FROM ghcr.io/open-webui/mcpo:main

# Azure CLI — required for non-interactive service-principal auth
# (`az login --service-principal`) performed by entrypoint.sh at container
# start. FlowAgent's auth model is Azure CLI + MSAL; see
# https://github.com/microsoft/power-platform-skills/blob/main/plugins/power-automate/references/connection-patterns.md
RUN apk add --no-cache py3-pip curl \
 && pip install --no-cache-dir --break-system-packages azure-cli

# FlowAgent self-contained MCP bundle (stdio transport, all tools inlined,
# Node 18+ only — no npm install / remote host needed at runtime).
# Pinned to a ref (commit SHA or tag), NOT `main`, for reproducible builds.
# Bump deliberately via PR when upstream ships updates:
# https://github.com/microsoft/power-platform-skills/tree/main/plugins/power-automate/server
ARG FLOWAGENT_REF=main
RUN mkdir -p /app/flowagent \
 && curl -fsSL "https://raw.githubusercontent.com/microsoft/power-platform-skills/${FLOWAGENT_REF}/plugins/power-automate/server/mcp.mjs" \
      -o /app/flowagent/mcp.mjs

COPY entrypoint.sh /app/flowagent/entrypoint.sh
RUN chmod +x /app/flowagent/entrypoint.sh