DEFAULT_TIMEOUT=600
# Install pinned CPU-only PyTorch stack from stable wheel index
RUN pip install --no-cache-dir --prefer-binary -v \
    torch==2.3.1 torchvision==0.18.1 torchaudio==2.3.1
# Install remaining backend dependencies
RUN pip install --no-cache-dir --prefer-binary --timeout 600 -r /app/requirements.txt

COPY backend/ /app/backend/
COPY --from=front-build /frontend/dist /app/frontend-dist

EXPOSE 2026
CMD ["uvicorn", "backend.app.main:app", "--host", "0.0.0.0", "--port", "2026"]
