services:
  dynamodb:
    image: amazon/dynamodb-local:latest
    container_name: ows-product-dynamodb
    command: -jar DynamoDBLocal.jar -sharedDb -inMemory
    ports:
      - "8000:8000"

  dynamodb-init:
    image: amazon/aws-cli:latest
    container_name: ows-product-dynamodb-init
    depends_on:
      - dynamodb
    environment:
      - AWS_ACCESS_KEY_ID=local
      - AWS_SECRET_ACCESS_KEY=local
      - AWS_DEFAULT_REGION=us-east-1
    entrypoint: ["/bin/sh", "-c"]
    command:
      - |
        set -e
        until aws dynamodb list-tables --endpoint-url http://dynamodb:8000 >/dev/null 2>&1; do
          echo "Waiting for DynamoDB Local..."
          sleep 1
        done
        aws dynamodb create-table \
          --endpoint-url http://dynamodb:8000 \
          --table-name dev-product_localization \
          --attribute-definitions \
            AttributeName=product_id,AttributeType=S \
            AttributeName=language_id,AttributeType=S \
          --key-schema \
            AttributeName=product_id,KeyType=HASH \
            AttributeName=language_id,KeyType=RANGE \
          --billing-mode PAY_PER_REQUEST \
          2>/dev/null || echo "Table dev-product_localization already exists, skipping."
        echo "DynamoDB Local ready."

  product-dev:
    build:
      context: .
      target: dev
    container_name: ows-product-app
    depends_on:
      dynamodb-init:
        condition: service_completed_successfully
    ports:
      - "5001:5000"
    volumes:
      - .:/var/app
    env_file:
      - path: .env
        required: false
    environment:
      - Environment=dev
      - DYNAMODB_HOST=http://dynamodb:8000
      - AWS_REGION=us-east-1
      - AWS_DEFAULT_REGION=us-east-1
      # Real AWS creds from the host (e.g. via awsume) — config.py fetches
      # MySQL creds from Secrets Manager at startup. DynamoDB Local ignores
      # credentials, so passing real ones is fine.
      - AWS_ACCESS_KEY_ID
      - AWS_SECRET_ACCESS_KEY
      - AWS_SESSION_TOKEN
      - DD_TRACE_ENABLED=0
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:5000/hello/"]
      interval: 5s
      timeout: 5s
      retries: 20
      start_period: 20s

  integration-test:
    build:
      context: .
      target: integration-test
    depends_on:
      product-dev:
        condition: service_healthy
    volumes:
      - .:/var/app
    env_file:
      - path: .env
        required: false
    environment:
      # Tests hit the local dockerized app instead of QA.
      - DEV_OWS_PRODUCT_URL=http://product-dev:5000
      - AWS_REGION=us-east-1
      - AWS_DEFAULT_REGION=us-east-1
      # Real AWS creds (from your shell, e.g. via awsume) are still needed
      # because the test conftest fetches JWT credentials from Secrets Manager.
      - AWS_ACCESS_KEY_ID
      - AWS_SECRET_ACCESS_KEY
      - AWS_SESSION_TOKEN
      - BASE_QA_OA_URL
      - BASE_QA_URL
      - BASE_QA_GRASS_URL
      - QA_DB_HOST
      - QA_DB_USER
      - QA_DB_PASS
      - QA_DB_DATABASE
      - QA_GRASS_HOST