# Stage 1: build the Cedar FFI library (Rust). cedar-policy is pinned to 4.13.0 in Cargo.toml / Cargo.lock.
FROM rust:1-slim-bookworm AS cedar
WORKDIR /w
COPY third_party/CedarDotNet/src/CedarDotNetFfi ./ffi
RUN cd ffi && cargo build --release

# Stage 2: harness (.NET 10, needed because CedarDotNet multi-targets net8/9/10) + Python API server
FROM mcr.microsoft.com/dotnet/sdk:10.0

RUN apt-get update && apt-get install -y --no-install-recommends python3 python3-pip && rm -rf /var/lib/apt/lists/*
ENV DOTNET_CLI_TELEMETRY_OPTOUT=1 DOTNET_NOLOGO=1 PYTHONUNBUFFERED=1 HF_HOME=/app/.cache/hf FINDAJEV_ROOT=/app
WORKDIR /app

COPY requirements.txt .
RUN pip3 install --no-cache-dir --break-system-packages -r requirements.txt fastapi "uvicorn[standard]" "gradio==6.28.0"

COPY third_party ./third_party
COPY --from=cedar /w/ffi/target/release/libcedar_dotnet_ffi.so ./third_party/CedarDotNet/src/CedarDotNet/runtimes/linux-x64/native/
COPY src ./src
RUN dotnet build src/FindAJev.Bench -c Release -o bin -v q

COPY policies ./policies
COPY models.json suites.json server.py ui.py PROJECT.md ./
COPY tools ./tools
COPY results ./results
# Fail the image build if the policies do not validate, a golden case regresses, or Cedar itself misbehaves (gate checks, <1 s).
RUN dotnet bin/FindAJev.Bench.dll cedar-suite --checks policy-validate,golden-cases,conformance

# Spaces run the container as uid 1000; the .NET 10 base image already has a user with that uid, so use it numerically
ENV HOME=/app
RUN mkdir -p /app/models /app/data /app/.cache && chown -R 1000:1000 /app
USER 1000
EXPOSE 7860
CMD ["uvicorn", "server:app", "--host", "0.0.0.0", "--port", "7860"]