# Original Saisit permissions/archive fork; upstream attribution retained.
# Built from the git tree (context: repo root). The whole build context, allowlisted by
# .dockerignore, is the AGPL corresponding source: it is tarred reproducibly, its SHA256 is
# computed here, and the image serves it as /saisit-source-<sha256>.tar.gz.
FROM docuseal/docuseal@sha256:e171808ce8dabb08491a49a6d8c477670a65ddce5e3de4764904b63a4487940f AS corresponding_source
USER root
ARG SOURCE_EPOCH=2026-10-01T00:00:00Z
RUN apk add --no-cache tar=1.35-r5 gzip=1.14-r3
COPY . /source
RUN tar --sort=name --mtime="$SOURCE_EPOCH" --owner=0 --group=0 --numeric-owner \
      --mode='u+rwX,go+rX,go-w' -C /source -cf - . | gzip -n -9 > /tmp/source.tar.gz && \
    sha256sum /tmp/source.tar.gz | cut -d ' ' -f 1 > /tmp/SOURCE_SHA256 && \
    grep -Eq '^[0-9a-f]{64}$' /tmp/SOURCE_SHA256

FROM docuseal/docuseal@sha256:e171808ce8dabb08491a49a6d8c477670a65ddce5e3de4764904b63a4487940f AS frontend_dependencies
USER root
WORKDIR /app
ENV RAILS_ENV=production NODE_ENV=production SECRET_KEY_BASE=build-assets-only-not-a-runtime-secret
RUN apk add --no-cache nodejs=24.18.1-r0 yarn=1.22.22-r1
COPY --from=corresponding_source /source/package.json /source/yarn.lock /app/
RUN yarn install --frozen-lockfile --non-interactive --network-timeout 120000

FROM frontend_dependencies AS frontend_assets
COPY --from=corresponding_source /source/ /app/
RUN rm -rf /app/public/packs /app/tmp/webpacker && bundle exec ./bin/shakapacker

FROM docuseal/docuseal@sha256:e171808ce8dabb08491a49a6d8c477670a65ddce5e3de4764904b63a4487940f
RUN rm -rf /app/public/packs
COPY --from=corresponding_source --chown=docuseal:docuseal /source/app /app/app
COPY --from=corresponding_source --chown=docuseal:docuseal /source/lib /app/lib
COPY --from=corresponding_source --chown=docuseal:docuseal /source/config /app/config
COPY --from=corresponding_source --chown=docuseal:docuseal /source/db/migrate /app/db/migrate
COPY --from=corresponding_source --chown=docuseal:docuseal /source/public /app/public
COPY --from=frontend_assets --chown=docuseal:docuseal /app/public/packs /app/public/packs
COPY --from=corresponding_source --chown=docuseal:docuseal /source/saisit/archive /app/saisit/archive
COPY --from=corresponding_source --chown=docuseal:docuseal /source/saisit/deploy/bootstrap.rb /app/saisit/deploy/bootstrap.rb
COPY --from=corresponding_source --chown=docuseal:docuseal /source/saisit/deploy/verify_image.rb /app/saisit/deploy/verify_image.rb
# lib/saisit/source_offer.rb reads /app/saisit/SOURCE_SHA256 to link the tarball from the UI.
COPY --from=corresponding_source --chown=docuseal:docuseal /tmp/SOURCE_SHA256 /app/saisit/SOURCE_SHA256
COPY --from=corresponding_source --chown=docuseal:docuseal /tmp/source.tar.gz /tmp/saisit-source.tar.gz
RUN mv /tmp/saisit-source.tar.gz "/app/public/saisit-source-$(cat /app/saisit/SOURCE_SHA256).tar.gz" && \
    mkdir -p /data/docuseal /data/archive && chown 2000:2000 /data/docuseal /data/archive && \
    chmod 0700 /data/docuseal /data/archive
LABEL org.opencontainers.image.revision=c6a7555f545ea8ea96207f198c2d8e42d16b091f
USER 2000:2000
