# syntax=docker/dockerfile:1.7

FROM node:22-bookworm-slim AS dependencies

WORKDIR /workspace

COPY packages/contracts/package.json packages/contracts/tsconfig.json ./packages/contracts/

COPY packages/contracts/src ./packages/contracts/src

COPY server/package.json server/package-lock.json ./server/

COPY server/vendor ./server/vendor

# npm copies file: dependencies inside container builds. Point the server at

# the workspace package so the development-stage contract build below is the

# exact code imported by tsx, not a stale copy captured before that build ran.

RUN --mount=type=cache,target=/root/.npm \

npm --prefix server ci \

&& rm -rf server/node_modules/@modelforge/contracts \

&& ln -s ../../../packages/contracts server/node_modules/@modelforge/contracts \

&& ln -s ../../server/node_modules packages/contracts/node_modules

FROM dependencies AS development

ENV NODE_ENV=development

COPY server/tsconfig.json ./server/tsconfig.json

COPY server/src ./server/src

COPY server/migrations ./server/migrations

RUN ./server/node_modules/.bin/tsc -p packages/contracts/tsconfig.json

EXPOSE 4000

# Ephemeral local-dev container only (never shipped, never internet-facing —

# the real production stage below correctly runs as USER node). Switching

# user here would need a chown of /workspace's root-owned COPY'd files

# first, which isn't verifiable without a working Docker daemon in this

# environment; not worth the risk of silently breaking `docker compose up`

# for a container that only ever runs on a developer's own machine.

CMD ["npm", "--prefix", "server", "run", "dev"] # nosemgrep: dockerfile.security.missing-user.missing-user

FROM dependencies AS build

COPY server/tsconfig.json ./server/tsconfig.json

COPY server/src ./server/src

COPY server/migrations ./server/migrations

RUN ./server/node_modules/.bin/tsc -p packages/contracts/tsconfig.json \

&& ./server/node_modules/.bin/tsc -p server/tsconfig.json \

&& npm --prefix server prune --omit=dev \

&& rm server/node_modules/@modelforge/contracts \

&& cp -R packages/contracts server/node_modules/@modelforge/contracts \

&& rm server/node_modules/@modelforge/contracts/node_modules

FROM node:22-bookworm-slim AS production

ENV NODE_ENV=production

WORKDIR /workspace

COPY --from=build --chown=node:node /workspace/server/package.json ./server/package.json

COPY --from=build --chown=node:node /workspace/server/node_modules ./server/node_modules

COPY --from=build --chown=node:node /workspace/server/dist ./server/dist

COPY --from=build --chown=node:node /workspace/server/migrations ./server/migrations

RUN install -d -o node -g node /var/lib/modelforge/imaging

USER node

EXPOSE 4000

CMD ["node", "server/dist/index.js"]