From 5b4f32a6495026015a38621247b7f4ad28fb1a8b Mon Sep 17 00:00:00 2001
From: Lucas Berger <me@lucasberger.ca>
Date: Sat, 13 Jun 2026 05:14:28 -0400
Subject: [PATCH] chore(16-01): bake ENV NODE_ENV=production into production
 Dockerfile stage

- Add ENV NODE_ENV=production in production stage after WORKDIR /app/apps/api
- Engages the devBypass.ts hard guard so DEV_AUTH_BYPASS can never inject
  DEV_USER in the shipped image, even if accidentally set (D-07)
- No other stage (base/builder/dev/pwa-builder) is affected
---
 apps/api/Dockerfile | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/apps/api/Dockerfile b/apps/api/Dockerfile
index d17ef0b..09418ff 100644
--- a/apps/api/Dockerfile
+++ b/apps/api/Dockerfile
@@ -39,6 +39,10 @@ COPY apps/pwa/package.json ./apps/pwa/
 RUN pnpm install --frozen-lockfile --prod --filter @familysync/api...
 COPY --from=builder /app/apps/api/dist ./apps/api/dist
 WORKDIR /app/apps/api
+# Enforce production identity — engages the NODE_ENV=production hard guard
+# in devBypass.ts, preventing dev-bypass activation even if DEV_AUTH_BYPASS
+# is accidentally set in the container environment. (D-07)
+ENV NODE_ENV=production
 # PWA static assets built from apps/pwa and served by this API from ./public
 # (single-port deployment for the Pangolin/newt tunnel). serveStatic resolves
 # ./public relative to the runtime CWD, which is this WORKDIR (/app/apps/api).