# syntax=docker/dockerfile:1
ARG         AWS_ACCOUNT=086679231553
ARG         PARENT_IMAGE_TAG=node24
ARG         BASE=${AWS_ACCOUNT}.dkr.ecr.us-east-1.amazonaws.com/docker-parent-images:${PARENT_IMAGE_TAG}
ARG         DDTRACE_ADDONS="@datadog/native-appsec @datadog/native-iast-taint-tracking @datadog/native-metrics @datadog/pprof"


##### deps #####
# Workspace manifests + all dependencies for platform + library packages.
# Split from dev-deps so the expensive install layer is only busted by
# package.json / lockfile changes.
################
FROM        ${BASE} AS deps
WORKDIR     /var/app
ENV         CI=true
COPY        .npmrc package.json pnpm-lock.yaml pnpm-workspace.yaml ./
COPY        --parents apps/platform/package.json packages/api-common/package.json packages/admin-api/package.json packages/async/package.json packages/common/package.json packages/data-structures/package.json packages/db/package.json ./
USER        root
RUN         corepack enable \
 && corepack prepare --activate \
 && chown -R node:node /var/app \
 && mkdir -p /home/node/.local/share/pnpm \
 && chown -R node:node /home/node/.local
USER        node
RUN         --mount=type=secret,id=GITHUB_NPM_TOKEN,required=true,uid=1000 \
            --mount=type=cache,target=/home/node/.local/share/pnpm/store,uid=1000 \
            GITHUB_NPM_TOKEN=$(cat /run/secrets/GITHUB_NPM_TOKEN) \
            pnpm install --frozen-lockfile --ignore-scripts
# Compile dd-trace native addons that --ignore-scripts skipped.
ARG         DDTRACE_ADDONS
RUN         pnpm rebuild ${DDTRACE_ADDONS}


##### dev-deps #####
# Full source for platform + library packages, with libraries built.
####################
FROM        deps AS dev-deps
# Root configs
COPY        --chown=node:node tsconfig.base.json tsconfig.lib.json tsconfig.app-base.json eslint.base.mjs ./
# api-common package (shared RPC utilities)
COPY        --chown=node:node packages/api-common/ ./packages/api-common/
# @coda/async (standalone — zero deps)
COPY        --chown=node:node packages/async/ ./packages/async/
# @coda/data-structures (standalone — zero deps)
COPY        --chown=node:node packages/data-structures/ ./packages/data-structures/
# Common source + configs (depends on data-structures)
COPY        --chown=node:node packages/common/tsconfig.json packages/common/tsconfig.test.json packages/common/tsdown.config.ts packages/common/eslint.config.mjs ./packages/common/
COPY        --chown=node:node packages/common/src ./packages/common/src
# DB package source + Prisma schema
COPY        --chown=node:node packages/db/tsconfig.json packages/db/tsconfig.test.json packages/db/tsdown.config.ts packages/db/prisma.config.ts packages/db/eslint.config.mjs ./packages/db/
COPY        --chown=node:node packages/db/src ./packages/db/src
COPY        --chown=node:node packages/db/prisma ./packages/db/prisma
# admin-api package (proto-generated ConnectRPC types)
COPY        --chown=node:node packages/admin-api/ ./packages/admin-api/
# Platform source + configs
COPY        --chown=node:node apps/platform/ ./apps/platform/
# Generate Prisma client + build all library packages.
RUN         pnpm --filter @coda/db db:generate
RUN         pnpm --filter @coda/async \
                 --filter @coda/data-structures \
                 --filter @coda/api-common \
                 --filter @coda/common \
                 --filter @coda/db \
                 --filter @coda/admin-api \
                 build


##### dev #####
# Hot-reloading dev server (used by docker-compose --profile dev).
###############
FROM        dev-deps AS dev
ENV         PORT=8082
EXPOSE      8082
RUN         touch apps/platform/.env
CMD         ["pnpm", "--filter", "@coda/platform-service", "dev"]


##### build-artifacts #####
# Compile TypeScript to ESM JavaScript via tsdown.
###########################
FROM        dev-deps AS build-artifacts
RUN         pnpm --filter @coda/platform-service build


##### pnpm-deploy-platform #####
# Standalone production deployment with flat node_modules.
################################
FROM        build-artifacts AS pnpm-deploy-platform
USER        root
RUN         mkdir -p /deploy && chown node:node /deploy
USER        node
RUN         pnpm deploy --filter @coda/platform-service --prod /deploy/platform
# Rebuild native addons in the flat deploy output.
ARG         DDTRACE_ADDONS
RUN         cd /deploy/platform && npm rebuild ${DDTRACE_ADDONS}


##### deploy-platform #####
# Lean production image — compiled JS only, no source or dev tools.
############################
FROM        ${BASE} AS deploy-platform
WORKDIR     /var/app
USER        node
COPY        --chown=node:node --from=pnpm-deploy-platform /deploy/platform ./
ENV         NODE_ENV=production PORT=8082
EXPOSE      8082
LABEL       org.opencontainers.image.source="https://github.com/theorchard/ows-coda"
HEALTHCHECK --interval=10s --timeout=5s --retries=5 --start-period=15s \
  CMD node -e "require('http').get('http://localhost:8082/health',r=>process.exit(r.statusCode===200?0:1)).on('error',()=>process.exit(1))"
CMD         ["node", "--import", "dd-trace/initialize.mjs", "dist/index.mjs"]