FROM node:20-alpine AS deps

WORKDIR /workspace

COPY packages/external-provider-contract/package.json ./packages/external-provider-contract/package.json
COPY packages/external-provider-contract/src/contract-version.mjs ./packages/external-provider-contract/src/contract-version.mjs
COPY packages/external-provider-contract/src/data-plane.mjs ./packages/external-provider-contract/src/data-plane.mjs
COPY packages/external-provider-contract/src/data-product.mjs ./packages/external-provider-contract/src/data-product.mjs
COPY packages/external-provider-contract/src/geometry.mjs ./packages/external-provider-contract/src/geometry.mjs
COPY packages/external-provider-contract/src/intake-batch.mjs ./packages/external-provider-contract/src/intake-batch.mjs
COPY packages/external-provider-contract/src/sensitive-field-policy.mjs ./packages/external-provider-contract/src/sensitive-field-policy.mjs
COPY services/external-data-plane/package.json services/external-data-plane/package-lock.json ./services/external-data-plane/

WORKDIR /workspace/services/external-data-plane
RUN npm ci --omit=dev

FROM node:20-alpine AS runner

ENV NODE_ENV=production
ENV PORT=18106

WORKDIR /app

COPY --from=deps /workspace/services/external-data-plane/package.json /workspace/services/external-data-plane/package-lock.json ./
COPY --from=deps /workspace/services/external-data-plane/node_modules ./node_modules
COPY --from=deps /workspace/packages/external-provider-contract /packages/external-provider-contract
COPY services/external-data-plane/src ./src
COPY services/external-data-plane/definitions ./definitions

# A dedicated numeric identity owns the legacy EDP bearer boundary and reads the
# separate public Engine trust mount; it is not the shared service uid/gid.
RUN addgroup -S -g 11006 nodedc-edp && adduser -S -D -H -u 11006 -G nodedc-edp nodedc-edp

USER 11006:11006

EXPOSE 18106

CMD ["node", "src/server.mjs"]