FROM node:22-alpine

WORKDIR /app

# Install pnpm
RUN npm install -g pnpm

# Create non-root user
RUN addgroup -S app && adduser -S -G app app

# Copy dependency definition files first for better caching
COPY pnpm-workspace.yaml .
COPY pnpm-lock.yaml .
COPY package.json .

# Copy patches (pnpm patchedDependencies)
COPY patches ./patches

# Copy packages (workspace dependencies)
COPY packages/shared ./packages/shared

# Copy service
COPY services/backend ./services/backend

# Install dependencies with build cache
RUN --mount=type=cache,id=pnpm-store,target=/root/.local/share/pnpm/store \
    pnpm install --frozen-lockfile

# Build shared workspace dependency first
RUN --mount=type=cache,id=pnpm-store,target=/root/.local/share/pnpm/store \
    pnpm --filter './packages/shared' run build

# Build backend
RUN --mount=type=cache,id=pnpm-store,target=/root/.local/share/pnpm/store \
    pnpm --filter './services/backend' run build

# Own dist + node_modules by non-root user
RUN chown -R app:app /app

# Switch to non-root user
USER app

# Expose port
EXPOSE 3000

# Healthcheck — backend serves HTTP on port 3000
HEALTHCHECK --interval=30s --timeout=10s --start-period=15s --retries=3 \
  CMD wget -qO- http://localhost:3000/api/health || exit 1

# Start backend
CMD ["node", "services/backend/dist/index.js"]