FROM python:3.11-slim

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1

WORKDIR /app

# Install server dependencies first for better layer caching
COPY sasi_server/requirements.txt /app/sasi_server/requirements.txt
RUN python -m pip install --no-cache-dir -U pip \
    && python -m pip install --no-cache-dir -r /app/sasi_server/requirements.txt

# Install the local SDK package (so sasi_server can import sasi_sdk)
COPY pyproject.toml /app/pyproject.toml
COPY README.md /app/README.md
COPY sasi_sdk /app/sasi_sdk
RUN python -m pip install --no-cache-dir -e /app

# Bundle MiniLM ONNX into the image (crisis semantic anchors). Do not set
# SASI_DISABLE_SEMANTIC or SASI_SERVERLESS_MODE in production if you need this path.
# Override path at runtime with SASI_ONNX_MODEL_PATH if the file is mounted elsewhere.
#
# Bundle tokenizer files alongside ONNX model to prevent network fetch on cold
# start in restricted-network production environments (Cloud Run). Without local
# tokenizer, embeddings fall back to mock vectors silently.
#
# SASKI-AUD-005: pinned to an immutable HuggingFace commit (not the mutable "main"
# branch) and verified against a SHA256 checksum after download. Must match
# sasi_sdk/utils/model_manager.py MODEL_INFO["minilm"]["sha256"] and
# docs/MODEL_ARTIFACT_INTEGRITY.md — update all three together if the model changes.
ARG MINILM_REVISION=1110a243fdf4706b3f48f1d95db1a4f5529b4d41
ARG MINILM_SHA256=6fd5d72fe4589f189f8ebc006442dbb529bb7ce38f8082112682524616046452
RUN apt-get update \
    && apt-get install -y --no-install-recommends curl ca-certificates \
    && rm -rf /var/lib/apt/lists/* \
    && mkdir -p /app/sasi_sdk/models/minilm_onnx \
    && curl -fsSL -o /app/sasi_sdk/models/minilm_onnx/all-MiniLM-L6-v2.onnx \
        "https://huggingface.co/sentence-transformers/all-MiniLM-L6-v2/resolve/${MINILM_REVISION}/onnx/model.onnx" \
    && echo "${MINILM_SHA256}  /app/sasi_sdk/models/minilm_onnx/all-MiniLM-L6-v2.onnx" | sha256sum -c \
    && curl -fsSL -o /app/sasi_sdk/models/minilm_onnx/tokenizer_config.json \
        "https://huggingface.co/sentence-transformers/all-MiniLM-L6-v2/resolve/${MINILM_REVISION}/tokenizer_config.json" \
    && curl -fsSL -o /app/sasi_sdk/models/minilm_onnx/tokenizer.json \
        "https://huggingface.co/sentence-transformers/all-MiniLM-L6-v2/resolve/${MINILM_REVISION}/tokenizer.json" \
    && curl -fsSL -o /app/sasi_sdk/models/minilm_onnx/vocab.txt \
        "https://huggingface.co/sentence-transformers/all-MiniLM-L6-v2/resolve/${MINILM_REVISION}/vocab.txt" \
    && curl -fsSL -o /app/sasi_sdk/models/minilm_onnx/special_tokens_map.json \
        "https://huggingface.co/sentence-transformers/all-MiniLM-L6-v2/resolve/${MINILM_REVISION}/special_tokens_map.json"

# Copy the server code
COPY sasi_server /app/sasi_server

EXPOSE 8080

CMD ["python", "-m", "uvicorn", "sasi_server.main:app", "--host", "0.0.0.0", "--port", "8080"]
