# SoulShop API — CyberSoul SecurITy's JSON API backend.  LAB USE ONLY.
#
# The API-attack chapter of the course spine (shop -> api -> cloud -> soulsearch).
# A REALISTIC modern JSON API (FastAPI + JWT bearer auth) with ONE deliberate
# flaw: a weak HMAC signing secret. jwt_scan cracks it, forges a role:admin
# token, and opens /api/admin/customers -> whose data reuses a credential into
# the cloud portal. Signature/alg/exp are otherwise verified CORRECTLY, so
# jwt_scan's other checks (alg:none, unverified-sig, expired) correctly report
# NOT vulnerable.
#
# FastAPI's auto /openapi.json publishes the HTTPBearer security scheme, which is
# exactly how SoulEyez's http_fingerprint tags the host JWT-gated and fires the
# jwt_scan chain. Multi-arch (python:3.12-slim is native amd64 + arm64, no qemu).
# Runs on the souleyez-dmz bridge as api.cybersoulsecurity.com — never expose it.

FROM python:3.12-slim

ENV PIP_NO_CACHE_DIR=1 \
    PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1

# Pinned, mainstream API stack. PyJWT is the standard JWT lib.
RUN pip install --no-cache-dir \
        "fastapi==0.115.*" \
        "uvicorn[standard]==0.30.*" \
        "pydantic>=2,<3" \
        "PyJWT==2.*"

WORKDIR /app
COPY app/ /app/
COPY entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh

EXPOSE 80
CMD ["/entrypoint.sh"]
