# Use Node 24 for all lambdas
FROM public.ecr.aws/lambda/nodejs:24 AS builder

# Install base tooling once for the build stage.
RUN dnf -y install shadow-utils && \
    dnf clean all && \
    rm -rf /var/cache/yum

# Enable Corepack to get access to pnpm.
RUN corepack enable

# Create a non-root user that owns /var/task to match the runtime.
RUN /usr/sbin/useradd -c "lambda user" -m -d /home/lambdauser -s /bin/bash lambdauser && \
    chown -R lambdauser:lambdauser /var/task

USER lambdauser
WORKDIR /app
RUN chown lambdauser:lambdauser /app

# Copy root files to establish workspace context
COPY --chown=lambdauser:lambdauser package.json pnpm-lock.yaml pnpm-workspace.yaml .npmrc ./

# Define build arguments for the specific package
ARG LAMBDA_NAME

# Check if arguments are provided
RUN if [ -z "$LAMBDA_NAME" ]; then echo "Build argument LAMBDA_NAME is required" && exit 1; fi

# Copy the specific package to build
COPY --chown=lambdauser:lambdauser lambda/${LAMBDA_NAME}/package.json ./lambda/${LAMBDA_NAME}/package.json

# Use a build secret for the GitHub token so registry access stays private.
RUN --mount=type=secret,id=GITHUB_NPM_TOKEN,required=true,uid=1000 \
    GITHUB_NPM_TOKEN="$(cat /run/secrets/GITHUB_NPM_TOKEN)" \
    pnpm install --frozen-lockfile --filter=${LAMBDA_NAME}... \
    && rm -f .npmrc

# Copy source code for the specific package
COPY --chown=lambdauser:lambdauser lambda/${LAMBDA_NAME} ./lambda/${LAMBDA_NAME}
COPY --chown=lambdauser:lambdauser tsconfig.json ./

# Build the specific package
RUN pnpm --filter=${LAMBDA_NAME} build \
    && pnpm --filter=${LAMBDA_NAME} --prod deploy /app/deploy

# Final stage
FROM public.ecr.aws/lambda/nodejs:24

# Remove package managers and their bundled dependencies from the production image.
# npm (with vulnerable transitive deps like minimatch, tar) and corepack live
# under /var/lang/ in the AWS Lambda Node.js base image.
# Some npm bundled files have read-only permissions, so chmod before removing.
RUN chmod -R u+w /var/lang/lib/node_modules/npm /var/lang/lib/node_modules/corepack 2>/dev/null; \
    rm -rf /var/lang/lib/node_modules/npm \
           /var/lang/lib/node_modules/corepack \
           /var/lang/bin/npm /var/lang/bin/npx /var/lang/bin/corepack \
           /var/lang/bin/pnpm /var/lang/bin/yarn

# Mirror the user setup from the builder for consistent permissions.
RUN dnf -y install shadow-utils && \
    dnf clean all && \
    rm -rf /var/cache/yum && \
    /usr/sbin/useradd -c "lambda user" -m -d /home/lambdauser -s /bin/bash lambdauser && \
    chown -R lambdauser:lambdauser /var/task

USER lambdauser
WORKDIR /var/task

# Copy the built application from the deploy directory
COPY --from=builder --chown=lambdauser:lambdauser /app/deploy ./

# Datadog configuration
COPY --from=public.ecr.aws/datadog/lambda-extension:92 /opt/extensions/ /opt/extensions
ENV DD_LAMBDA_HANDLER=dist/app.handler

# Versioning
ARG DD_VERSION
ENV DD_VERSION=${DD_VERSION:-1}

# Needed for ESM support in the Datadog Lambda Library
RUN rm -f node_modules/datadog-lambda-js/dist/handler.js || true

CMD [ "node_modules/datadog-lambda-js/dist/handler.handler" ]