# ============================================================
# CVE-2026-24136 Lab Environment
# Saleor IDOR Vulnerability Demo
# Phiên bản dễ bị tấn công: 3.20.109
# ============================================================

services:

  # ── PostgreSQL ────────────────────────────────────────────
  db:
    image: postgres:15-alpine
    container_name: cve_saleor_db
    environment:
      POSTGRES_DB: saleor
      POSTGRES_USER: saleor
      POSTGRES_PASSWORD: saleor_lab_pass
    volumes:
      - saleor_db_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U saleor"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - saleor_lab

  # ── Redis ─────────────────────────────────────────────────
  redis:
    image: redis:7-alpine
    container_name: cve_saleor_redis
    networks:
      - saleor_lab

  # ── Saleor API (phiên bản dễ bị tấn công) ─────────────────
  # Dùng tag 3.20 (3.20.0–3.20.109 là vulnerable range theo CVE-2026-24136)
  # Nếu muốn pin đúng version: ghcr.io/saleor/saleor:3.20.109
  saleor_api:
    image: ghcr.io/saleor/saleor:3.20
    container_name: cve_saleor_api
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_started
    environment:
      DATABASE_URL: postgres://saleor:saleor_lab_pass@db:5432/saleor
      CELERY_BROKER_URL: redis://redis:6379/0
      REDIS_URL: redis://redis:6379/0
      SECRET_KEY: "lab-secret-key-do-not-use-in-production"
      ALLOWED_HOSTS: "localhost,127.0.0.1,saleor_api"
      ALLOWED_CLIENT_HOSTS: "localhost,127.0.0.1"
      DEFAULT_FROM_EMAIL: "lab@example.com"
      EMAIL_URL: "console://"
      DEBUG: "True"
      ENABLE_DJANGO_SILK: "False"
    ports:
      - "8000:8000"
    # start_api.sh patches wsgi/__init__.py warmup bug (bytes vs BytesIO, Django 4+)
    # then starts gunicorn
    volumes:
      - ./scripts/start_api.sh:/start_api.sh:ro
    command: sh /start_api.sh
    networks:
      - saleor_lab
    healthcheck:
      # Dùng python thay vì curl vì curl có thể không có trong image
      test: ["CMD-SHELL", "python -c \"import urllib.request; urllib.request.urlopen('http://localhost:8000/health/')\" 2>/dev/null || exit 1"]
      interval: 15s
      timeout: 10s
      retries: 10
      start_period: 60s

  # ── Saleor Dashboard (tuỳ chọn, để xem GUI) ──────────────
  dashboard:
    image: ghcr.io/saleor/saleor-dashboard:3.20
    container_name: cve_saleor_dashboard
    ports:
      - "9000:80"
    environment:
      API_URL: "http://localhost:8000/graphql/"
    networks:
      - saleor_lab

volumes:
  saleor_db_data:

networks:
  saleor_lab:
    driver: bridge