# QR Scan Difficulty Check: the measured bell, and five open-source QR scanners that place your pictures on it.
FROM python:3.13-slim-bookworm

# Java runs ZXing as Android's Settings app does; curl fetches the pinned third-party files below
RUN apt-get update \
 && apt-get install -y --no-install-recommends openjdk-17-jdk-headless curl ca-certificates \
 && rm -rf /var/lib/apt/lists/*

WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir --require-hashes --only-binary=:all: -r requirements.txt

# ZXing core 3.5.2 from Maven Central, and WeChat's detector and super-resolution models with their licence from
# WeChatCV's opencv_3rdparty repository (Apache-2.0) at a fixed commit, each checked against a pinned SHA-256
COPY server/vendor.sha256 /app/vendor/vendor.sha256
RUN cd /app/vendor && mkdir -p zxing wechat \
 && curl -fsSL -o zxing/core-3.5.2.jar https://repo1.maven.org/maven2/com/google/zxing/core/3.5.2/core-3.5.2.jar \
 && for f in detect.prototxt detect.caffemodel sr.prototxt sr.caffemodel LICENSE; do \
      curl -fsSL -o "wechat/$f" "https://raw.githubusercontent.com/WeChatCV/opencv_3rdparty/3487ef7cde71d93c6a01bb0b84aa0f22c6128f6b/$f"; \
    done \
 && sha256sum -c vendor.sha256

COPY server/ /app/server/
RUN javac --release 17 -d /app/vendor/zxing/classes -cp /app/vendor/zxing/core-3.5.2.jar /app/server/zxing/ZxingServer.java
COPY web/ /app/web/

RUN useradd -m -u 1000 user
USER user
ENV PYTHONUNBUFFERED=1 PYTHONDONTWRITEBYTECODE=1 OPENCV_IO_MAX_IMAGE_PIXELS=50000000
EXPOSE 7860
CMD ["uvicorn", "server.main:app", "--host", "0.0.0.0", "--port", "7860", "--no-access-log"]