FROM node:20-alpine AS deps

WORKDIR /workspace

COPY packages/external-provider-contract ./packages/external-provider-contract
COPY services/external-data-plane/package.json services/external-data-plane/package-lock.json ./services/external-data-plane/

WORKDIR /workspace/services/external-data-plane
RUN npm ci --omit=dev

FROM node:20-alpine AS runner

ENV NODE_ENV=production
ENV PORT=18106

WORKDIR /app

COPY --from=deps /workspace/services/external-data-plane/package.json /workspace/services/external-data-plane/package-lock.json ./
COPY --from=deps /workspace/services/external-data-plane/node_modules ./node_modules
COPY --from=deps /workspace/packages/external-provider-contract /packages/external-provider-contract
COPY services/external-data-plane/src ./src
COPY services/external-data-plane/definitions ./definitions

# A dedicated numeric identity can read only the EDP provisioning secret mount;
# it is intentionally not the shared Node/Map Gateway uid/gid (1000).
RUN addgroup -S -g 11006 nodedc-edp && adduser -S -D -H -u 11006 -G nodedc-edp nodedc-edp

USER 11006:11006

EXPOSE 18106

CMD ["node", "src/server.mjs"]