FROM python:3.11.9-slim-bookworm

# Vulnerable pattern reference (pinned for evidence):
#   lemur/lemur/auth/service.py:130-137
#     header_data = fetch_token_header(token)
#     payload = decode_with_multiple_secrets(
#         token, token_secrets, algorithms=[header_data["alg"]]   # <-- attacker controls alg
#     )

RUN apt-get update && apt-get install -y --no-install-recommends \
        curl ca-certificates \
    && rm -rf /var/lib/apt/lists/*

RUN pip install --no-cache-dir \
        flask==3.0.3 \
        pyjwt==2.8.0

WORKDIR /app

# Pin the antipattern excerpt from upstream so evidence shows the exact lines.
RUN mkdir -p /app/evidence-src && \
    printf '%s\n' \
'# lemur/lemur/auth/service.py:130-137' \
'try:' \
'    header_data = fetch_token_header(token)' \
'    payload = decode_with_multiple_secrets(' \
'        token, token_secrets, algorithms=[header_data["alg"]]   # <-- antipattern' \
'    )' \
'except jwt.DecodeError:' \
'    return dict(message="Token is invalid"), 403' \
> /app/evidence-src/jwt_sink.txt

# Faithful config file: includes the LEMUR_TOKEN_SECRET like a real deployment.
RUN printf '%s\n' \
"# /app/lemur.conf.py (sample deployment config)" \
"LEMUR_TOKEN_SECRET = 'lab-deploy-token-secret-DO-NOT-USE-IN-PROD-aabbccdd11'" \
"LEMUR_ENCRYPTION_KEYS = ['lab-only-encryption-key']" \
"LEMUR_DEFAULT_COUNTRY = 'US'" \
> /app/lemur.conf.py

COPY lemur_jwt_mock.py /app/lemur_jwt_mock.py

EXPOSE 8000

HEALTHCHECK --interval=2s --timeout=2s --retries=10 --start-period=2s \
    CMD curl -fsS http://127.0.0.1:8000/api/1/health || exit 1

CMD ["python3", "/app/lemur_jwt_mock.py"]
