# ControlUp MCP -> Streamable HTTP bridge  —  REFERENCE COPY
#
# You do NOT need this file locally. The deployment helper (deploy.sh) writes
# this exact Dockerfile inside Azure Cloud Shell and builds it with `az acr build`,
# so there is no local Dockerfile and no local Docker required. It's kept here
# only so you can review or security-scan the image recipe.
#
# It wraps ControlUp's PUBLIC @controlup-ai/mcp package (public npm — no private
# feed / Artifactory) with supergateway, exposing MCP Streamable HTTP on /mcp.
# No ControlUp credentials are baked in; they come from Key Vault at runtime.

# ---- builder: install pinned packages from public npm ----
FROM node:22-bookworm-slim AS builder
ARG CU_MCP_VERSION=1.0.3
ARG SUPERGATEWAY_VERSION=3.4.3
RUN npm install -g --omit=dev \
      @controlup-ai/mcp@${CU_MCP_VERSION} \
      supergateway@${SUPERGATEWAY_VERSION} \
 && npm cache clean --force

# ---- runtime: the shipped image ----
FROM node:22-bookworm-slim AS runtime
LABEL org.opencontainers.image.title="controlup-mcp-bridge" \
      org.opencontainers.image.vendor="ControlUp"

# Non-root
RUN groupadd -r mcp && useradd -r -g mcp -d /home/mcp -m mcp

COPY --from=builder /usr/local/lib/node_modules /usr/local/lib/node_modules
COPY --from=builder /usr/local/bin /usr/local/bin

ENV NODE_ENV=production \
    PORT=8000 \
    STREAMABLE_HTTP_PATH=/mcp \
    # Bin name of the @controlup-ai/mcp package (verified: bin "cu-mcp").
    STDIO_COMMAND="cu-mcp"
#
# Runtime credentials come from the platform (Key Vault -> ACA secret -> env):
#     API_KEY, ORG_ID     (optional: DOMAINS to scope product tools; API_URL for region)

USER mcp
EXPOSE 8000

# /healthz is served by supergateway (via --healthEndpoint) and probed directly
# against the container, bypassing the ingress auth layer (Easy Auth).
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
  CMD node -e "fetch('http://127.0.0.1:'+(process.env.PORT||8000)+'/healthz').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"

# Stateless Streamable HTTP (POST /mcp) — most compatible mode behind Easy Auth.
# For session resumption: add --stateful --sessionTimeout 60000 and set maxReplicas = 1.
ENTRYPOINT ["/bin/sh","-c","exec supergateway \
  --stdio \"$STDIO_COMMAND\" \
  --outputTransport streamableHttp \
  --streamableHttpPath \"$STREAMABLE_HTTP_PATH\" \
  --port \"$PORT\" \
  --healthEndpoint /healthz"]
