Develop

.github/workflows/backend-ci.yml

@@ -13,6 +13,8 @@ concurrency:
   group: ci-backend-pr-${{ github.event.pull_request.number }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
 jobs:
   backend:
     name: backend checks
@@ -42,4 +44,4 @@ jobs:
         run: npm -w backend run test
 
       - name: Docker build (backend only)
-        run: docker build -f backend/docker/Dockerfile -t comptaleyes-backend:ci backend
+        run: docker build -f backend/docker/Dockerfile -t comptaleyes-backend:ci .

.github/workflows/cdk-synth.yml

@@ -13,6 +13,8 @@ concurrency:
   group: ci-infra-synth-pr-${{ github.event.pull_request.number }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
 jobs:
   synth:
     name: cdk synth (localSynth)

.github/workflows/frontend-cd.yml

@@ -2,8 +2,6 @@ name: CD - Frontend (S3 + CloudFront Deploy) [Manual]
 
 on:
     workflow_dispatch:
-
-    # Enable later (when frontend is real + you want auto deploy on merge to master)
     push:
       branches: [master]
       paths:
@@ -74,7 +72,6 @@ jobs:
                   echo "bucket_name=$BUCKET_NAME" >> "$GITHUB_OUTPUT"
                   echo "distribution_id=$DIST_ID" >> "$GITHUB_OUTPUT"
 
-            # Frontend build is placeholder for now.
             # This will only run once frontend/package.json exists.
             - name: Setup Node
               if: steps.fe.outputs.exists == 'true'

.github/workflows/frontend-ci.yml

@@ -13,6 +13,8 @@ concurrency:
   group: ci-frontend-pr-${{ github.event.pull_request.number }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
 jobs:
   frontend:
     name: frontend checks

backend/.npmrc

@@ -0,0 +1,2 @@
+package-lock=true
+save-exact=false

backend/README.md

@@ -17,68 +17,6 @@ npm run dev
 •Health: `http://localhost:3000/health`
 •Ready: `http://localhost:3000/ready`
 
-## Architecture Rules
-
-•modules/\*\*/domain must not depend on NestJS
-•application depends only on domain
-•infrastructure depends on NestJS & external libs
-•core is reusable across all services
-•No circular dependencies
-•All dependencies go inwards
-
-## Architecture
-
-```txt
-.
-├─ src/
-│  ├─ main.ts
-│  ├─ app.module.ts
-│  ├─ core/                      # cross-cutting, global, reusable across modules
-│  │  ├─ config/                 # env schema + config service
-│  │  ├─ logging/                # structured logger + request correlation
-│  │  ├─ errors/                 # global exception filter + error types
-│  │  ├─ http/                   # request context, interceptors, pipes
-│  │  ├─ health/                 # /health + /ready
-│  │  └─ docs/                   # swagger setup (optional later)
-│  │
-│  ├─ modules/                   # business domains (feature modules)
-│  │  └─ <domain>/               # e.g. users, invoices, arrears, etc.
-│  │     ├─ api/                 # controllers + DTOs + request/response mapping
-│  │     ├─ application/         # use-cases (orchestrates domain + ports)
-│  │     ├─ domain/              # pure business: entities, value-objects, rules
-│  │     └─ infrastructure/      # adapters: db/http/queues/filesystem
-│  │
-│  └─ shared/                    # framework-agnostic helpers/types
-│     ├─ types/
-│     ├─ utils/
-│     └─ constants/
-│
-├─ test/
-│  ├─ unit/
-│  └─ e2e/
-│
-├─ docker/                       # later
-│  ├─ Dockerfile
-│  └─ entrypoint.sh
-├─ compose/                      # later
-│  ├─ docker-compose.yml
-│  └─ docker-compose.dev.yml
-├─ infra/                        # later (IaC)
-│  ├─ cdk/ or terraform/
-│  └─ README.md
-├─ .github/workflows/            # later (CI/CD)
-├─ .env.example                  # later (but reserved now)
-└─ README.md
-```
-
-## Environment Configuration
-
-```bash
-cp .env.example .env
-```
-
-Environment variables are loaded via the ConfigModule.
-
 ## Running Locally (without Docker)
 
 ```bash
@@ -193,7 +131,7 @@ UNLICENSED (internal use)
 
 ```js
 
-# <Service Name>
+# Comptalize - API
 
 ## Overview
 

backend/docker/Dockerfile

@@ -1,42 +1,42 @@
 # syntax=docker/dockerfile:1
 
 ########################
-# deps (install prod deps)
+# deps (install prod deps for backend workspace)
 ########################
 FROM node:22-alpine AS deps
 WORKDIR /app
 
+# Use monorepo root context to leverage workspace lockfile
 COPY package.json package-lock.json ./
-RUN npm ci --omit=dev --ignore-scripts
+COPY backend/package.json backend/package.json
+RUN npm ci --omit=dev --ignore-scripts --workspace backend
 
 ########################
-# build
+# build (install dev deps for backend workspace and compile)
 ########################
 FROM node:22-alpine AS build
 WORKDIR /app
 
 COPY package.json package-lock.json ./
-RUN npm ci
-
-COPY tsconfig*.json ./
-COPY src ./src
-
-RUN npm run build
+COPY backend backend
+RUN npm ci --workspace backend
+RUN npm run -w backend build
 
 ########################
 # runtime
 ########################
 FROM node:22-alpine AS runtime
-WORKDIR /app
+WORKDIR /app/backend
 
 ENV NODE_ENV=production
 ENV TZ=UTC
 
 RUN addgroup -S app && adduser -S app -G app
 
-COPY --from=deps /app/node_modules ./node_modules
-COPY --from=build /app/dist ./dist
-COPY package.json ./
+# Node resolves modules upward; keep modules at /app/node_modules
+COPY --from=deps /app/node_modules ../node_modules
+COPY --from=build /app/backend/dist ./dist
+COPY backend/package.json ./package.json
 
 USER app