# syntax=docker/dockerfile:1
#
# Image API Scheffin untuk Hugging Face Space.
#
# Space ini publik, jadi kode sumber TIDAK di-push ke sini. Saat build, kode
# di-clone dari repo GitHub privat memakai deploy key (baca-saja) dari secret
# Space GITHUB_DEPLOY_KEY. Commit yang dibangun tertulis di file REVISION, yang
# diisi workflow deploy-api.yml.

# ==========================================
# Tahap 1: clone dan build
# ==========================================
FROM node:24-bookworm-slim AS builder

RUN apt-get update \
 && apt-get install -y --no-install-recommends git openssh-client ca-certificates \
 && rm -rf /var/lib/apt/lists/*

# Kunci host resmi GitHub (api.github.com/meta). Dengan ini koneksi ke server
# palsu tetap ditolak, tanpa perlu StrictHostKeyChecking=no.
RUN mkdir -p /root/.ssh \
 && echo "github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl" > /root/.ssh/known_hosts

# Sebelum clone: setiap SHA baru memecah cache Docker, jadi clone di bawah
# tidak pernah memakai hasil lama.
COPY REVISION /tmp/REVISION

# Kunci disalin ke file sementara dengan newline di akhir, karena secret yang
# ditempel di Settings sering tanpa newline dan OpenSSH menolaknya ("invalid
# format"). File itu dihapus di RUN yang sama, jadi tidak pernah masuk layer.
RUN --mount=type=secret,id=GITHUB_DEPLOY_KEY,required=true \
    cp /run/secrets/GITHUB_DEPLOY_KEY /tmp/k \
 && echo >> /tmp/k \
 && chmod 600 /tmp/k \
 && GIT_SSH_COMMAND="ssh -i /tmp/k -o IdentitiesOnly=yes" \
    git clone --quiet git@github.com:rasyiq03/Scheffin-App.git /src \
 && rm -f /tmp/k \
 && git -C /src checkout --quiet "$(cat /tmp/REVISION)" \
 && rm -rf /src/.git

WORKDIR /src

# Lockfile hanya ada di root monorepo.
RUN npm ci -w apps/api \
 && npm exec -w apps/api -- prisma generate \
 && npm run build -w apps/api \
 && npm prune --omit=dev -w apps/api \
 && mkdir -p apps/api/node_modules

# ==========================================
# Tahap 2: runtime
# ==========================================
FROM node:24-bookworm-slim

# User "node" bawaan image ber-UID 1000, sesuai yang dipakai Spaces.
COPY --from=builder --chown=node:node /src/node_modules /app/node_modules
COPY --from=builder --chown=node:node /src/apps/api/dist /app/apps/api/dist
COPY --from=builder --chown=node:node /src/apps/api/node_modules /app/apps/api/node_modules
COPY --from=builder --chown=node:node /src/apps/api/package.json /app/apps/api/package.json
COPY --from=builder --chown=node:node /tmp/REVISION /app/REVISION

WORKDIR /app/apps/api
USER node

ENV NODE_ENV=production \
    PORT=7860
EXPOSE 7860

# Tanpa `prisma migrate deploy`: migrasi dijalankan manual lewat migrate.yml.
# GIT_SHA dibaca /api/v1/health supaya workflow rilis tahu versi mana yang live.
CMD ["sh", "-c", "GIT_SHA=$(cat /app/REVISION) exec node --no-warnings=MODULE_TYPELESS_PACKAGE_JSON dist/src/main"]