Makefile

# Makefile

# Variables
ADMIN_FRONTEND_DIR := ui/admin-frontend
FORCE_BUILD := false
SKIP_FRONTEND := false
SKIP_DOCS := false

# Detect if enterprise submodule exists and is initialized
ENTERPRISE_EXISTS := $(shell test -f enterprise/.git && echo "yes" || echo "no")

ifeq ($(ENTERPRISE_EXISTS),yes)
    BUILD_TAGS := -tags enterprise
    EDITION := ent
    $(info 🏢 Building Enterprise Edition)
else
    BUILD_TAGS :=
    EDITION := ce
    $(info 🌍 Building Community Edition)
endif

# The root go.mod does not require the private enterprise module, so that the
# module graph plugin authors inherit resolves from the public proxy.
# Enterprise builds and tests of the root module find it through
# enterprise.work: prefix those go commands with $(call root_gowork,<tags>),
# which sets GOWORK when <tags> include enterprise. Never use it for
# microgateway/ or the plugin modules, which are not in that workspace.
ENT_GOWORK := GOWORK=$(CURDIR)/enterprise.work
root_gowork = $(if $(findstring enterprise,$(1)),$(ENT_GOWORK))

# Version information (from git tags)
VERSION ?= $(shell git describe --tags --always --dirty 2>/dev/null || echo "dev")
BUILD_HASH ?= $(shell git rev-parse --short HEAD 2>/dev/null || echo "unknown")
BUILD_TIME ?= $(shell date -u '+%Y-%m-%dT%H:%M:%SZ')

# Build flags for production (optimized, stripped, with version info)
PROD_LDFLAGS := -ldflags="-w -s -X main.Version=$(VERSION) -X main.BuildHash=$(BUILD_HASH) -X main.BuildTime=$(BUILD_TIME)" -trimpath

# Build flags for development (with version info, no stripping)
DEV_LDFLAGS := -ldflags="-X main.Version=$(VERSION) -X main.BuildHash=$(BUILD_HASH) -X main.BuildTime=$(BUILD_TIME)"

# Default target
.DEFAULT_GOAL := help
all: build

# Help target
help:
	@echo "Tyk AI Studio Build Targets"
	@echo ""
	@echo "Current edition: $(EDITION)"
	@echo ""
	@echo "🐳 Docker Development (RECOMMENDED - with hot reloading):"
	@echo "  make dev                - Start minimal env (Studio + Frontend + Postgres)"
	@echo "  make dev-full           - Start full stack (+ Gateway + Plugins)"
	@echo "  make dev-ent            - Start enterprise minimal env"
	@echo "  make dev-full-ent       - Start enterprise full stack (no plugin builds)"
	@echo "  make dev-full-ent-plugins - Same, plus build/watch all plugins"
	@echo "  make dev-down           - Stop development environment"
	@echo "  make dev-help           - Show all development commands"
	@echo ""
	@echo "Development (single platform, fast):"
	@echo "  make build-native       - Build for current platform with CGO (auto-detect edition)"
	@echo "  make build-native-ce    - Build CE for current platform with CGO"
	@echo "  make build-native-ent   - Build ENT for current platform with CGO"
	@echo "  make build-local        - Alias for build-native (backward compatible)"
	@echo ""
	@echo "Development flags:"
	@echo "  SKIP_FRONTEND=true      - Skip frontend build (for faster iteration)"
	@echo "  SKIP_DOCS=true          - Skip docs build (for faster iteration)"
	@echo "  Example: make build-native-ce SKIP_FRONTEND=true SKIP_DOCS=true"
	@echo ""
	@echo "Production (multi-platform, optimized, CGO-enabled):"
	@echo "  make build-prod         - Build all platforms with CGO (auto-detect edition)"
	@echo "  make build-prod-ce      - Build CE for all platforms with CGO"
	@echo "  make build-prod-ent     - Build ENT for all platforms with CGO"
	@echo ""
	@echo "Platform-specific (CGO-enabled):"
	@echo "  make build-linux-amd64  - Linux AMD64 with CGO"
	@echo "  make build-linux-arm64  - Linux ARM64 with CGO (requires cross-compiler)"
	@echo "  make build-darwin-amd64 - Darwin AMD64 with CGO"
	@echo "  make build-darwin-arm64 - Darwin ARM64 with CGO"
	@echo ""
	@echo "Plugin Development:"
	@echo "  make tools              - Build development tools (plugin-scaffold)"
	@echo "  make plugin-new         - Scaffold a new plugin (NAME=x TYPE=y [CAPABILITIES=a,b])"
	@echo "  make plugin-help        - Show plugin scaffolding help"
	@echo "  make plugins            - Build all example plugins"
	@echo "  make plugin-publish     - Build, sign, push a plugin + index it (NAME=x [VERSION=y])"
	@echo "  make plugin-verify      - Check a published plugin's digest and signature (NAME=x|all)"
	@echo "                            (guide: docs/site/docs/plugins-publishing.md)"
	@echo ""
	@echo "Packaging (RPM/DEB via GoReleaser + nfpm):"
	@echo "  make package            - Build all packages (auto-detect edition)"
	@echo "  make package-ce         - Build CE packages (both components)"
	@echo "  make package-ent        - Build ENT packages (both components)"
	@echo "  make package-help       - Show all packaging targets"
	@echo "  make test-package-smoke - Build CE packages and run smoke tests"
	@echo ""
	@echo "Other targets:"
	@echo "  make test               - Run tests"
	@echo "  make clean              - Clean build artifacts"
	@echo "  make show-edition       - Show current edition info"
	@echo ""
	@echo "Integration Tests (requires Docker):"
	@echo "  make test-integration                      - Run all integration tests"
	@echo "  make test-integration-plugin-cache         - Run cache plugin integration tests"
	@echo "  make test-integration-plugin-cache-full    - Run all cache plugin tests (with cluster+syslog)"
	@echo "  make test-integration-plugin-cache-coverage - Run with coverage report"
	@echo "  make test-integration-plugin-github-rag    - Run github-rag-ingest Vault integration tests"
	@echo ""

