# syntax=docker/dockerfile:1.7

FROM rust:1.93-bookworm AS rust-builder
WORKDIR /workspace

COPY server-rs ./server-rs
COPY docs/openapi ./docs/openapi
COPY .codex/skills/genarrative-external-editor-api ./.codex/skills/genarrative-external-editor-api
COPY public ./public
RUN cargo build --release -p api-server --manifest-path server-rs/Cargo.toml && \
    cp server-rs/target/release/api-server /tmp/api-server

FROM debian:bookworm-slim AS api-runtime
WORKDIR /srv/genarrative

RUN apt-get update && \
    apt-get install -y --no-install-recommends ca-certificates curl && \
    rm -rf /var/lib/apt/lists/* && \
    useradd --system --create-home --home-dir /srv/genarrative --shell /usr/sbin/nologin genarrative

COPY --from=rust-builder /tmp/api-server /usr/local/bin/api-server

RUN mkdir -p /var/lib/genarrative/auth /var/lib/genarrative/tracking-outbox /var/lib/genarrative/wallet-refund-outbox && \
    chown -R genarrative:genarrative /srv/genarrative /var/lib/genarrative

ARG GENARRATIVE_PREVIEW_SECRETS_SHA256=
ARG GENARRATIVE_PREVIEW_ENV_LOCAL_SHA256=
RUN --mount=type=secret,id=genarrative_preview_secrets,required=false \
    --mount=type=secret,id=genarrative_preview_env_local,required=false \
    if [ -n "${GENARRATIVE_PREVIEW_SECRETS_SHA256}" ]; then \
      test -f /run/secrets/genarrative_preview_secrets; \
      test "$(sha256sum /run/secrets/genarrative_preview_secrets | cut -d ' ' -f 1)" = "${GENARRATIVE_PREVIEW_SECRETS_SHA256}"; \
      install -o genarrative -g genarrative -m 0400 \
        /run/secrets/genarrative_preview_secrets /srv/genarrative/.env.secrets.local; \
    fi; \
    if [ -n "${GENARRATIVE_PREVIEW_ENV_LOCAL_SHA256}" ]; then \
      test -f /run/secrets/genarrative_preview_env_local; \
      test "$(sha256sum /run/secrets/genarrative_preview_env_local | cut -d ' ' -f 1)" = "${GENARRATIVE_PREVIEW_ENV_LOCAL_SHA256}"; \
      install -o genarrative -g genarrative -m 0400 \
        /run/secrets/genarrative_preview_env_local /srv/genarrative/.env.local; \
    fi

USER genarrative
EXPOSE 8082

ENV GENARRATIVE_ENV=container \
    GENARRATIVE_API_HOST=0.0.0.0 \
    GENARRATIVE_API_PORT=8082 \
    GENARRATIVE_TRACKING_OUTBOX_DIR=/var/lib/genarrative/tracking-outbox

CMD ["api-server"]

FROM node:22-bookworm-slim AS web-builder
WORKDIR /workspace

ARG NPM_VERSION=10.9.7
RUN npm install --global "npm@${NPM_VERSION}" --no-audit --no-fund && \
    test "$(npm --version)" = "${NPM_VERSION}"

COPY package.json package-lock.json ./
COPY apps/admin-web/package.json ./apps/admin-web/package.json
COPY apps/ai-game-creator-shell/package.json ./apps/ai-game-creator-shell/package.json
COPY apps/desktop-shell/package.json ./apps/desktop-shell/package.json
COPY apps/mobile-shell/package.json ./apps/mobile-shell/package.json
COPY apps/preview-deployer-web/package.json ./apps/preview-deployer-web/package.json
COPY packages/image-canvas-core/package.json ./packages/image-canvas-core/package.json
COPY packages/image-canvas-react/package.json ./packages/image-canvas-react/package.json
COPY packages/shared/package.json ./packages/shared/package.json
COPY tools/spine-json-export-validator/package.json ./tools/spine-json-export-validator/package.json
RUN npm ci

COPY index.html metadata.json tsconfig.json vite.config.ts ./
COPY scripts/vite-cli.mjs scripts/admin-web-build.mjs ./scripts/
COPY src ./src
COPY public ./public
COPY media ./media
COPY packages ./packages
COPY apps/admin-web ./apps/admin-web
RUN npm run build:raw && npm run admin-web:build

FROM nginx:1.27-alpine AS nginx-runtime
COPY --from=web-builder /workspace/dist /srv/genarrative/web
COPY --from=web-builder /workspace/apps/admin-web/dist /srv/genarrative/web/admin
COPY deploy/container/nginx.conf /etc/nginx/nginx.conf