# 从仓库根目录构建：docker build -f backend/Dockerfile -t ys-payroll-backend:release .
FROM ghcr.io/astral-sh/uv:0.12.13 AS uv
FROM python:3.12-slim-bookworm

ENV TZ=Asia/Shanghai \
    PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    UV_LINK_MODE=copy \
    UV_PYTHON_DOWNLOADS=never \
    PATH="/app/backend/.venv/bin:$PATH"

# 这里只安装客户端驱动，连接客户现场 SQL Server；镜像内没有 T+ 数据库。
RUN apt-get update \
    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends ca-certificates curl gnupg unixodbc tzdata \
    && curl -fsSL https://packages.microsoft.com/keys/microsoft.asc \
        | gpg --dearmor -o /usr/share/keyrings/microsoft-prod.gpg \
    && echo "deb [signed-by=/usr/share/keyrings/microsoft-prod.gpg] https://packages.microsoft.com/debian/12/prod bookworm main" \
        > /etc/apt/sources.list.d/mssql-release.list \
    && apt-get update \
    && ACCEPT_EULA=Y DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends msodbcsql18 \
    && apt-get purge -y curl gnupg \
    && apt-get autoremove -y \
    && rm -rf /var/lib/apt/lists/*

COPY --from=uv /uv /usr/local/bin/uv
WORKDIR /app/backend
COPY backend/pyproject.toml backend/uv.lock backend/.python-version ./
RUN uv sync --frozen --no-dev --extra tplus --no-cache

COPY backend/alembic.ini ./
COPY backend/alembic ./alembic
COPY backend/app ./app
# 保留仓库相对布局，覆盖读取、总量、关联核验和样本核对 SQL。
COPY db/queries/tplus /app/db/queries/tplus
# V28 迁移从仓库路径读取留存 SQL，镜像必须携带该运行时依赖。
COPY db/migration /app/db/migration
COPY docker/tplus-maintenance.sh /app/tplus-maintenance.sh

RUN mkdir -p /app/backend/uploads /app/backend/logs \
    && useradd --uid 10001 --create-home appuser \
    && chown -R appuser:appuser /app/backend/uploads /app/backend/logs
USER appuser
CMD ["python", "-m", "uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]