FROM python:3.11-slim AS base

ARG DEBIAN_FRONTEND=noninteractive
ARG JRE_VERSION=17.0.18+10
ARG JRE_DEB="bellsoft-jre${JRE_VERSION}-linux-amd64-full.deb"
ARG JRE_URL=https://download.bell-sw.com/java/${JRE_VERSION}/${JRE_DEB}
ARG INSEL_VERSION=8.3.4.0b
ARG INSEL_DEB="insel_${INSEL_VERSION}_x64_mini.deb"
ARG INSEL_URL=https://insel.eu/download/${INSEL_DEB}

# Java 17 (SimStadt requirement) + INSEL (SimStadt's PV/irradiance workflow steps shell out to it).
# curl is only a build-time dependency to fetch the JRE/INSEL .deb files; it is installed and
# removed within this same layer so it never persists in the final image.
RUN apt-get update && \
    apt-get install curl --no-install-recommends -y && \
    curl ${JRE_URL} -o /tmp/${JRE_DEB} -k && \
    curl ${INSEL_URL} -o /tmp/${INSEL_DEB} -k && \
    apt-get install /tmp/${JRE_DEB} /tmp/${INSEL_DEB} --no-install-recommends -y && \
    apt-get remove curl -y && \
    rm -rf /var/lib/apt/lists/* && \
    apt-get clean && \
    rm /tmp/${JRE_DEB} /tmp/${INSEL_DEB}

# SRA (Simplified Radiosity Algorithm, used by shadow-processing workflow steps) is a
# separate ~550KB binary+library, not bundled in the SimStadt zip itself. Cheap enough to
# always include, even though the current test suite's shadow-processing integration tests
# already pass without it (SimStadt appears to fall back to a pure-Java path when absent).
# citysim_sra links against libGLU at runtime, hence libglu1-mesa below (small: ~1MB installed).
RUN apt-get update && \
    apt-get install libglu1-mesa --no-install-recommends -y && \
    rm -rf /var/lib/apt/lists/* && \
    apt-get clean
ADD https://simstadt.hft-stuttgart.de/download/InstallFiles/citysim_sra /usr/local/bin/
RUN chmod a+rx /usr/local/bin/citysim_sra
ADD https://simstadt.hft-stuttgart.de/download/InstallFiles/libshortwave.so /usr/lib/
RUN chmod a+r /usr/lib/libshortwave.so

RUN groupadd -g 1000 simstadt \
  && useradd simstadt --create-home --shell /bin/bash -u 1000 -g 1000

COPY --from=ghcr.io/astral-sh/uv:0.12.17 /uv /uvx /usr/local/bin/

RUN mkdir -p /opt/venv && chown simstadt:simstadt /opt/venv
ENV VIRTUAL_ENV=/opt/venv
ENV UV_PROJECT_ENVIRONMENT=/opt/venv
ENV PATH="/opt/venv/bin:${PATH}"

USER simstadt
RUN mkdir -p /home/simstadt/app /home/simstadt/Desktop
WORKDIR /home/simstadt/app

FROM base AS cli

# `simstadt` is unpinned (always the latest PyPI release), and `simstadt --install`
# always fetches the latest SimStadt build — there's no version/URL override available
# for either today. This is a deliberate tradeoff for a "real, current" image, not
# an oversight: it means the build needs network access, and rebuilding this stage later
# can silently bake in different simstadt/SimStadt versions than a previous build.
COPY --chown=simstadt:simstadt pyproject.toml uv.lock README.md ./
RUN uv sync --frozen --no-install-project
# `uv pip install` (unlike `uv sync`) doesn't consult uv.lock: a future published `simstadt`
# release could bump a shared runtime dep (matplotlib/numpy/pandas/...) past what the frozen
# sync above just pinned, silently upgrading it. Accepted for now, same spirit as leaving
# `simstadt` itself unpinned below — revisit with `uv pip install --constraint` if it bites.
RUN uv pip install simstadt

RUN simstadt --install

# tests/ is copied last (after the network-bound `simstadt --install`) so editing a test
# doesn't invalidate that layer's cache. It also means a future consumer using this image as
# a base (see the design doc's ":cli as a candidate FROM base" note) would inherit tests/ and
# the pytest/pytest-cov/rich dev group as dead weight — a known, small, accepted cost of
# this image serving two purposes (runtime + release smoke test) from one artifact.
COPY --chown=simstadt:simstadt tests ./tests

# This image tests the PUBLISHED simstadt package (from PyPI) against a real SimStadt/INSEL
# install — a release/environment smoke test, not a pre-publish check of local changes
# (which `make simple_tests` already covers via mocks, no Docker/real SimStadt needed).
# Tests are run via an explicit `docker run <image> <test-command>` override (see the
# Makefile's `docker-test` target: `uv run --no-sync pytest -v`). Plain `uv run pytest -v`
# is deliberately NOT used here since this stage never copies `src/`, so `uv run`'s implicit
# sync would try (and fail) to build/install the local project from a nonexistent `src/`.
# `--no-sync` skips that; plain `pytest -v` would also work (the venv's `bin/` is already on
# `PATH` via `base`), but `uv run --no-sync` was chosen to match this repo's other test
# targets' `uv run` style.
CMD ["simstadt"]
