# Build stage
FROM node:22-alpine AS builder
WORKDIR /app
RUN corepack enable && corepack prepare pnpm@11.13.0 --activate
# 安装原生模块编译工具（bcrypt 需要 python3 + make + g++）
RUN apk add --no-cache python3 make g++

# 复制 workspace 配置 + tsconfig 基线
COPY package.json pnpm-lock.yaml* pnpm-workspace.yaml tsconfig.base.json ./

# 复制 shared-proto（gRPC proto-loader 运行时加载）
COPY packages/shared-proto ./packages/shared-proto

# 复制 shared-ts（workspace 依赖）
COPY packages/shared-ts ./packages/shared-ts

# 复制 iam 源码
COPY services/iam ./services/iam

# HUSKY=0 跳过根 package.json 的 prepare:husky 脚本
ENV HUSKY=0

# 只安装 iam 及其 workspace 依赖（@edu/shared-ts、@edu/shared-proto），不安装 arch-scan（避免 better-sqlite3 原生编译）
# 不使用 --ignore-scripts，让 bcrypt 的 install script 正常执行原生编译
RUN pnpm install --no-frozen-lockfile --filter @edu/iam-service...

# 构建 shared-ts（iam 依赖 @edu/shared-ts/outbox dist 产物）
RUN cd packages/shared-ts && pnpm build

# 构建 iam
WORKDIR /app/services/iam
RUN pnpm build

# Runtime stage
FROM node:22-alpine
WORKDIR /app

# 复制 workspace 配置 + tsconfig 基线
COPY package.json pnpm-lock.yaml* pnpm-workspace.yaml tsconfig.base.json ./

# 复制 shared-proto + shared-ts（运行时需要：proto 文件 + shared-ts dist）
COPY packages/shared-proto ./packages/shared-proto
COPY packages/shared-ts ./packages/shared-ts

# 复制 iam 源码
COPY services/iam ./services/iam

# 从 builder 复制已编译的 prod node_modules + iam dist + shared-ts dist
COPY --from=builder /app/services/iam/node_modules ./services/iam/node_modules
COPY --from=builder /app/packages/shared-ts/node_modules ./packages/shared-ts/node_modules
COPY --from=builder /app/node_modules ./node_modules
COPY --from=builder /app/services/iam/dist ./services/iam/dist
COPY --from=builder /app/packages/shared-ts/dist ./packages/shared-ts/dist

WORKDIR /app/services/iam
EXPOSE 3002 50052
CMD ["node", "dist/main.js"]