"""The role "ATOMA Guest": what the Petrolyst app's embedded dashboards may do (PD-12 trial).

Superset gives every embedded viewer (a guest pass signed for one dashboard) the role named by
GUEST_ROLE_NAME. That role gets the same permissions as "ATOMA Reader": reading a dashboard
and its charts' data, nothing else. Which dashboard a guest sees comes from the pass, not from
the role. Superset leaves the SQL out of chart-data responses for guests.

Embedding is switched on in the local stack only (.local/fmdb-scratch, superset_config_local.py),
so this script is not part of init.sh; run it by hand inside the Superset container:

    docker exec <superset> /app/.venv/bin/python /app/petrolyst-roles/atoma_guest.py
"""

from __future__ import annotations

import sys

from atoma_reader import PERMISSIONS, sync

ROLE = "ATOMA Guest"

if __name__ == "__main__":
    sys.exit(sync(ROLE, PERMISSIONS))