# b2g_subpayment/Dockerfile
ARG BASE_IMAGE

# ---------------------------------------------------------------- dependency stage
# Composer deps are installed here, not shipped in a committed vendor/ folder. No
# vendor/ has ever existed in this repo, so the previous single-stage image built
# cleanly and then fatalled on `require vendor/autoload.php` at first request.
#
# Only the manifests are copied before `composer install`, so this slow, network-bound
# layer is keyed on composer.json/composer.lock and is not invalidated by an ordinary
# application edit.
FROM ${BASE_IMAGE} AS deps
COPY --from=public.ecr.aws/composer/composer:2-bin /composer /usr/bin/composer
WORKDIR /app
COPY composer.json composer.lock ./
# --no-scripts is mandatory, not hygiene. composer.json declares
#   post-install-cmd -> yii\composer\Installer::postInstall
#   extra.generateCookieValidationKey -> ["config/web.php"]
# so running scripts would rewrite config/web.php with a FRESH RANDOM cookie key on
# every build, invalidating every session on every deploy — and it contradicts the
# platform design, which injects cookie keys from Secrets Manager.
#
# --prefer-dist is safe: every package in composer.lock carries a dist URL, so this
# stage needs no git binary.
RUN composer install --no-dev --no-scripts --no-progress --no-interaction \
                     --optimize-autoloader --prefer-dist \
 && composer clear-cache

# ---------------------------------------------------------------- runtime stage
FROM ${BASE_IMAGE}

# App code — same content that was bind-mounted at /app under Docker Compose.
COPY . /app
COPY --from=deps /app/vendor /app/vendor

# Yii needs runtime/ and the asset publish dirs to EXIST and be writable. Neither is
# tracked in git, so a plain `COPY . /app` produces an image without them and the app
# fatals on its first log write. Create them explicitly rather than chown-ing paths
# that may not be there.
RUN set -eux; \
    mkdir -p /app/runtime/logs /app/runtime/cache /app/web/assets; \
    if [ -d /app/api ]; then mkdir -p /app/api/assets; fi; \
    chown -R www-data:www-data /app/runtime /app/web/assets; \
    if [ -d /app/api/assets ]; then chown -R www-data:www-data /app/api/assets; fi; \
    chmod -R 775 /app/runtime /app/web/assets

EXPOSE 80 81 82 83 84