# Copyright The Pit Project Owners. All rights reserved.
# SPDX-License-Identifier: Apache-2.0
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# Please see https://officer.openpit.dev and the OWNERS file for details.

# Build context is the officer module root.

# Before the first FROM so the FROM instructions themselves can expand it; a
# stage that uses the value in its own body redeclares it.
ARG GO_VERSION
ARG NODE_VERSION

# Stage 1: build the dashboard SPA. Its output is platform-independent, so a
# multi-platform build runs it once, natively, instead of under emulation.
FROM --platform=$BUILDPLATFORM node:${NODE_VERSION}-alpine AS frontend

WORKDIR /app/web

# Install dependencies in their own layer for caching, from the committed
# lockfile: npm ci fails when it disagrees with package.json instead of
# resolving a set nobody committed.
COPY web/package.json web/package-lock.json ./
RUN npm ci

COPY web/ ./
RUN npm run build

# Stage 2: build the pit-officer binary (cgo required by the openpit binding).
FROM golang:${GO_VERSION}-bookworm AS gobuild

ARG GO_VERSION
ENV GOTOOLCHAIN=go${GO_VERSION}

# Set only when packaging an official Officer version tag.
ARG OFFICER_RELEASE_TAG=""

RUN apt-get update && apt-get install -y --no-install-recommends \
    gcc \
    libc6-dev \
    && rm -rf /var/lib/apt/lists/*

# go.mod/go.sum first for a cacheable download layer.
COPY go.mod go.sum* /workspace/officer/

WORKDIR /workspace/officer

RUN go mod download

COPY . /workspace/officer/

COPY --from=frontend /app/web/dist /workspace/officer/web/dist

# Set to the full commit ID of the Officer checkout being built.
ARG OFFICER_COMMIT

# -ldflags "-s -w" strips debug symbols for a smaller binary.
RUN if [ -z "${OFFICER_COMMIT}" ]; then \
        echo 'OFFICER_COMMIT is required: use just docker-build, or docker build ... --build-arg OFFICER_COMMIT=$(git rev-parse HEAD)' >&2; \
        exit 1; \
    fi; \
    CGO_ENABLED=1 go build \
    -ldflags="-s -w -X go.openpit.dev/officer/framework/backend.releaseTag=${OFFICER_RELEASE_TAG} -X go.openpit.dev/officer/framework/backend.buildCommit=${OFFICER_COMMIT}" \
    -o /pit-officer \
    ./cmd/pit-officer

# Stage 3: runtime image.
FROM debian:bookworm-slim AS runtime

# Proves to the MCP Registry that this image belongs to the server in server.json.
LABEL io.modelcontextprotocol.server.name="io.github.openpitkit/officer"

# C runtime required by the openpit binding (libgcc / glibc).
RUN apt-get update && apt-get install -y --no-install-recommends \
    libgcc-s1 \
    ca-certificates \
    && rm -rf /var/lib/apt/lists/*

RUN useradd -r -s /sbin/nologin -u 1001 officer

# Own /data before dropping privileges, else SQLite cannot create the db file.
RUN mkdir -p /data && chown officer:officer /data

WORKDIR /app

COPY --from=gobuild /pit-officer /app/pit-officer

COPY --from=frontend /app/web/dist /app/web/dist

# The default 127.0.0.1 is unreachable across the container boundary; bind all
# interfaces and rely on Docker port-mapping. Front with a TLS reverse proxy.
ENV PIT_OFFICER_HTTP_ADDR=0.0.0.0:8787

VOLUME ["/data"]
ENV PIT_OFFICER_SQLITE_PATH=/data/pit-officer.db

# Headless container: never attempt to launch a browser on serve start.
ENV PIT_OFFICER_OPEN_BROWSER=false

# The OpenPit SDK extracts its embedded runtime on first load into the user
# cache directory, and the officer user has no home directory. A read-only root
# filesystem must keep /tmp writable and executable.
ENV OPENPIT_RUNTIME_CACHE_DIR=/tmp/openpit-runtime

EXPOSE 8787

# The binary's own /healthz probe; the image carries no curl or wget.
HEALTHCHECK --interval=15s --timeout=5s --start-period=10s --retries=3 \
    CMD ["/app/pit-officer", "healthcheck"]

USER officer

ENTRYPOINT ["/app/pit-officer"]
CMD ["serve"]