# 基础镜像（使用 Alpine，手动处理 OpenSSL 兼容性）
# 2026-08-12 通过 `docker buildx imagetools inspect node:18-alpine` 核验的
# Docker Hub 官方多架构清单 digest。生产默认值必须是不可变引用；本地测试
# 如需改镜像源，仍可显式传入 BASE_IMAGE，但发布脚本不得覆盖此默认值。
ARG BASE_IMAGE=node:18-alpine@sha256:8d6421d663b4c28fd3ebc498332f249011d118945588d0a35cb9bc4b8ca09d9e
ARG ALPINE_MIRROR=https://mirrors.tuna.tsinghua.edu.cn/alpine
# Local/CI builds remain possible without Git metadata. Production deployment
# supplies the exact SHA and rejects this sentinel before any container starts.
ARG VCS_REF=0000000000000000000000000000000000000000
FROM ${BASE_IMAGE} AS base

# 安装依赖阶段
FROM base AS deps
ARG ALPINE_MIRROR
RUN sed -i "s|https://dl-cdn.alpinelinux.org/alpine|${ALPINE_MIRROR}|g" /etc/apk/repositories && \
    apk add --no-cache libc6-compat python3 make g++ cairo-dev jpeg-dev pango-dev giflib-dev
WORKDIR /app

# package-lock.json 是生产构建的必需输入，缺失时 COPY 直接失败。
COPY package.json package-lock.json ./

# 安装依赖（使用淘宝镜像 + BuildKit缓存）
RUN --mount=type=cache,target=/root/.npm \
    manifest_sha="$(sha256sum package.json | awk '{print $1}')" && \
    lock_sha="$(sha256sum package-lock.json | awk '{print $1}')" && \
    echo "Installing dependencies (using cache if available)..." && \
    npm config set registry https://registry.npmmirror.com && \
    npm_config_build_from_source=canvas npm_config_nodedir=/usr/local npm ci --prefer-offline --no-audit --no-fund --legacy-peer-deps && \
    test "$manifest_sha" = "$(sha256sum package.json | awk '{print $1}')" && \
    test "$lock_sha" = "$(sha256sum package-lock.json | awk '{print $1}')" && \
    node -e "const sharp=require('sharp'); sharp(Buffer.alloc(4),{raw:{width:1,height:1,channels:4}}).png().toBuffer().then(()=>console.log('sharp dependency smoke passed')).catch((error)=>{console.error(error);process.exit(1)})" && \
    echo "Dependencies installed ($(du -sh /app/node_modules | cut -f1))"

# 本地开发阶段：复用依赖层，并补齐项目运行时会调用的媒体处理工具。
# 源码由 Compose 绑定挂载，避免每次修改代码都重新构建镜像。
FROM deps AS dev
ARG ALPINE_MIRROR
RUN apk add --no-cache ffmpeg openssl poppler-utils

ENV NODE_ENV=development
ENV NEXT_TELEMETRY_DISABLED=1
ENV HOSTNAME=0.0.0.0

EXPOSE 3000

CMD ["npm", "run", "dev", "--", "--hostname", "0.0.0.0"]

# 构建阶段
FROM base AS builder
ARG ALPINE_MIRROR
ARG VCS_REF
# 安装构建依赖
RUN sed -i "s|https://dl-cdn.alpinelinux.org/alpine|${ALPINE_MIRROR}|g" /etc/apk/repositories && \
    apk add --no-cache libc6-compat python3 make g++ cairo-dev jpeg-dev pango-dev giflib-dev ffmpeg openssl
WORKDIR /app
COPY --from=deps /app/node_modules ./node_modules
COPY . .

