# syntax=docker/dockerfile:1
# Build context is the repo ROOT (so the bun workspace resolves).

# ---- Build: produce the static SPA. The app calls its OWN origin (/auth, /api),
#      which the Bun server reverse-proxies to the backend, so no backend URL is baked. ----
FROM oven/bun:1.3.14 AS build
WORKDIR /repo

COPY package.json bun.lock turbo.json ./
COPY packages/typescript-config/package.json ./packages/typescript-config/
COPY packages/eslint-config/package.json ./packages/eslint-config/
COPY apps/backend/package.json ./apps/backend/
COPY apps/frontend/package.json ./apps/frontend/
COPY apps/cli/package.json ./apps/cli/
RUN bun install --frozen-lockfile

COPY . .
# vite build runs in "production" mode and loads apps/frontend/.env.production.
RUN cd apps/frontend && bun run build

# ---- Runtime: Bun serving the static build on $PORT and proxying backend routes ----
FROM oven/bun:1.3.14-slim AS runtime
WORKDIR /app
ENV PORT=8080
# BACKEND_URL is set at deploy time by cloudbuild.yaml from the value in
# apps/frontend/.env.production. Do not bake a default here.
COPY apps/frontend/server.ts ./server.ts
COPY --from=build /repo/apps/frontend/dist ./dist
EXPOSE 8080
USER bun
CMD ["bun", "server.ts"]