FROM python:3.12-slim

COPY --from=ghcr.io/astral-sh/uv:0.8.17 /uv /uvx /bin/

RUN apt-get update \
    && apt-get install --no-install-recommends -y git \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app

ENV VIRTUAL_ENV="/app/.venv"

COPY requirements.txt /app/requirements.txt

RUN uv venv "$VIRTUAL_ENV" && uv pip install -r /app/requirements.txt

# Full requirement spec for the PyAirbyte build to deploy, such as
# `airbyte==0.56.0` or `airbyte @ git+https://github.com/airbytehq/PyAirbyte@ref`.
# A bare version is not enough. `deploy-mcp-command.yml` always passes this: it
# resolves the latest release from PyPI when no specific build was requested, so
# the deployed version is explicit and logged rather than whatever PyPI happened
# to serve while the layer above was building.
ARG PYAIRBYTE_REQUIREMENT=""
# `--no-cache` so a just-published version is not missed: the layer above
# caches PyPI's index response for `airbyte`, and reusing it here would hide a
# release that landed seconds ago. `--prerelease=allow` applies only to this
# explicit override, so a PR prerelease that itself depends on prerelease
# dependencies resolves; the pinned install above keeps stable-only resolution.
RUN if [ -n "$PYAIRBYTE_REQUIREMENT" ]; then uv pip install --no-cache --prerelease=allow -- "$PYAIRBYTE_REQUIREMENT"; fi

# Deployment-owned OIDC OAuth-state storage factory. PyAirbyte resolves this
# module by name from `AIRBYTE_MCP_OIDC_CLIENT_STORAGE_FACTORY` (set by Pulumi),
# so it must be importable -- `PYTHONPATH=/app` puts it on `sys.path`.
COPY cloud_mcp_oidc_storage.py /app/cloud_mcp_oidc_storage.py

RUN useradd -m -u 10001 appuser \
    && chown -R appuser:appuser /app

ENV PATH="/app/.venv/bin:$PATH"
ENV PYTHONPATH="/app"

EXPOSE 8080

USER appuser

CMD ["airbyte-mcp-http"]
