# ymz/astrbot — pinned, patched AstrBot for yunmengze.
#
# Base image is pinned to the upstream release tag (never :latest); the only
# delta is the trusted-header SSO patch plus its bootstrap page. Both files are
# generated/verified by build.sh from the transparent diff in
# patches/astrbot-sso.patch against upstream tag v4.29.3.
#
# Build:  ./build.sh   (regenerates build inputs, then builds on the VPS)
# Result: ymz/astrbot:v4.29.3-sso
FROM soulter/astrbot:v4.29.3

LABEL org.opencontainers.image.title="ymz/astrbot" \
      org.opencontainers.image.description="AstrBot v4.29.3 with the yunmengze trusted-header SSO patch" \
      org.opencontainers.image.base.name="docker.io/soulter/astrbot:v4.29.3" \
      org.opencontainers.image.version="v4.29.3-sso"

# Downstream patch: POST /api/v1/auth/sso (loopback + shared secret ->
# AuthService.generate_jwt). See patches/astrbot-sso.patch.
COPY auth.py /AstrBot/astrbot/dashboard/api/auth.py

# Downstream hosting notice. Upstream's FIRST_NOTICE says "paid = scam"; this
# managed deployment replaces that user-facing notice with an accurate one:
# the fee pays for hosting, not for the AGPL software. Source offer link is in
# the notice. Localized copies are used by AstrBot's notice resolver.
COPY FIRST_NOTICE.md /AstrBot/FIRST_NOTICE.md
COPY FIRST_NOTICE.md /AstrBot/FIRST_NOTICE.zh-CN.md
COPY FIRST_NOTICE.md /AstrBot/FIRST_NOTICE.en-US.md

# Bootstrap page. It lives in the *bundled* dashboard dist, which AstrBot
# serves on a fresh data volume (data/dist does not exist yet), so
# https://<slug>.yunmengze.xyz/sso.html works on first boot.
COPY sso.html /AstrBot/astrbot/dashboard/dist/sso.html

# Sanity check at build time: the patch must be in place and importable.
# (Fails the build instead of shipping an image whose SSO route is missing.)
RUN python - <<'PY'
import pathlib
import py_compile

auth = pathlib.Path("/AstrBot/astrbot/dashboard/api/auth.py")
sso = pathlib.Path("/AstrBot/astrbot/dashboard/dist/sso.html")
assert "/auth/sso" in auth.read_text(encoding="utf-8"), "auth.py patch missing"
py_compile.compile(str(auth), doraise=True)
assert sso.is_file() and sso.stat().st_size > 0, "sso.html missing"
print("ymz/astrbot: SSO patch + bootstrap page present")
PY

# Upstream entrypoint/CMD are inherited: WORKDIR /AstrBot, CMD ["python","main.py"].
