FROM node:22-alpine AS web-builder
WORKDIR /src/web
COPY web/package.json web/package-lock.json ./
RUN --mount=type=cache,target=/root/.npm npm ci
COPY web/ ./
RUN npm run build

FROM golang:1.25-alpine AS go-builder
WORKDIR /src
COPY go.mod go.sum ./
RUN --mount=type=cache,target=/go/pkg/mod go mod download
COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags="-s -w" -o /finance-portal ./cmd/finance-portal

FROM python:3.11-slim
COPY script/finance_portal/requirements.txt /tmp/finance-worker-requirements.txt
RUN groupadd --system portal && useradd --system --gid portal portal \
    && pip install --no-cache-dir -r /tmp/finance-worker-requirements.txt
WORKDIR /app
COPY --from=go-builder /finance-portal /usr/local/bin/finance-portal
COPY --from=web-builder /src/web/dist /app/web/dist
COPY script/bigquery /app/script/bigquery
COPY script/finance_portal /app/script/finance_portal
RUN mkdir -p /app/data && chown -R portal:portal /app
USER portal
ENV FINANCE_PORTAL_LISTEN=0.0.0.0:8870 \
    FINANCE_PORTAL_WEB_DIST=/app/web/dist \
    FINANCE_PORTAL_STATE_PATH=/app/data/control-plane.json \
    FINANCE_PORTAL_MONTHLY_SCRIPT=/app/script/finance_portal/monthly_billing.py
EXPOSE 8870
ENTRYPOINT ["/usr/local/bin/finance-portal"]