# ---------------------------------------------------------------------------
# Stage 1: Builder — install dependencies with uv
# ---------------------------------------------------------------------------
FROM python:3.11-slim AS builder

COPY --from=ghcr.io/astral-sh/uv:0.7 /uv /usr/local/bin/uv

WORKDIR /app

# Copy everything needed for install
COPY pyproject.toml README.md ./
COPY src/ src/

# Create venv and install package + deps
RUN --mount=type=cache,target=/root/.cache/uv \
    uv venv /app/.venv && \
    uv pip install --python /app/.venv/bin/python .

# ---------------------------------------------------------------------------
# Stage 2: Runtime — minimal image
# ---------------------------------------------------------------------------
FROM python:3.11-slim AS runtime

RUN apt-get update && apt-get install -y --no-install-recommends curl && \
    rm -rf /var/lib/apt/lists/*

# Create non-root user
RUN groupadd --gid 1000 appuser && \
    useradd --uid 1000 --gid appuser --create-home appuser

WORKDIR /app

# Copy venv from builder
COPY --from=builder /app/.venv /app/.venv

# Ensure config directories exist and are writable
# /home/appuser/.config/... is the default for local/STDIO mode
# /data/config is used when overridden by docker-compose (volume mount)
RUN mkdir -p /home/appuser/.config/google-workspace-mcp/tokens && \
    chown -R appuser:appuser /home/appuser/.config && \
    mkdir -p /data/config/tokens /data/config/users /data/config/kv_store && \
    chown -R appuser:appuser /data

ENV PATH="/app/.venv/bin:$PATH" \
    PYTHONUNBUFFERED=1 \
    GW_MCP_TRANSPORT=http \
    GW_MCP_HOST=0.0.0.0 \
    GW_MCP_PORT=8000 \
    GW_MCP_CONFIG_DIR=/home/appuser/.config/google-workspace-mcp

EXPOSE 8000

USER appuser

HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
    CMD curl -f http://localhost:8000/health || exit 1

CMD ["google-workspace-mcp"]
