version: 1
applications:
  - frontend:
      phases:
        preBuild:
          commands:
            - nvm use $(cat .nvmrc) || nvm install $(cat .nvmrc)
            # --include=dev is required because the build needs PostCSS /
            # Tailwind plugins which live in devDependencies; without it,
            # NODE_ENV=production in the Amplify env causes npm to skip them.
            - npm ci --include=dev --cache .npm --prefer-offline
            # Amplify exposes Environment Variables in the build shell as
            # plain `$VAR` references, but Secrets are SecureString entries
            # in SSM Parameter Store at `/amplify/<appId>/<branch>/<name>`
            # and are NOT always injected automatically into the build
            # shell on older build images. If a Secret is unset as an env
            # var, fall back to fetching it from SSM directly.
            #
            # Once resolved, the values get baked into .env.production so
            # Next bundles them into the SSR Lambda. .env* is gitignored.
            - |
              # Try SSM for any of these that arrive empty (they were set
              # via the Amplify Secrets tab, not Environment variables).
              # Requires the Amplify build role to have ssm:GetParameter on
              # /amplify/$AWS_APP_ID/$AWS_BRANCH/*  — granted by default.
              fetch_secret() {
                local name="$1"
                local current="${!name}"
                if [ -n "$current" ]; then return 0; fi
                local path="/amplify/${AWS_APP_ID}/${AWS_BRANCH}/${name}"
                local val
                val=$(aws ssm get-parameter --name "$path" --with-decryption \
                  --query "Parameter.Value" --output text 2>/dev/null || true)
                if [ -n "$val" ] && [ "$val" != "None" ]; then
                  export "$name=$val"
                  echo "[secrets] $name resolved from SSM ($path)"
                fi
              }
              for v in CIVI_API_KEY CIVI_SITE_KEY CIVI_HTTP_AUTH_PASS HEALTH_TOKEN PREVIEW_ADMIN_TOKEN STAFF_REPORT_KEY; do
                fetch_secret "$v"
              done
            - |
              # Length-only diagnostic (no values leaked to the log).
              for v in CIVI_BASE_URL CIVI_API_KEY CIVI_SITE_KEY CIVI_HTTP_AUTH_USER CIVI_HTTP_AUTH_PASS HEALTH_TOKEN PREVIEW_ADMIN_TOKEN STAFF_REPORT_KEY; do
                val="${!v}"
                if [ -n "$val" ]; then
                  echo "[env check] $v set (${#val} chars)"
                else
                  echo "[env check] $v UNSET"
                fi
              done
            - |
              # Required-vars guard. Fails the build now (with a clear
              # message) instead of letting an empty .env.production crash
              # the SSR Lambda at runtime with "Refusing to run in
              # production" from lib/env.ts.
              missing=""
              for v in CIVI_BASE_URL CIVI_API_KEY CIVI_SITE_KEY; do
                if [ -z "${!v}" ]; then missing="$missing $v"; fi
              done
              if [ -n "$missing" ]; then
                echo "::error::Amplify build env missing required vars:$missing"
                echo "Confirm: (1) the var is in the Amplify console under either"
                echo "Hosting → Environment variables OR Hosting → Secrets;"
                echo "(2) it is scoped to branch '${AWS_BRANCH}' (or All branches);"
                echo "(3) the Amplify build role can read /amplify/${AWS_APP_ID}/${AWS_BRANCH}/* from SSM."
                exit 1
              fi
            - |
              {
                echo "CIVI_BASE_URL=$CIVI_BASE_URL"
                echo "CIVI_API_KEY=$CIVI_API_KEY"
                echo "CIVI_SITE_KEY=$CIVI_SITE_KEY"
                echo "CIVI_HTTP_AUTH_USER=$CIVI_HTTP_AUTH_USER"
                echo "CIVI_HTTP_AUTH_PASS=$CIVI_HTTP_AUTH_PASS"
                echo "HEALTH_TOKEN=$HEALTH_TOKEN"
                echo "PREVIEW_ADMIN_TOKEN=$PREVIEW_ADMIN_TOKEN"
                echo "STAFF_REPORT_KEY=$STAFF_REPORT_KEY"
              } > .env.production
        build:
          commands:
            - npm run build
      artifacts:
        baseDirectory: .next
        files:
          - '**/*'
      cache:
        paths:
          - node_modules/**/*
          - .next/cache/**/*
          - .npm/**/*