# Build target (default to production multi-platform builds)
build: build-prod

# Build frontend (can be skipped with SKIP_FRONTEND=true)
build-frontend:
ifeq ($(SKIP_FRONTEND),true)
	@echo "⏭️  Skipping frontend build (SKIP_FRONTEND=true)"
else
	@echo "🔨 Building frontend..."
	cd $(ADMIN_FRONTEND_DIR) && npm run build
endif

# Build documentation site (can be skipped with SKIP_DOCS=true)
build-docs:
ifeq ($(SKIP_DOCS),true)
	@echo "⏭️  Skipping docs build (SKIP_DOCS=true)"
else
	@echo "📚 Building documentation..."
	cd docs/site && npm ci && npm run docs:build
endif

# ============================================================================
# Development Builds (single platform, fast, CGO enabled)
# ============================================================================

# Build for native platform (auto-detect edition)
build-native: ent-link build-frontend build-docs
	@echo "🔨 Building $(EDITION) for native platform with CGO..."
	@mkdir -p bin
	$(call root_gowork,$(BUILD_TAGS)) CGO_ENABLED=1 go build $(BUILD_TAGS) $(DEV_LDFLAGS) -o bin/midsommar-$(EDITION)
	cd microgateway && $(MAKE) build
	cp microgateway/dist/microgateway-$(EDITION) bin/mgw-$(EDITION)
	chmod +x bin/*
	@echo "✅ Native build complete: bin/midsommar-$(EDITION) and bin/mgw-$(EDITION)"

# Build CE for native platform
build-native-ce: build-frontend build-docs
	@echo "🔨 Building CE for native platform with CGO..."
	@mkdir -p bin
	CGO_ENABLED=1 go build $(DEV_LDFLAGS) -o bin/midsommar-ce
	cd microgateway && $(MAKE) build-community
	cp microgateway/dist/microgateway-ce bin/mgw-ce
	chmod +x bin/*
	@echo "✅ Native CE build complete"

