FROM node:20-alpine AS builder
WORKDIR /app

RUN corepack enable && corepack prepare pnpm@10.6.5 --activate

# Use Gitea npm registry for @bytelyst/* packages
COPY backend/package.json ./package.json

RUN --mount=type=secret,id=gitea_npm_token \
  TOKEN=$(cat /run/secrets/gitea_npm_token) && \
  printf '@bytelyst:registry=http://localhost:3300/api/packages/bytelyst/npm/\n//localhost:3300/api/packages/bytelyst/npm/:_authToken=%s\nlink-workspace-packages=false\nshared-workspace-lockfile=false\n' "$TOKEN" > .npmrc && \
  pnpm install --ignore-scripts --lockfile=false

COPY backend/tsconfig.json ./backend/tsconfig.json
COPY backend/src/ ./backend/src/
COPY shared/ ./shared/
RUN cd /app/backend && ../node_modules/.bin/tsc -p tsconfig.json

FROM node:20-alpine
WORKDIR /app/backend
ENV NODE_ENV=production

# Build metadata baked at image build time (consumed by @bytelyst/devops)
ARG BYTELYST_COMMIT_SHA=unknown
ARG BYTELYST_COMMIT_SHA_FULL=unknown
ARG BYTELYST_BRANCH=unknown
ARG BYTELYST_BUILT_AT=unknown
ARG BYTELYST_COMMIT_AUTHOR=unknown
ARG BYTELYST_COMMIT_MESSAGE=unknown
ARG BYTELYST_DOCKER_IMAGE=invttrdg-backend:latest
ENV BYTELYST_COMMIT_SHA=${BYTELYST_COMMIT_SHA} \
    BYTELYST_COMMIT_SHA_FULL=${BYTELYST_COMMIT_SHA_FULL} \
    BYTELYST_BRANCH=${BYTELYST_BRANCH} \
    BYTELYST_BUILT_AT=${BYTELYST_BUILT_AT} \
    BYTELYST_COMMIT_AUTHOR=${BYTELYST_COMMIT_AUTHOR} \
    BYTELYST_COMMIT_MESSAGE=${BYTELYST_COMMIT_MESSAGE} \
    BYTELYST_DOCKER_IMAGE=${BYTELYST_DOCKER_IMAGE}

COPY --from=builder /app/node_modules ./node_modules
COPY --from=builder /app/package.json ./package.json
COPY --from=builder /app/backend/dist ./dist
COPY --from=builder /app/shared/ ../shared/

RUN chown -R node:node /app
USER node

EXPOSE 4018
CMD ["node", "dist/backend/src/bootstrap.js"]