FROM heartexlabs/label-studio:latest

USER root

RUN pip install --no-cache-dir flask==3.0.3 requests==2.32.3 "huggingface_hub>=0.23"

# Re-enable legacy API token auth (disabled by default in LS 1.23+)
ENV LABEL_STUDIO_ENABLE_LEGACY_API_TOKEN=true

# Patch LS settings so the HF Space origin is trusted for Django CSRF.
# Path confirmed from build log: /label-studio/label_studio/core/settings/label_studio.py
RUN echo "CSRF_TRUSTED_ORIGINS=['https://trustllmeu-saga-annotation.hf.space','https://saga-research.com','https://www.saga-research.com']" \
    >> /label-studio/label_studio/core/settings/label_studio.py \
    && echo "[Dockerfile] Patched CSRF_TRUSTED_ORIGINS"

RUN mkdir -p /app/projects /data && chmod 777 /data

COPY ls_proxy_hf.py /app/ls_proxy_hf.py
COPY import_projects.py /app/import_projects.py
COPY ensure_admin.py /app/ensure_admin.py
COPY db_sync.py /app/db_sync.py
COPY start.sh /start.sh
RUN chmod +x /start.sh

# Task data only — no credentials
COPY projects/ /app/projects/

EXPOSE 7860

# Override the LS entrypoint so our start.sh runs first and can create
# the /label-studio/data -> /data/ls symlink before LS checks for it.
ENTRYPOINT ["/start.sh"]