# The source revision is immutable image metadata, not a runtime environment
# assertion. Production builds must provide the exact 40-character Git SHA.
RUN if ! printf '%s\n' "$VCS_REF" | grep -Eq '^[0-9a-f]{40}$'; then \
      echo "VCS_REF must be the exact 40-character lowercase Git SHA" >&2; \
      exit 1; \
    fi && \
    printf '%s\n' "$VCS_REF" > /app/DEPLOYMENT_COMMIT && \
    chmod 0444 /app/DEPLOYMENT_COMMIT

# 品牌资源是页面和 favicon 的离线兜底；缺失或空文件时禁止继续构建。
RUN test -s "/app/public/brand/header-logo.png" && \
    test -s "/app/public/brand/login-logo.png" && \
    test -s "/app/public/brand/favicon.png" && \
    node -e "const sharp=require('sharp'); Promise.all(['header-logo.png','login-logo.png','favicon.png'].map((name)=>sharp('/app/public/brand/'+name,{failOn:'error',limitInputPixels:25000000,animated:false}).rotate().toBuffer())).then(()=>console.log('builder brand image decode smoke passed')).catch((error)=>{console.error(error);process.exit(1)})" && \
    test -f "/app/prisma/migrations/20251118000000_add_upload_id_to_materials/migration.sql" && \
    test -f "/app/prisma/migrations/20260811_add_video_transcode_lease/migration.sql" && \
    test -f "/app/prisma/migrations/20260811_update_brand_logo_defaults/migration.sql" && \
    test -f "/app/prisma/migrations/20260812_add_product_package_upload_job_lease/migration.sql" && \
    test -f "/app/prisma/migrations/20260812_align_material_upload_idempotency_index/migration.sql" && \
    test -f "/app/prisma/migrations/20260813_add_material_custody_department/migration.sql" && \
    test -f "/app/prisma/migrations/20260813_add_organization_units_and_employment_state/migration.sql" && \
    test -f "/app/prisma/migrations/20260813_add_user_employee_binding/migration.sql" && \
    test -f "/app/prisma/migrations/20260817_add_material_is_incomplete_shell/migration.sql" && \
    test -f "/app/prisma/migrations/20260819_add_user_permission_inherit/migration.sql" && \
    test -f "/app/prisma/migrations/20260820_add_permission_group_members/migration.sql" && \
    test -f "/app/prisma/migrations/20260820_unique_permission_group_department/migration.sql" && \
    test -f "/app/prisma/migrations/20260820_add_ding_workflow_snapshots/migration.sql"

# 这两个动态路由负责兜底访问本地上传文件；如果它们在构建上下文里丢失，
# 线上音频/视频就会直接 404。这里提前失败，避免再把缺路由的镜像发出去。
RUN test -f "/app/app/api/uploads/[...path]/route.ts" && \
    test -f "/app/app/uploads/[...path]/route.ts"

# 设置环境变量
ENV NEXT_TELEMETRY_DISABLED=1

# 构建时使用假的环境变量（只用于构建，运行时会被容器的真实环境变量覆盖）
# 这样 Prisma 和其他模块在构建时不会报错
ENV DATABASE_URL="postgresql://build:build@localhost:5432/build"
ENV NEXTAUTH_SECRET="build-time-secret"
ENV NEXTAUTH_URL="http://localhost:3000"
ENV ADMIN_API_KEY="build-time-key"
ENV DINGTALK_CLIENT_ID="build-time-dingtalk-id"
ENV DINGTALK_CLIENT_SECRET="build-time-dingtalk-secret"

# 构建应用（复用 Next.js 构建缓存）
RUN --mount=type=cache,target=/app/.next/cache \
    NODE_ENV=production npm run build

# 清理 standalone 目录中不需要的文件（减少 1GB+ 体积）
RUN echo "清理 standalone 目录..." && \
    rm -rf .next/standalone/uploads && \
    rm -rf .next/standalone/.build-cache && \
    rm -rf .next/standalone/.docker-cache && \
    rm -rf .next/standalone/.git && \
    rm -rf .next/standalone/__tests__ && \
    rm -rf .next/standalone/docs && \
    rm -rf .next/standalone/backups && \
    rm -rf .next/standalone/.kiro && \
    rm -rf .next/standalone/scripts && \
    echo "清理完成"

