# Petrolyst Superset image. Deployment only: every customization is copied from
# petrolyst-insights/, which compose.yaml passes as the named build context
# "insights". deploy/deploy.sh tags the result with a hash of exactly these
# inputs (this file plus what is copied below), so the tag changes only when
# the image would.
FROM apache/superset:6.1.0@sha256:16b50bbef6648912a79e3293d418fefa743ce555d36c5af6b85d859119ed7f88

USER root
# The 6.1.0 image ships neither an OAuth client nor the Postgres driver.
RUN uv pip install --no-cache --python /app/.venv/bin/python \
      authlib==1.9.1 psycopg2-binary==2.9.13

COPY --from=insights --chown=superset:superset superset_config.py petrolyst_security.py /app/pythonpath/
COPY --from=insights --chown=superset:superset roles/ /app/petrolyst-roles/
COPY --from=insights --chown=superset:superset assets/branding/ /app/superset/static/assets/branding/
COPY --from=insights patches/ /app/patches/petrolyst/
# Stop at the first patch or verify that fails, so a later success cannot hide
# an earlier failure.
RUN for p in /app/patches/petrolyst/fix_*.py; do \
      [ -e "$p" ] || continue; \
      { python3 "$p" && python3 "$p" --verify; } || exit 1; \
    done

# Deployment, not customization: in the image (and so in the tag) rather than
# bind-mounted, so a change to it makes deploy.sh run superset-init again.
COPY init.sh /app/petrolyst-init.sh

USER superset