Build / security fixes, Prisma updates to run migrations on deploy, and add new subcontractingEndCustomer field to billing accounts to be loaded from Salesforce.

.gitignore

@@ -53,6 +53,9 @@ pids
 *.seed
 *.pid.lock
 
+# TypeScript build info
+tsconfig.tsbuildinfo
+
 # Diagnostic reports (https://nodejs.org/api/report.html)
 report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json
 

Dockerfile

@@ -1,36 +1,31 @@
 # ---- Base Stage ----
-FROM node:20-alpine AS base
+FROM node:22.19-alpine AS base
+RUN apk add --no-cache openssh-client git openssl
 WORKDIR /usr/src/app
 
 # ---- Dependencies Stage ----
 FROM base AS deps
-# Install pnpm
 RUN npm install -g pnpm
-# Copy dependency-defining files
 COPY package.json pnpm-lock.yaml ./
-# Install dependencies
-RUN pnpm install --frozen-lockfile --prod
+RUN pnpm install --frozen-lockfile
 
 # ---- Build Stage ----
-FROM base AS build
-RUN npm install -g pnpm
-COPY --from=deps /usr/src/app/node_modules ./node_modules
+FROM deps AS build
 COPY . .
-# Build the application
+# Build the application (runs prisma generate via package script)
 RUN pnpm build
 
 # ---- Production Stage ----
 FROM base AS production
 ENV NODE_ENV=production
-# Install OpenSSL runtime (provides libssl.so.3 for Prisma musl OpenSSL 3)
-RUN apk add --no-cache openssl
-# Copy built application from the build stage
+WORKDIR /usr/src/app
+
+# Copy built artifacts and runtime deps
 COPY --from=build /usr/src/app/dist ./dist
-# Copy production dependencies (including generated Prisma client) from the build stage
 COPY --from=build /usr/src/app/node_modules ./node_modules
+COPY --from=build /usr/src/app/prisma ./prisma
+COPY --from=build /usr/src/app/entrypoint.sh /entrypoint.sh
 
-# Expose the application port
-EXPOSE 3000
+RUN chmod +x /entrypoint.sh
 
-# The command to run the application
-CMD ["node", "dist/main.js"]
+ENTRYPOINT ["/entrypoint.sh"]

entrypoint.sh

@@ -0,0 +1,25 @@
+#!/bin/sh
+
+set -e
+
+echo "Starting Billing Accounts API v6..."
+
+# Run database migrations
+# Prisma uses PostgreSQL advisory locks to prevent concurrent migrations
+# Only one instance will run migrations, others will wait
+
+echo "Running database migrations..."
+
+npx prisma migrate deploy
+
+# Check migration status
+if [ $? -eq 0 ]; then
+    echo "Migrations completed successfully"
+else
+    echo "Migration failed with exit code $?"
+    exit 1
+fi
+
+# Start the application
+echo "Starting application server..."
+exec node /usr/src/app/dist/main.js

package.json

@@ -13,7 +13,9 @@
     "prisma:generate": "prisma generate",
     "prisma:migrate": "prisma migrate dev --name init",
     "import:legacy": "ts-node scripts/import-legacy.ts",
-    "import:access": "ts-node scripts/import-ba-access.ts"
+    "import:access": "ts-node scripts/import-ba-access.ts",
+    "import:markup": "ts-node scripts/import-markup.ts",
+    "backfill:clientIds": "ts-node scripts/backfill-client-ids.ts"
   },
   "dependencies": {
     "@nestjs/common": "^10.3.0",
@@ -23,17 +25,17 @@
     "@nestjs/swagger": "^7.4.2",
     "@nestjs/mapped-types": "^2.1.0",
     "@nestjs/platform-express": "^10.3.0",
-    "@prisma/client": "^5.18.0",
+    "@prisma/client": "^6.18.0",
     "@types/express": "^5.0.3",
     "class-transformer": "^0.5.1",
     "class-validator": "^0.14.0",
     "dotenv": "^16.4.5",
     "pino": "^9.0.0",
-    "prisma": "^5.18.0",
+    "prisma": "^6.18.0",
     "reflect-metadata": "^0.1.13",
     "rimraf": "^5.0.7",
     "swagger-ui-express": "^5.0.0",
-    "tc-core-library-js": "github:appirio-tech/tc-core-library-js#v3.0.1"
+    "tc-core-library-js": "github:appirio-tech/tc-core-library-js#security"
   },
   "devDependencies": {
     "@eslint/eslintrc": "^3.2.0",
@@ -50,7 +52,7 @@
   },
   "pnpm": {
     "onlyBuiltDependencies": [
-        "@prisma/client"
+      "@prisma/client"
     ]
   }
 }