# Stage 1: Base image & dependencies installation
FROM php:8.5-fpm AS base

# Install essential system dependencies and PHP extensions
RUN apt-get update -y && apt-get install -y \
    unzip curl gnupg libpng-dev libjpeg-dev libfreetype6-dev libonig-dev \
    libzip-dev libicu-dev libxslt-dev \
    && docker-php-ext-configure gd --with-freetype --with-jpeg \
    && docker-php-ext-install -j$(nproc) gd xsl pdo_mysql zip intl bcmath soap \
    sockets mysqli exif ftp \
    && rm -rf /var/lib/apt/lists/*

# Install Composer
COPY --from=composer:2 /usr/bin/composer /usr/local/bin/composer

# Stage 2: Node.js installation
FROM node:24 AS node-stage

# Stage 3: Final image
FROM php:8.5-fpm AS php-final

# Install runtime dependencies with specific ImageMagick 6.9 version
RUN apt-get update -y && apt-get install -y \
    build-essential libffi-dev libssl-dev libpixman-1-dev libcairo2-dev libpango1.0-dev \
    libgdk-pixbuf-xlib-2.0-dev libjpeg-dev libgif-dev libzip-dev libxslt-dev \
    supervisor nginx sudo cron nano wget postfix rsync \
    pstoedit libpstoedit-dev libmagickcore-dev librsvg2-bin autopoint git intltool pdf2svg=0.2.4-1 \
    python3 python3-dev python3-pip python3-setuptools python3-pillow python3-path libheif-examples \
    poppler-utils ghostscript \
    autoconf automake libtool \
    && ln -sf python3 /usr/bin/python \
    && pip install rectpack --break-system-packages \
    && rm -rf /var/lib/apt/lists/*

# Install PHP OAuth extension from source.
# pecl.php.net's TLS is flaky from this host AND no oauth release declares PHP 8.5
# compatibility, so `pecl install oauth` fails ("No releases available"). Fetch the
# tarball with retries and build with phpize to bypass the PECL version gate.
RUN for i in 1 2 3 4 5; do \
        curl -fsSL --retry 5 --retry-all-errors -m 60 https://pecl.php.net/get/oauth-2.0.10.tgz -o /tmp/oauth.tgz && break; \
        echo "oauth download retry $i"; sleep 3; \
    done \
    && mkdir -p /usr/src/oauth && tar -xzf /tmp/oauth.tgz -C /usr/src/oauth --strip-components=1 \
    && cd /usr/src/oauth && phpize && ./configure && make -j"$(nproc)" && make install \
    && docker-php-ext-enable oauth \
    && rm -rf /tmp/oauth.tgz /usr/src/oauth

# ImageMagick: CLI binaries + PHP extension + Ghostscript (PDF delegate)
# Built from GitHub source because pecl.php.net is unreachable from this host.
RUN set -eux; \
apt-get update -y; \
apt-get install -y --no-install-recommends \
    libmagickwand-dev \
    imagemagick \
    ghostscript; \
curl -fsSL https://github.com/Imagick/imagick/archive/refs/tags/3.8.1.tar.gz -o /tmp/imagick.tar.gz; \
mkdir -p /usr/src/imagick; \
tar -xzf /tmp/imagick.tar.gz -C /usr/src/imagick --strip-components=1; \
cd /usr/src/imagick; \
phpize; \
./configure; \
make -j"$(nproc)"; \
make install; \
docker-php-ext-enable imagick; \
rm -rf /tmp/imagick.tar.gz /usr/src/imagick /var/lib/apt/lists/*

# Allow ImageMagick to read/write PDF, PS, EPS (blocked by Debian's default policy)
RUN set -eux; \
POLICY="$(ls /etc/ImageMagick-*/policy.xml 2>/dev/null | head -1)"; \
test -n "$POLICY"; \
sed -i -E '/domain="coder"/ { /(PDF|PS|EPS|XPS)/ s/rights="none"/rights="read|write"/ }' "$POLICY"; \
! grep -E 'rights="none"[^>]*(PDF|PS|EPS|XPS)' "$POLICY"

# Install Inkscape 1.4.3 via AppImage (apt version is outdated)
RUN wget -O /tmp/inkscape.AppImage "https://media.inkscape.org/dl/resources/file/Inkscape-0d15f75-x86_64.AppImage" \
    && chmod +x /tmp/inkscape.AppImage \
    && cd /tmp && /tmp/inkscape.AppImage --appimage-extract \
    && mv /tmp/squashfs-root /opt/inkscape \
    && ln -s /opt/inkscape/AppRun /usr/local/bin/inkscape \
    && rm /tmp/inkscape.AppImage

# Install autotrace (pinned to specific commit for supply chain safety)
RUN git clone https://github.com/autotrace/autotrace.git /tmp/autotrace \
    && cd /tmp/autotrace \
    && ./autogen.sh \
    && LD_LIBRARY_PATH=/usr/local/lib ./configure --prefix=/usr \
    && make && make install \
    && rm -rf /tmp/autotrace

# Configure sudoers for www-data — restrict to only required commands
RUN echo 'www-data ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoers

# Copy dependencies from base stage
COPY --from=base /usr/local/lib/php/extensions/ /usr/local/lib/php/extensions/
COPY --from=base /usr/local/etc/php/conf.d/ /usr/local/etc/php/conf.d/
COPY --from=base /usr/local/bin/composer /usr/local/bin/composer

# Copy Node.js from node-stage
COPY --from=node-stage /usr/local/include/node /usr/local/include/node
COPY --from=node-stage /usr/local/lib/node_modules /usr/local/lib/node_modules
COPY --from=node-stage /usr/local/bin/node /usr/local/bin/node
RUN ln -s /usr/local/lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm

# Set working directory
WORKDIR /var/www/html

# Set environment variable
ARG ENV=production
ENV ENV=${ENV}

# Copy configuration files and application code
COPY docker/conf/default.${ENV}.conf /etc/nginx/conf.d/default.conf
COPY docker/conf/nginx.conf /etc/nginx/nginx.conf
# Prestashop Domain
# COPY docker/conf/localhost.prestashop-docker.com.conf /etc/nginx/conf.d/localhost.prestashop-docker.com.conf
# Wordpress Domain
# COPY docker/conf/localhost.wordpress-docker.com.conf /etc/nginx/conf.d/localhost.wordpress-docker.com.conf
COPY docker/conf/supervisord.${ENV}.conf /etc/supervisor/supervisord.conf
COPY docker/conf/magento-crontab /etc/cron.d/magento-crontab
COPY docker/conf/main.cf /etc/postfix/main.cf
COPY docker/conf/php.ini /usr/local/etc/php/php.ini
COPY entrypoint.sh /usr/local/bin/entrypoint.sh
COPY composer.json composer.lock /var/www/
COPY node /var/www/node
COPY python /var/www/python
COPY app/code /var/www/app/code
COPY app/design /var/www/app/design
COPY patches /var/www/patches

# Set permissions and apply cron job
RUN chmod 0644 /etc/cron.d/magento-crontab \
    && chown -R www-data:www-data /var/www \
    && chmod -R 775 /var/www \
    && chmod +x /usr/local/bin/entrypoint.sh

# Expose port for Nginx and Node server only (9229 debug port removed)
EXPOSE 80 3000 9229

# Switch to www-data user for application execution
USER www-data

# Apply the cron job
RUN crontab /etc/cron.d/magento-crontab

# Set the entrypoint
ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]