FROM node:22-slim AS dependencies
WORKDIR /app
COPY package*.json ./
RUN npm ci

FROM dependencies AS build
COPY . .
RUN npm run build

# Production API/worker image: deliberately contains no LibreOffice, PDF
# renderer, or OCR engine. Untrusted document processors live only in the
# disposable sandbox target below.
FROM node:22-slim AS app
WORKDIR /app
COPY package*.json ./
RUN npm ci --omit=dev && npm cache clean --force
COPY --from=build /app/dist ./dist
COPY --from=build /app/workflow-packs ./workflow-packs
ENV NODE_ENV=production
USER node
EXPOSE 3001
CMD ["npm", "start"]

FROM app AS document-sandbox
USER root
RUN apt-get update \
  && apt-get install -y --no-install-recommends \
    fonts-dejavu-core \
    libreoffice \
    poppler-utils \
    tesseract-ocr \
    tesseract-ocr-deu \
    tesseract-ocr-eng \
    tesseract-ocr-fra \
    tesseract-ocr-hun \
    tesseract-ocr-ita \
    tesseract-ocr-pol \
    tesseract-ocr-spa \
  && rm -rf /var/lib/apt/lists/*
ENV NODE_ENV=production \
    DOCUMENT_SANDBOX_WORKER=true \
    HOME=/tmp \
    PORT=3010
USER node
EXPOSE 3010
CMD ["node", "dist/documentSandboxServer.js"]

# Keep plain `docker build backend` safe: its default final image is the API,
# not the tooling-heavy sandbox.
FROM app AS production
