ad39a3bb0f
admin-portal §2.3 P1 阻塞项补齐：CreateUser/UpdateUser/DeleteUser 3 RPC iam.repository/service/grpc.controller 实现 3 用户管理方法（含 bcrypt + 审计） iam.controller 新增 POST /v1/iam/users + DELETE /v1/iam/users/:id（@RequirePermission(IAM_USER_MANAGE)） iam.dto 新增 createUserSchema Zod 校验 F12 httpOnly Cookie：refresh_token 改为 httpOnly+Secure+SameSite=Strict Cookie 下发 extractRefreshToken 优先读 cookie 回退 body + buildRefreshTokenCookie/buildClearCookie
58 lines
2.0 KiB
Docker
58 lines
2.0 KiB
Docker
# Build stage
|
||
FROM node:22-alpine AS builder
|
||
WORKDIR /app
|
||
RUN corepack enable && corepack prepare pnpm@11.13.0 --activate
|
||
# 安装原生模块编译工具（bcrypt 需要 python3 + make + g++）
|
||
RUN apk add --no-cache python3 make g++
|
||
|
||
# 复制 workspace 配置 + tsconfig 基线
|
||
COPY package.json pnpm-lock.yaml* pnpm-workspace.yaml tsconfig.base.json ./
|
||
|
||
# 复制 shared-proto（gRPC proto-loader 运行时加载）
|
||
COPY packages/shared-proto ./packages/shared-proto
|
||
|
||
# 复制 shared-ts（workspace 依赖）
|
||
COPY packages/shared-ts ./packages/shared-ts
|
||
|
||
# 复制 iam 源码
|
||
COPY services/iam ./services/iam
|
||
|
||
# HUSKY=0 跳过根 package.json 的 prepare:husky 脚本
|
||
ENV HUSKY=0
|
||
|
||
# 只安装 iam 及其 workspace 依赖（@edu/shared-ts、@edu/shared-proto），不安装 arch-scan（避免 better-sqlite3 原生编译）
|
||
# 不使用 --ignore-scripts，让 bcrypt 的 install script 正常执行原生编译
|
||
RUN pnpm install --no-frozen-lockfile --filter @edu/iam-service...
|
||
|
||
# 构建 shared-ts（iam 依赖 @edu/shared-ts/outbox dist 产物）
|
||
RUN cd packages/shared-ts && pnpm build
|
||
|
||
# 构建 iam
|
||
WORKDIR /app/services/iam
|
||
RUN pnpm build
|
||
|
||
# Runtime stage
|
||
FROM node:22-alpine
|
||
WORKDIR /app
|
||
|
||
# 复制 workspace 配置 + tsconfig 基线
|
||
COPY package.json pnpm-lock.yaml* pnpm-workspace.yaml tsconfig.base.json ./
|
||
|
||
# 复制 shared-proto + shared-ts（运行时需要：proto 文件 + shared-ts dist）
|
||
COPY packages/shared-proto ./packages/shared-proto
|
||
COPY packages/shared-ts ./packages/shared-ts
|
||
|
||
# 复制 iam 源码
|
||
COPY services/iam ./services/iam
|
||
|
||
# 从 builder 复制已编译的 prod node_modules + iam dist + shared-ts dist
|
||
COPY --from=builder /app/services/iam/node_modules ./services/iam/node_modules
|
||
COPY --from=builder /app/packages/shared-ts/node_modules ./packages/shared-ts/node_modules
|
||
COPY --from=builder /app/node_modules ./node_modules
|
||
COPY --from=builder /app/services/iam/dist ./services/iam/dist
|
||
COPY --from=builder /app/packages/shared-ts/dist ./packages/shared-ts/dist
|
||
|
||
WORKDIR /app/services/iam
|
||
EXPOSE 3002 50052
|
||
CMD ["node", "dist/main.js"]
|