services:
  router:
    # Overridden per variant (router-internal / router-mcp) so `docker ps`
    # shows which router is up; also its DNS name on the compose network.
    container_name: router-public
    platform: linux/amd64
    build:
      context: .
      dockerfile: Dockerfile
      target: deploy
    ports:
      - "8080:8080"
    environment:
      - Environment=dev
      - APOLLO_KEY
      - APOLLO_GRAPH_REF=graphql-theorchard@qa-public
      - CONFIG_FILE=config-qa.yaml
      - RUST_BACKTRACE=1

  lint-test:
    platform: linux/amd64
    build:
      context: .
      dockerfile: Dockerfile
      target: test
    environment:
      - RUST_BACKTRACE=1

  # JWT auth enforcement tests against the deployed QA routers. Needs AWS
  # credentials (passed through from the environment) to mint a valid QA token
  # via Secrets Manager + Auth0; the forged-token cases run without them.
  integration-test:
    build:
      context: .
      dockerfile: Dockerfile
      target: integration-test
    environment:
      - AWS_ACCESS_KEY_ID
      - AWS_SECRET_ACCESS_KEY
      - AWS_SESSION_TOKEN
      - AWS_DEFAULT_REGION=us-east-1
      # Optional: supply expired tokens directly.
      - EXPIRED_JWT
      # Optional: test a local router instead of the QA matrix. From inside
      # the container use the router's container name
      # (http://router-<public|internal|mcp>:8080/graphql) or
      # host.docker.internal. Mode is block unless LOCAL_ROUTER_MODE=warn.
      - LOCAL_ROUTER_URL
      - LOCAL_ROUTER_MODE=warn