# Explicit, one-shot database migrator. It is never used by the application
# container or the normal deploy entry. The operator must supply production DB
# identity, exact source SHA and a hashed backup receipt before --apply works.
FROM base AS migrator
ARG ALPINE_MIRROR
ARG VCS_REF
WORKDIR /app
LABEL org.opencontainers.image.revision=$VCS_REF
ENV NODE_ENV=production
RUN sed -i "s|https://dl-cdn.alpinelinux.org/alpine|${ALPINE_MIRROR}|g" /etc/apk/repositories && \
    apk add --no-cache openssl postgresql-client && \
    command -v openssl >/dev/null && \
    command -v pg_dump >/dev/null && \
    command -v pg_restore >/dev/null && \
    command -v psql >/dev/null
COPY --from=builder /app/node_modules ./node_modules
COPY --from=builder /app/prisma ./prisma
COPY --from=builder /app/scripts/safe-production-migrate.mjs ./scripts/safe-production-migrate.mjs
COPY --from=builder /app/scripts/create-verified-production-backup.mjs ./scripts/create-verified-production-backup.mjs
COPY --from=builder /app/DEPLOYMENT_COMMIT /app/DEPLOYMENT_COMMIT
RUN test "$(cat /app/DEPLOYMENT_COMMIT)" = "$VCS_REF" && \
    chmod -R a-w /app/prisma /app/scripts /app/DEPLOYMENT_COMMIT
USER node
ENTRYPOINT ["node", "scripts/safe-production-migrate.mjs"]

# 生产运行阶段
FROM base AS runner
ARG VCS_REF
WORKDIR /app

LABEL org.opencontainers.image.revision=$VCS_REF

ENV NODE_ENV=production
ENV NEXT_TELEMETRY_DISABLED=1

ARG ALPINE_MIRROR
RUN sed -i "s|https://dl-cdn.alpinelinux.org/alpine|${ALPINE_MIRROR}|g" /etc/apk/repositories && \
    apk add --no-cache ffmpeg python3 cairo jpeg pango giflib openssl poppler-utils flock && \
    command -v flock >/dev/null && \
    flock --exclusive --timeout 1 --conflict-exit-code 75 --no-fork \
      /tmp/material-upload-flock-probe.lock sh -c 'true' && \
    rm -f /tmp/material-upload-flock-probe.lock

RUN addgroup --system --gid 1001 nodejs && \
    adduser --system --uid 1001 nextjs

RUN mkdir -p /app/scripts

# 复制必要文件
COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
COPY --from=builder --chown=nextjs:nodejs /app/app ./app
COPY --from=builder --chown=root:root /app/public ./public
COPY --from=builder --chown=root:root /app/DEPLOYMENT_COMMIT /app/DEPLOYMENT_COMMIT

# 只复制运行时必需的 node_modules
COPY --from=builder --chown=nextjs:nodejs /app/node_modules/.prisma ./node_modules/.prisma
COPY --from=builder --chown=nextjs:nodejs /app/node_modules/ag-psd ./node_modules/ag-psd
COPY --from=builder --chown=nextjs:nodejs /app/node_modules/ioredis ./node_modules/ioredis
COPY --from=builder --chown=nextjs:nodejs /app/node_modules/@ioredis ./node_modules/@ioredis
COPY --from=builder --chown=nextjs:nodejs /app/node_modules/@aws-sdk ./node_modules/@aws-sdk
COPY --from=builder --chown=nextjs:nodejs /app/node_modules/@smithy ./node_modules/@smithy

