# b2g_usermgmt/Dockerfile
ARG BASE_IMAGE

# ---------------------------------------------------------------- dependency stage
# Composer deps are installed here, not shipped in a committed vendor/ folder. No
# vendor/ has ever existed in this repo, so the previous single-stage image built
# cleanly and then fatalled on `require vendor/autoload.php` at first request.
#
# Only the manifests are copied before `composer install`, so this slow, network-bound
# layer is keyed on composer.json/composer.lock and is not invalidated by an ordinary
# application edit.
FROM ${BASE_IMAGE} AS deps
COPY --from=public.ecr.aws/composer/composer:2-bin /composer /usr/bin/composer
WORKDIR /app
COPY composer.json composer.lock ./
# --no-scripts is mandatory, not hygiene. composer.json declares
#   post-install-cmd -> yii\composer\Installer::postInstall
#   extra.generateCookieValidationKey -> ["config/web.php"]
# so running scripts would rewrite config/web.php with a FRESH RANDOM cookie key on
# every build, invalidating every session on every deploy — and it contradicts the
# platform design, which injects cookie keys from Secrets Manager.
#
# --prefer-dist is safe: every package in composer.lock carries a dist URL, so this
# stage needs no git binary.
# --ignore-platform-req=php: modules/apium/controllers/UmController.php require_once's
# 2amigos/qrcode-library, which was never declared in composer.json - it only worked
# because the old images shipped a committed vendor/ that happened to contain it, and a
# clean --no-dev install 500'd every /apium/um/* route with "Failed opening required
# .../2amigos/qrcode-library/src/QrCode.php". Declaring it pulls bacon/bacon-qr-code
# 1.0.3, whose constraint is ^5.4|^7.0 and so excludes 8.2 - the same package filemst
# already carries. Scoped to php, never the blanket --ignore-platform-reqs, which would
# also hide a genuinely missing extension.
RUN composer install --no-dev --no-scripts --no-progress --no-interaction \
                     --optimize-autoloader --prefer-dist --ignore-platform-req=php \
 && composer clear-cache

# ---------------------------------------------------------------- runtime stage
FROM ${BASE_IMAGE}

# App code — same content that was bind-mounted at /app under Docker Compose.
COPY . /app
COPY --from=deps /app/vendor /app/vendor

# Yii needs runtime/ and the asset publish dirs to EXIST and be writable. Neither is
# tracked in git, so a plain `COPY . /app` produces an image without them and the app
# fatals on its first log write. Create them explicitly rather than chown-ing paths
# that may not be there.
RUN set -eux; \
    mkdir -p /app/runtime/logs /app/runtime/cache /app/web/assets; \
    if [ -d /app/api ]; then mkdir -p /app/api/assets; fi; \
    mkdir -p /app/api/web/generated/pledgecertificate/QRimage \
             /app/api/web/generated/pledgecertificate/pdfformat \
             /app/api/web/generated/pledgecertificate/image; \
    mkdir -p /app/api/uploads/invoices /app/api/uploads/receipts; \
    chown -R www-data:www-data /app/runtime /app/web/assets /app/api/web/generated /app/api/uploads; \
    if [ -d /app/api/assets ]; then chown -R www-data:www-data /app/api/assets; fi; \
    chmod -R 775 /app/runtime /app/web/assets /app/api/web/generated /app/api/uploads

# apium/um/take-pledge builds a pledge PDF + QR image under
# /app/api/web/generated/pledgecertificate/ before uploading them to filemst. Those dirs
# are not tracked in git and /app/api/web does not exist in the image, so the code's
# mkdir (non-recursive for QRimage, and blocked by the root-owned /app/api for the rest)
# failed and every take-pledge returned a 500. Create them www-data-writable here; the
# files themselves are scratch (uploaded to filemst immediately after).
#
# subm/subscription-management writes invoice and receipt PDFs to
# {srcDirectory}uploads/invoices|receipts/comp_<id>/ before registering them with
# filemst, and hit the identical trap: /app/api is root-owned, so the code's mkdir was
# refused, mPDF then failed to write, and download-invoice answered "Invoice PDF could
# not be generated". Local Docker masked it because ./b2g_usermgmt:/app is a Windows
# bind mount where everything is writable. Same treatment as the pledge dirs above.

EXPOSE 80 81 82 83 84