# syntax=docker/dockerfile:1

# ---------------------------------------------------------------------------
# Multi-stage build.
#
# The final image carries only production dependencies and compiled output —
# no source, no dev toolchain, no build cache. It also runs as a non-root user,
# because a container escape from an app running as root is a much shorter path
# to the host than one from an unprivileged account.
# ---------------------------------------------------------------------------

FROM node:20-alpine AS base
# OpenSSL is required by the Prisma query engine on Alpine.
RUN apk add --no-cache libc6-compat openssl
WORKDIR /app

# --- Dependencies ---------------------------------------------------------
FROM base AS deps
COPY package.json package-lock.json ./
COPY apps/backend/package.json ./apps/backend/
COPY packages/shared-types/package.json ./packages/shared-types/
COPY packages/shared-utils/package.json ./packages/shared-utils/
RUN npm ci

# --- Build ----------------------------------------------------------------
FROM base AS build
COPY --from=deps /app/node_modules ./node_modules
COPY --from=deps /app/apps/backend/node_modules ./apps/backend/node_modules
COPY . .
RUN npm run prisma:generate \
 && npm run build:packages \
 && npm run build:backend \
 && npm prune --omit=dev

# --- Runtime --------------------------------------------------------------
FROM base AS runtime
ENV NODE_ENV=production

RUN addgroup --system --gid 1001 nodejs \
 && adduser --system --uid 1001 nestjs

COPY --from=build --chown=nestjs:nodejs /app/node_modules ./node_modules
COPY --from=build --chown=nestjs:nodejs /app/apps/backend/dist ./apps/backend/dist
COPY --from=build --chown=nestjs:nodejs /app/apps/backend/package.json ./apps/backend/
COPY --from=build --chown=nestjs:nodejs /app/packages ./packages
COPY --from=build --chown=nestjs:nodejs /app/database ./database
COPY --from=build --chown=nestjs:nodejs /app/package.json ./

USER nestjs
EXPOSE 3000

# The orchestrator restarts the container if this fails, so it checks the
# database connection too — a process that is up but cannot reach Postgres is
# not actually serving.
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
  CMD node -e "require('http').get('http://127.0.0.1:3000/api/v1/health',r=>process.exit(r.statusCode===200?0:1)).on('error',()=>process.exit(1))"

CMD ["node", "apps/backend/dist/main.js"]
