# Multi-stage build for Security Center Frontend
FROM public.ecr.aws/docker/library/node:18-alpine AS deps

# Install dependencies only when needed
WORKDIR /app

# Copy package files
COPY package.json package-lock.json* ./

# Install dependencies
RUN npm ci

# Builder stage
FROM public.ecr.aws/docker/library/node:18-alpine AS builder

WORKDIR /app

ARG API_PROXY_TARGET=http://localhost:8080
ARG NEXT_PUBLIC_SSO_PROVIDER=auth0

# Copy dependencies from deps stage
COPY --from=deps /app/node_modules ./node_modules

# Copy source code
COPY . .

# Some deployments do not include a Next.js `public/` directory.
# Ensure it exists so the runtime stage COPY doesn't fail.
RUN mkdir -p public
RUN touch .env.local.example

# Set environment variables for build
ENV NEXT_TELEMETRY_DISABLED=1
ENV NODE_ENV=production
ENV API_PROXY_TARGET=${API_PROXY_TARGET}
ENV NEXT_PUBLIC_SSO_PROVIDER=${NEXT_PUBLIC_SSO_PROVIDER}

# Build the application
RUN npm run build

# Production stage
FROM public.ecr.aws/docker/library/node:18-alpine AS runner

WORKDIR /app

ENV NODE_ENV=production
ENV NEXT_TELEMETRY_DISABLED=1

# Create non-root user
RUN addgroup --system --gid 1001 nodejs && \
    adduser --system --uid 1001 nextjs

# Copy necessary files from builder
COPY --from=builder /app/public ./public
COPY --from=builder /app/.next-build/standalone ./
COPY --from=builder /app/.next-build/static ./.next-build/static

# Copy environment template
COPY --from=builder /app/.env.local.example ./.env.local

# Change ownership
RUN chown -R nextjs:nodejs /app

# Switch to non-root user
USER nextjs

# Expose port
EXPOSE 3000

ENV PORT=3000
ENV HOSTNAME=0.0.0.0

# Health check
HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
  CMD node -e "require('http').get('http://localhost:3000/api/health', (r) => {process.exit(r.statusCode === 200 ? 0 : 1)})" || exit 1

# Run the application
CMD ["node", "server.js"]