# ==========================================
# MULTI-STAGE DOCKERFILE - BACKEND FASTIFY
# DIAN Electronic Invoicing Microservice
# ==========================================

# Stage 1: Builder
FROM node:22-alpine AS builder

WORKDIR /app

# Instalar herramientas requeridas para compilar dependencias nativas si aplican
RUN apk add --no-cache python3 make g++

COPY backend/package*.json ./
COPY backend/prisma ./prisma/

RUN npm ci

COPY backend/tsconfig.json ./
COPY backend/src ./src

# Generar cliente Prisma y compilar TypeScript a JavaScript estricto
RUN npx prisma generate
RUN npm run build

# Stage 2: Production Distroless / Alpine Minimal
FROM node:22-alpine AS runner

WORKDIR /app

ENV NODE_ENV=production
ENV PORT=3001
ENV HOST=0.0.0.0

# Crear usuario sin privilegios para mitigar riesgos de seguridad
RUN addgroup --system --gid 1001 nodejs && \
    adduser --system --uid 1001 dianapp

# Copiar dependencias de producción y artefactos compilados
COPY backend/package*.json ./
COPY backend/prisma ./prisma/

RUN npm ci --only=production && npm cache clean --force
RUN npx prisma generate

COPY --from=builder --chown=dianapp:nodejs /app/dist ./dist

USER dianapp

EXPOSE 3001

HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
  CMD wget --no-verbose --tries=1 --spider http://localhost:3001/health || exit 1

CMD ["node", "dist/index.js"]