# Stage 1: Build the Rust FFI dynamic library
FROM rust:1-slim AS rust-builder
WORKDIR /usr/src/app

# Install protobuf compiler for tonic-build
RUN apt-get update && apt-get install -y protobuf-compiler

COPY spire_ffi ./spire_ffi
WORKDIR /usr/src/app/spire_ffi
RUN cargo build --release

# Stage 2: Cache Deno dependencies
FROM denoland/deno:debian-2.9.4 AS deno-builder
WORKDIR /app
ENV DENO_DIR=/deno-dir

# Layer cache: Pre-download dependencies (only invalidates if deps change)
COPY deno.json deno.lock* deps.ts ./
COPY server/deno.json ./server/
COPY sdk/deno.json ./sdk/
COPY ui/deno.json ./ui/
RUN deno cache deps.ts

# Source code layer
COPY . .
RUN deno cache server/main.ts

# Stage 3: Runner
FROM denoland/deno:debian-2.9.4

USER deno
WORKDIR /app

COPY --from=deno-builder --chown=deno:deno /deno-dir/ /deno-dir/
ENV DENO_DIR=/deno-dir

# Copy the Rust library
COPY --from=rust-builder --chown=deno:deno /usr/src/app/spire_ffi/target/release/libspire_ffi.so /app/libspire_ffi.so

COPY --from=deno-builder --chown=deno:deno /app ./

EXPOSE 8000

# Added --allow-ffi for Deno.dlopen and --allow-read for dlopen path resolution
CMD ["run", "--allow-net", "--allow-env", "--allow-ffi=./libspire_ffi.so", "--allow-read=.,/var/run/spire/agent.sock", "--unstable-ffi", "server/main.ts"]