# ─── Stage 1: Build ─────────────────────────────────────────────────────────
FROM node:22-alpine AS builder

WORKDIR /app

COPY package.json package-lock.json ./
# --legacy-peer-deps: jspdf-autotable@3.8.4 declares a peer dep on jspdf@^2,
# but the project pins jspdf@^4.2.1 directly and already runs against it
# locally (jspdf-autotable's v3 API still works against jsPDF v4 in
# practice). Without this flag, npm ci hard-fails on the peer conflict.
RUN npm ci --ignore-scripts --legacy-peer-deps

COPY . .

# Vite injects env values during build time. Jenkins can override any of these
# with docker build --build-arg VITE_...=...
ARG VITE_AUTH_APP_URL=/auth
ARG VITE_EFFICIENCY_APP_URL=/efficiency
ARG VITE_OH_APP_URL=/optimumoh
ARG VITE_PFI_APP_URL=/pfi/api/v1
ARG VITE_API_V1_LIVE=/pfi/api/v1
ARG VITE_LCCA_APP_URL=/lcca
ARG VITE_RELIABILITY_APP_URL=/reliability
ARG VITE_RISK_MATRIX_APP_URL=/risk-matrix/api
ARG VITE_EQUIPMENT_IMAGE_URL=/pfi/uploads
ARG VITE_API_MONITORING_URL=/monitoring
ARG VITE_RBD_APP_URL=/rbd
ARG VITE_IRCFA_APP_URL=/ircfa
ARG VITE_AHM_APP_URL=/ahm/api/v1
ARG VITE_OPS_DOCK_APP_URL=/ops-dock/api/v1
ARG VITE_AUTH_URL=
ARG VITE_AUTH_SECRET=
ARG VITE_ENABLE_SECURE_EXPORT=false
ARG VITE_ALLOW_ACCESS_EFFICIENCY=true
ARG VITE_ALLOW_ACCESS_PFI=true
ARG VITE_ALLOW_ACCESS_RELIABILITY=true
ARG VITE_ALLOW_ACCESS_RISK_MATRIX=true
ARG VITE_ALLOW_ACCESS_LCCA=true
ARG VITE_ALLOW_ACCESS_RBD=true
ARG VITE_ALLOW_ACCESS_OH=true
ARG VITE_ALLOW_ACCESS_IRCFA=true
ARG VITE_ALLOW_ACCESS_AHM=true
ARG VITE_ENVIRONMENT=production

ENV VITE_AUTH_APP_URL=$VITE_AUTH_APP_URL \
    VITE_EFFICIENCY_APP_URL=$VITE_EFFICIENCY_APP_URL \
    VITE_OH_APP_URL=$VITE_OH_APP_URL \
    VITE_PFI_APP_URL=$VITE_PFI_APP_URL \
    VITE_API_V1_LIVE=$VITE_API_V1_LIVE \
    VITE_LCCA_APP_URL=$VITE_LCCA_APP_URL \
    VITE_RELIABILITY_APP_URL=$VITE_RELIABILITY_APP_URL \
    VITE_RISK_MATRIX_APP_URL=$VITE_RISK_MATRIX_APP_URL \
    VITE_EQUIPMENT_IMAGE_URL=$VITE_EQUIPMENT_IMAGE_URL \
    VITE_API_MONITORING_URL=$VITE_API_MONITORING_URL \
    VITE_RBD_APP_URL=$VITE_RBD_APP_URL \
    VITE_IRCFA_APP_URL=$VITE_IRCFA_APP_URL \
    VITE_AHM_APP_URL=$VITE_AHM_APP_URL \
    VITE_OPS_DOCK_APP_URL=$VITE_OPS_DOCK_APP_URL \
    VITE_AUTH_URL=$VITE_AUTH_URL \
    VITE_AUTH_SECRET=$VITE_AUTH_SECRET \
    VITE_ENABLE_SECURE_EXPORT=$VITE_ENABLE_SECURE_EXPORT \
    VITE_ALLOW_ACCESS_EFFICIENCY=$VITE_ALLOW_ACCESS_EFFICIENCY \
    VITE_ALLOW_ACCESS_PFI=$VITE_ALLOW_ACCESS_PFI \
    VITE_ALLOW_ACCESS_RELIABILITY=$VITE_ALLOW_ACCESS_RELIABILITY \
    VITE_ALLOW_ACCESS_RISK_MATRIX=$VITE_ALLOW_ACCESS_RISK_MATRIX \
    VITE_ALLOW_ACCESS_LCCA=$VITE_ALLOW_ACCESS_LCCA \
    VITE_ALLOW_ACCESS_RBD=$VITE_ALLOW_ACCESS_RBD \
    VITE_ALLOW_ACCESS_OH=$VITE_ALLOW_ACCESS_OH \
    VITE_ALLOW_ACCESS_IRCFA=$VITE_ALLOW_ACCESS_IRCFA \
    VITE_ALLOW_ACCESS_AHM=$VITE_ALLOW_ACCESS_AHM \
    VITE_ENVIRONMENT=$VITE_ENVIRONMENT

# Build the static Vite bundle. Keep this at vite build so deployment is not
# blocked by unrelated TypeScript debt during the migration.
RUN npx vite build

# ─── Stage 2: Serve ─────────────────────────────────────────────────────────
FROM nginx:stable-alpine AS runtime

RUN apk add --no-cache gettext

COPY nginx.conf /etc/nginx/templates/default.conf.template
COPY --from=builder /app/dist /usr/share/nginx/html

# Runtime (not build-time) — where nginx proxies each API prefix to. These
# are read by envsubst at container start, so they can be overridden per
# deployment (e.g. via docker-compose environment:) without rebuilding the
# image. BACKEND_URL_IRCFA is separate because IRCFA lives on a different
# host than the rest of the backend routes.
ENV BACKEND_URL=http://192.168.1.82:8000
ENV BACKEND_URL_IRCFA=http://192.168.1.119:8000

EXPOSE 80

CMD ["sh", "-c", \
    "envsubst '${BACKEND_URL} ${BACKEND_URL_IRCFA}' < /etc/nginx/templates/default.conf.template \
     > /etc/nginx/conf.d/default.conf && nginx -g 'daemon off;'"]