Issue #245978 feat: Provider BE - Docker Security Hotspot fixes

.dockerignore

@@ -0,0 +1,96 @@
+# Dependencies
+node_modules
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+
+# Environment files
+.env
+.env.local
+.env.development.local
+.env.test.local
+.env.production.local
+*.env
+.npmrc
+.yarnrc
+.pnpmrc
+
+# Git
+.git
+.gitignore
+.gitattributes
+
+# Documentation
+README.md
+CHANGELOG.md
+*.md
+docs/
+
+# Tests
+test/
+tests/
+__tests__/
+*.test.js
+*.spec.js
+coverage/
+
+# IDE and editor files
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+
+# OS generated files
+.DS_Store
+.DS_Store?
+._*
+.Spotlight-V100
+.Trashes
+ehthumbs.db
+Thumbs.db
+
+# Logs
+logs/
+*.log
+
+# Docker files
+Dockerfile*
+docker-compose*.yml
+.dockerignore
+
+# Build artifacts
+dist/
+build/
+.next/
+.nuxt/
+
+# Temporary files
+tmp/
+temp/
+
+# Miscellaneous
+.nyc_output
+.cache
+.parcel-cache
+.tsbuildinfo
+*.tsbuildinfo
+
+# Keys/credentials
+*.pem
+*.key
+*.p12
+*.pfx
+*.crt
+id_rsa*
+id_ed25519*
+.ssh/
+
+# Scripts (excluding from production)
+scripts/
+
+# Mock files
+mock-files/
+
+# Upload files (sensitive data)
+uploads/

Dockerfile

@@ -1,27 +1,29 @@
-FROM node:20 as dependencies
-
+FROM node:20-alpine AS builder
+RUN apk add --no-cache g++ libc6-compat make python3
 WORKDIR /app
-
-# Install dependencies
 COPY package*.json ./
-RUN npm install
-
-# Copy everything else (including prisma/)
-COPY . .
-
-# Optional check to confirm schema exists
-RUN ls -la prisma/schema.prisma
-
-# Generate Prisma client
-RUN npx prisma generate
-
-# Run migrations
-#RUN npx prisma migrate dev --name init
-#RUN npx prisma migrate reset --force
-
-# Build project
-RUN npm run build
-
+RUN npm ci --ignore-scripts
+COPY prisma/ ./prisma/
+COPY src/ ./src/
+COPY nest-cli.json ./
+COPY tsconfig*.json ./
+COPY eslint.config.mjs ./
+RUN npx prisma generate && npm run build
+
+FROM node:20-alpine AS runner
+ENV NODE_ENV=production
+# Create app user/group
+RUN addgroup -g 1001 -S appgroup && adduser -S appuser -u 1001 -G appgroup -s /sbin/nologin -h /home/appuser
+WORKDIR /app
+COPY --chown=root:appgroup package*.json ./
+RUN chmod 644 package*.json && npm ci --omit=dev --ignore-scripts && npm cache clean --force
+# Copy only runtime artifacts
+COPY --chown=root:appgroup prisma/ ./prisma/
+COPY --from=builder --chown=root:appgroup /app/dist/ ./dist/
+COPY --from=builder --chown=root:appgroup /app/node_modules/.prisma/ ./node_modules/.prisma/
+RUN chmod -R 644 prisma/ dist/ node_modules/.prisma/ && \
+    find prisma/ dist/ node_modules/.prisma/ -type d -exec chmod 755 {} \; && \
+    mkdir -p /app/logs /app/temp && chown appuser:appgroup /app/logs /app/temp && chmod 755 /app/logs /app/temp
+USER appuser
 EXPOSE 7000
-
-CMD ["npm", "start"]
+CMD ["node", "dist/main.js"]

src/app.controller.spec.ts

@@ -15,8 +15,8 @@ describe('AppController', () => {
   });
 
   describe('root', () => {
-    it('should return "Hello World!"', () => {
-      expect(appController.getHello()).toBe('Hello World!');
+    it('should return "Strapi Provider MW Backend!!"', () => {
+      expect(appController.getHello()).toBe('Strapi Provider MW Backend!!');
     });
   });
 });

src/app.service.ts

@@ -3,6 +3,6 @@ import { Injectable } from '@nestjs/common';
 @Injectable()
 export class AppService {
   getHello(): string {
-    return 'Hello World!';
+    return 'Strapi Provider MW Backend!!';
   }
 }

src/main.ts

@@ -49,7 +49,8 @@ async function bootstrap() {
 		},
 	});
 
-	console.log('process.env.PORT-->>', process.env.PORT);
-	await app.listen(process.env.PORT ?? 3000);
+	// Bind to all interfaces inside the container; avoid logging env in prod
+	const port = parseInt(process.env.PORT ?? '', 10) || 7000;
+	await app.listen(port, '0.0.0.0');
 }
 bootstrap();

test/app.e2e-spec.ts

@@ -20,6 +20,6 @@ describe('AppController (e2e)', () => {
     return request(app.getHttpServer())
       .get('/')
       .expect(200)
-      .expect('Hello World!');
+      .expect('Strapi Provider MW Backend!!');
   });
 });