# syntax=docker/dockerfile:1.7

FROM python:3.12-slim AS base

# `uv` ships as a tiny static binary; copy it from the official image to avoid
# re-resolving it inside this layer.
COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv

# Match the package name on PyPI / source layout.
WORKDIR /app

# Install dependencies first so the layer is cacheable on source-only changes.
COPY pyproject.toml uv.lock README.md LICENSE /app/
COPY src /app/src

# `--frozen` ensures we install the exact resolved versions from uv.lock.
# Skip dev dependency group; users running the container don't need pytest etc.
RUN uv sync --frozen --no-dev

# Tokens live under XDG by default — for a long-running container, mount this
# directory from the host (or a named volume) so refresh tokens persist:
#
#   docker run -v ~/.config/inoreader-mcp:/root/.config/inoreader-mcp \
#     -e INOREADER_APP_ID=... -e INOREADER_APP_KEY=... \
#     ghcr.io/ibrapk/inoreader-mcp serve
#
# Authorization itself must be done on the host (the OAuth loopback can't reach
# a port inside the container easily). Run `inoreader-mcp auth --manual` on the
# host once, then mount the resulting tokens.json into the container.
ENV INOREADER_APP_ID=""
ENV INOREADER_APP_KEY=""

ENTRYPOINT ["uv", "run", "--frozen", "inoreader-mcp"]
CMD ["serve"]
