FROM    public.ecr.aws/lambda/nodejs:24 AS base

WORKDIR /var/task
COPY    scripts/setup.sh .npmrc.shadow package.json yarn.lock tsconfig.json tsconfig.build.json ./

RUN     --mount=type=secret,id=tokens,uid=1000,required npm install -g yarn@latest \
        && yarn global add node-gyp \
        && chmod +x ./setup.sh \
        && ./setup.sh true

FROM    base AS build
COPY    src ./src
RUN     --mount=type=secret,id=tokens,uid=1000,required chmod +x ./setup.sh \
        && ./setup.sh false \
        && yarn build \
        && yarn global remove node-gyp


FROM    public.ecr.aws/lambda/nodejs:24 AS runner

WORKDIR /var/task
# Add Datadog Lambda extension
COPY    --from=public.ecr.aws/datadog/lambda-extension:69 /opt/extensions/ /opt/extensions

# Add Sentry Lambda extension
COPY    --from=public.ecr.aws/sentry/sentry-node-serverless-sdk:28 /opt/ /opt

RUN     dnf -y install shadow-utils \
        && /usr/sbin/useradd -c 'lambda user' -m -d /home/lambdauser -s /bin/bash lambdauser \
        && chown -R lambdauser:lambdauser /var/task \
        && dnf -y remove shadow-utils \
        && dnf clean all

# Copy production dependencies
COPY    --from=base --chown=lambdauser:lambdauser /var/task/node_modules ./node_modules
# Copy build
COPY    --from=build --chown=lambdauser:lambdauser /var/task/build ./

ENV     DD_LAMBDA_HANDLER=app.handler
RUN     rm node_modules/datadog-lambda-js/dist/handler.js

USER    lambdauser
CMD     [ "node_modules/datadog-lambda-js/dist/handler.handler" ]