# patches/

Runtime patches applied while the Superset image is built
(`stacks/fuel-monitoring/superset/Dockerfile`):

- `fix_redact_query_for_readers.py`: chart-data responses carry no SQL for readers, as Superset
  already does for embedded guests (`petrolyst_reader.py`).

Same convention as media-insights:

- One file per fix, named `fix_<what>.py`. It patches files inside the installed image
  (`/app/superset/...` or the venv), for changes that cannot be made through
  `superset_config.py`.
- `python3 fix_<what>.py` applies the patch; `python3 fix_<what>.py --verify` exits non-zero
  unless the patched code is in place. Both must be idempotent.
- The Dockerfile runs both for every `fix_*.py` and stops at the first failure, so a patch that
  no longer applies to a new Superset version fails the build instead of shipping silently.
- Everything in this folder is a build input: changing it gives the image a new tag and
  recreates the `superset` container on the next deploy.