# Both stages use the exact image already running in staging, including its dependencies.
FROM svhd/logto@sha256:847cdd2759ad60f61b9733af0ea352183c805681dff5c9f8140a80f52d8e1340 AS frontend
WORKDIR /etc/logto
COPY provenance.json verify-source.mjs /opt/hiraccoon/
COPY build/logto-1.44.0-hiraccoon.tar.gz /opt/hiraccoon/source.tar.gz
RUN node /opt/hiraccoon/verify-source.mjs && \
    tar -xzf /opt/hiraccoon/source.tar.gz --strip-components=1 \
      logto-1.44.0-hiraccoon/packages/experience/src/shared/components/LogtoSignature/index.tsx \
      logto-1.44.0-hiraccoon/packages/account/src/components/PageFooter/index.tsx \
      logto-1.44.0-hiraccoon/packages/account/src/components/PageFooter/index.module.scss && \
    node /opt/hiraccoon/verify-source.mjs --patched
# The base contains the complete, already-installed frontend build toolchain.
# No dependency installation, backend build, tenant settings or build-time secrets.
ENV NODE_ENV=production CI=true
RUN npm --prefix packages/experience run check && npm --prefix packages/account run check
RUN npm --prefix packages/experience run build && npm --prefix packages/account run build
COPY build/logto-1.44.0-hiraccoon.tar.gz packages/experience/dist/assets/hiraccoon-source/
COPY notices.html packages/experience/dist/assets/hiraccoon-source/notices.html
RUN cp LICENSE packages/experience/dist/assets/hiraccoon-source/LICENSE.txt && \
    node --input-type=module -e 'import fs from "node:fs"; for (const name of ["experience", "account"]) { const p = `packages/${name}/dist/index.html`; const html = fs.readFileSync(p, "utf8"); fs.writeFileSync(p, html.replace("</head>", "<link rel=\"license\" href=\"/assets/hiraccoon-source/notices.html\">\n<!-- MPL-2.0 corresponding source: /assets/hiraccoon-source/notices.html -->\n</head>")); }'

FROM svhd/logto@sha256:847cdd2759ad60f61b9733af0ea352183c805681dff5c9f8140a80f52d8e1340
WORKDIR /etc/logto
# Clear stale bundles before copying so the old signature cannot survive in old assets.
RUN rm -rf packages/experience/dist packages/account/dist
COPY --from=frontend /etc/logto/packages/experience/dist/ packages/experience/dist/
COPY --from=frontend /etc/logto/packages/account/dist/ packages/account/dist/
# Entrypoint, backend, admin console, environment defaults and DB migrations stay upstream.
