#!/bin/sh
# Installs the workspace's dependencies inside the image.
#
# Split out of the Dockerfile so a failure prints this file's own message
# instead of BuildKit echoing a twenty-line inline shell twice.
set -eu

TOKEN_FILE=/run/secrets/nexus_token
NEXUS_PATH=//nexus.pireon.dev/repository/npm-releases/

# `required=true` on the mount only asserts the secret was declared, not that it
# holds anything. An empty one sails past it and surfaces four hundred packages
# later as a Nexus 401 that reads like a credentials problem.
if [ ! -s "$TOKEN_FILE" ]; then
  cat >&2 <<'MSG'

ERROR: the nexus_token build secret is empty.

@pi/ui is published to the private Nexus, so the install needs a token.

  compose:  NEXUS_TOKEN=... docker compose build
            or put NEXUS_TOKEN in .env, which compose reads on its own
  docker:   docker build --secret id=nexus_token,env=NEXUS_TOKEN .

Locally the value is the one already in ~/.npmrc:

  grep nexus.pireon.dev ~/.npmrc

MSG
  exit 1
fi

# Written and removed inside a single layer, so it leaves no trace even in this
# stage — which is discarded anyway.
NPMRC=/tmp/npmrc
printf '%s:_authToken=%s\n' "$NEXUS_PATH" "$(cat "$TOKEN_FILE")" > "$NPMRC"

if NPM_CONFIG_USERCONFIG="$NPMRC" npm ci --no-audit --no-fund; then
  rm -f "$NPMRC"
else
  status=$?
  rm -f "$NPMRC"

  if [ "$status" -ne 0 ]; then
    echo "" >&2
    echo "npm ci failed. If the error above is a 401 from nexus.pireon.dev," >&2
    echo "the token was present but is not valid for npm-releases." >&2
    echo "" >&2
  fi

  exit "$status"
fi