FROM node:24-bookworm AS build
WORKDIR /workspace

RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
    build-essential \
    clang \
    curl \
    file \
    libayatana-appindicator3-dev \
    libssl-dev \
    libwebkit2gtk-4.1-dev \
    libxdo-dev \
    lld \
    llvm \
    nsis \
    patchelf \
    pkg-config \
    librsvg2-dev \
    wget \
  && rm -rf /var/lib/apt/lists/*

RUN curl https://sh.rustup.rs -sSf | sh -s -- -y --profile minimal
ENV PATH="/root/.cargo/bin:$PATH"

RUN rustup target add x86_64-pc-windows-msvc \
  && cargo install --locked cargo-xwin

COPY package.json ./
RUN npm install

COPY . .

# Signed updater artifacts are produced by the release pipeline once its
# persistent signing key is available. This builder intentionally packages
# the desktop app itself without creating updater signatures.
RUN node -e "const fs=require('fs'); const p='src-tauri/tauri.conf.json'; const c=JSON.parse(fs.readFileSync(p,'utf8')); c.bundle.createUpdaterArtifacts=false; fs.writeFileSync(p, JSON.stringify(c,null,2)+'\\n')"

RUN npm run bundle:windows
RUN npm run bundle:deb

RUN set -eux; \
    mkdir -p /desktop-artifacts; \
    win="$(find src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis -maxdepth 1 -type f -name '*-setup.exe' -print -quit)"; \
    deb="$(find src-tauri/target/release/bundle/deb -maxdepth 1 -type f -name '*.deb' -print -quit)"; \
    test -n "$win"; \
    test -n "$deb"; \
    cp "$win" /desktop-artifacts/fieldlens-print-windows-x64-setup.exe; \
    cp "$deb" /desktop-artifacts/fieldlens-print-linux-x64.deb; \
    sha256sum /desktop-artifacts/* > /desktop-artifacts/SHA256SUMS

FROM nginx:1.27-alpine
COPY --from=build /desktop-artifacts /usr/share/nginx/html
EXPOSE 80