# 复制运行时 schema，以及切流前只读校验所需的精确 migration；仍不复制 engine-cache。
COPY --from=builder --chown=nextjs:nodejs /app/prisma/schema.prisma ./prisma/schema.prisma
COPY --from=builder --chown=root:root /app/prisma/migrations/20251118000000_add_upload_id_to_materials ./prisma/migrations/20251118000000_add_upload_id_to_materials
COPY --from=builder --chown=root:root /app/prisma/migrations/20260811_add_video_transcode_lease ./prisma/migrations/20260811_add_video_transcode_lease
COPY --from=builder --chown=root:root /app/prisma/migrations/20260811_update_brand_logo_defaults ./prisma/migrations/20260811_update_brand_logo_defaults
COPY --from=builder --chown=root:root /app/prisma/migrations/20260812_add_product_package_upload_job_lease ./prisma/migrations/20260812_add_product_package_upload_job_lease
COPY --from=builder --chown=root:root /app/prisma/migrations/20260812_align_material_upload_idempotency_index ./prisma/migrations/20260812_align_material_upload_idempotency_index
COPY --from=builder --chown=root:root /app/prisma/migrations/20260813_add_material_custody_department ./prisma/migrations/20260813_add_material_custody_department
COPY --from=builder --chown=root:root /app/prisma/migrations/20260813_add_organization_units_and_employment_state ./prisma/migrations/20260813_add_organization_units_and_employment_state
COPY --from=builder --chown=root:root /app/prisma/migrations/20260813_add_user_employee_binding ./prisma/migrations/20260813_add_user_employee_binding
COPY --from=builder --chown=root:root /app/prisma/migrations/20260817_add_material_is_incomplete_shell ./prisma/migrations/20260817_add_material_is_incomplete_shell
COPY --from=builder --chown=root:root /app/prisma/migrations/20260819_add_user_permission_inherit ./prisma/migrations/20260819_add_user_permission_inherit
COPY --from=builder --chown=root:root /app/prisma/migrations/20260820_add_permission_group_members ./prisma/migrations/20260820_add_permission_group_members
COPY --from=builder --chown=root:root /app/prisma/migrations/20260820_unique_permission_group_department ./prisma/migrations/20260820_unique_permission_group_department
COPY --from=builder --chown=root:root /app/prisma/migrations/20260820_add_ding_workflow_snapshots ./prisma/migrations/20260820_add_ding_workflow_snapshots
COPY --from=builder --chown=nextjs:nodejs /app/lib ./lib
COPY --from=builder --chown=nextjs:nodejs /app/scripts/public-traffic-rollup-from-nginx.py ./scripts/public-traffic-rollup-from-nginx.py
COPY --from=builder --chown=nextjs:nodejs /app/scripts/collapse-performance-survey-template-versions.mjs ./scripts/collapse-performance-survey-template-versions.mjs

# 创建必要目录并收紧权限。
# 应用代码归 root 所有，运行账号只能写上传目录和 Next.js 运行时缓存；
# 即使上层文件路径校验再次出现缺陷，也不能覆盖 server.js 或业务源码。
RUN mkdir -p /app/public /app/uploads && \
    mkdir -p /app/scripts && \
    mkdir -p /app/.next/cache && \
    mkdir -p /app/uploads/temp && \
    mkdir -p /app/uploads/assembled && \
    mkdir -p /app/uploads/materials && \
    mkdir -p /app/uploads/cleanup && \
    chown -R root:root /app && \
    chmod -R a+rX /app/public /app/prisma/migrations /app/scripts && \
    chown -R nextjs:nodejs /app/.next/cache /app/uploads && \
    chmod 0750 /app/uploads /app/uploads/temp /app/uploads/assembled /app/uploads/materials /app/uploads/cleanup && \
    test "$(cat /app/DEPLOYMENT_COMMIT)" = "$VCS_REF" && \
    chmod 0444 /app/DEPLOYMENT_COMMIT && \
    test -s /app/public/brand/header-logo.png && \
    test -s /app/public/brand/login-logo.png && \
    test -s /app/public/brand/favicon.png && \
    node -e "const sharp=require('sharp'); Promise.all(['header-logo.png','login-logo.png','favicon.png'].map((name)=>sharp('/app/public/brand/'+name,{failOn:'error',limitInputPixels:25000000,animated:false}).rotate().toBuffer())).then(()=>console.log('runner brand image decode smoke passed')).catch((error)=>{console.error(error);process.exit(1)})"

USER nextjs

EXPOSE 3000

ENV PORT=3000
ENV HOSTNAME="0.0.0.0"

CMD ["node", "server.js"]