# Frontend image — multi-stage build
# Stage 1: build the Vite app with Node.js
# Stage 2: serve static files with nginx (which also proxies /api -> api:8000)

FROM node:22-alpine AS build

WORKDIR /app

# Dependencies first (layer caching)
# NPM_REGISTRY overridable; default points at npmmirror because
# registry.npmjs.org is unreachable from this network.
ARG NPM_REGISTRY=https://registry.npmmirror.com
COPY package.json package-lock.json ./
RUN npm config set registry ${NPM_REGISTRY} && npm ci

# Developer Mode panel on the login page (dev-only aid). Production builds
# MUST keep this "false" — identity comes from Casdoor tokens, and the
# backend rejects the X-User-* header path unless DEV_LOGIN_ENABLED=true.
ARG DEV_LOGIN_ENABLED=false
ENV VITE_ENABLE_DEV_LOGIN=${DEV_LOGIN_ENABLED}

# Observability (Phase 2) — baked into the bundle at build time.
# Empty values disable the feature (analytics.ts is a no-op then).
ARG VITE_OPENPANEL_URL=""
ARG VITE_OPENPANEL_CLIENT_ID=""
ARG VITE_SENTRY_DSN=""
ENV VITE_OPENPANEL_URL=${VITE_OPENPANEL_URL} \
    VITE_OPENPANEL_CLIENT_ID=${VITE_OPENPANEL_CLIENT_ID} \
    VITE_SENTRY_DSN=${VITE_SENTRY_DSN}

# Source code + build
COPY . .
RUN npm run build

# ---------- runtime ----------
FROM nginx:alpine

COPY --from=build /app/dist /usr/share/nginx/html
COPY nginx.conf /etc/nginx/conf.d/default.conf

EXPOSE 80

CMD ["nginx", "-g", "daemon off;"]