FROM python:3.12-slim

COPY --from=ghcr.io/astral-sh/uv:0.8.17 /uv /uvx /bin/

RUN apt-get update \
    && apt-get install --no-install-recommends -y git \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app

ENV VIRTUAL_ENV="/app/.venv"

COPY requirements.txt /app/requirements.txt

RUN uv venv "$VIRTUAL_ENV" && uv pip install -r /app/requirements.txt

# Optional full requirement spec for previewing an unreleased PyAirbyte on
# cloud-mcp-preview (for example, `airbyte==0.54.0.dev123` or
# `airbyte @ git+https://github.com/airbytehq/PyAirbyte@ref`). A bare version is
# not enough. The requirements pin remains the deployed default.
ARG PYAIRBYTE_REQUIREMENT=""
# `--no-cache` so a just-published version is not missed: the layer above
# caches PyPI's index response for `airbyte`, and reusing it here would hide a
# release that landed seconds ago.
RUN if [ -n "$PYAIRBYTE_REQUIREMENT" ]; then uv pip install --no-cache -- "$PYAIRBYTE_REQUIREMENT"; fi

# Deployment-owned OIDC OAuth-state storage factory. PyAirbyte resolves this
# module by name from `AIRBYTE_MCP_OIDC_CLIENT_STORAGE_FACTORY` (set by Pulumi),
# so it must be importable -- `PYTHONPATH=/app` puts it on `sys.path`.
COPY cloud_mcp_oidc_storage.py /app/cloud_mcp_oidc_storage.py

RUN useradd -m -u 10001 appuser \
    && chown -R appuser:appuser /app

ENV PATH="/app/.venv/bin:$PATH"
ENV PYTHONPATH="/app"

EXPOSE 8080

USER appuser

CMD ["airbyte-mcp-http"]