# Build ENT for native platform
build-native-ent: ent-link build-frontend build-docs
	@if [ ! -f enterprise/.git ]; then \
		echo "❌ ERROR: Enterprise submodule not initialized."; \
		echo "Run: make init-enterprise"; \
		exit 1; \
	fi
	@echo "🔨 Building ENT for native platform with CGO..."
	@mkdir -p bin
	$(ENT_GOWORK) CGO_ENABLED=1 go build -tags enterprise $(DEV_LDFLAGS) -o bin/midsommar-ent
	cd microgateway && $(MAKE) build-enterprise
	cp microgateway/dist/microgateway-ent bin/mgw-ent
	chmod +x bin/*
	@echo "✅ Native ENT build complete"

# ============================================================================
# Production Builds (multi-platform, optimized, CGO enabled)
# ============================================================================

# Build production artifacts for all platforms (auto-detect edition)
build-prod: ent-link build-frontend
	@echo "🏗️  Building production $(EDITION) artifacts..."
	@mkdir -p bin
	$(MAKE) build-linux-amd64 EDITION=$(EDITION) BUILD_TAGS="$(BUILD_TAGS)"
	$(MAKE) build-linux-arm64 EDITION=$(EDITION) BUILD_TAGS="$(BUILD_TAGS)"
	$(MAKE) build-darwin-amd64 EDITION=$(EDITION) BUILD_TAGS="$(BUILD_TAGS)"
	$(MAKE) build-darwin-arm64 EDITION=$(EDITION) BUILD_TAGS="$(BUILD_TAGS)"
	cd microgateway && $(MAKE) build-prod EDITION=$(EDITION)
	cp microgateway/dist/microgateway-$(EDITION)-linux-amd64 bin/mgw-$(EDITION)-linux-amd64 2>/dev/null || true
	cp microgateway/dist/microgateway-$(EDITION)-linux-arm64 bin/mgw-$(EDITION)-linux-arm64 2>/dev/null || true
	cp microgateway/dist/microgateway-$(EDITION)-darwin-amd64 bin/mgw-$(EDITION)-darwin-amd64 2>/dev/null || true
	cp microgateway/dist/microgateway-$(EDITION)-darwin-arm64 bin/mgw-$(EDITION)-darwin-arm64 2>/dev/null || true
	chmod +x bin/* 2>/dev/null || true
	@echo "✅ Production build complete"

# Build production CE for all platforms
build-prod-ce: build-frontend
	@echo "🏗️  Building production CE artifacts..."
	@mkdir -p bin
	$(MAKE) build-linux-amd64 EDITION=ce BUILD_TAGS=""
	$(MAKE) build-linux-arm64 EDITION=ce BUILD_TAGS=""
	$(MAKE) build-darwin-amd64 EDITION=ce BUILD_TAGS=""
	$(MAKE) build-darwin-arm64 EDITION=ce BUILD_TAGS=""
	cd microgateway && $(MAKE) build-prod-ce
	cp microgateway/dist/microgateway-ce-linux-amd64 bin/mgw-ce-linux-amd64 2>/dev/null || true
	cp microgateway/dist/microgateway-ce-linux-arm64 bin/mgw-ce-linux-arm64 2>/dev/null || true
	cp microgateway/dist/microgateway-ce-darwin-amd64 bin/mgw-ce-darwin-amd64 2>/dev/null || true
	cp microgateway/dist/microgateway-ce-darwin-arm64 bin/mgw-ce-darwin-arm64 2>/dev/null || true
	chmod +x bin/* 2>/dev/null || true
	@echo "✅ Production CE build complete"

# Build production ENT for all platforms
build-prod-ent: ent-link build-frontend
	@if [ ! -f enterprise/.git ]; then \
		echo "❌ ERROR: Enterprise submodule not initialized."; \
		echo "Run: make init-enterprise"; \
		exit 1; \
	fi
	@echo "🏗️  Building production ENT artifacts..."
	@mkdir -p bin
	$(MAKE) build-linux-amd64 EDITION=ent BUILD_TAGS="-tags enterprise"
	$(MAKE) build-linux-arm64 EDITION=ent BUILD_TAGS="-tags enterprise"
	$(MAKE) build-darwin-amd64 EDITION=ent BUILD_TAGS="-tags enterprise"
	$(MAKE) build-darwin-arm64 EDITION=ent BUILD_TAGS="-tags enterprise"
	cd microgateway && $(MAKE) build-prod-ent
	cp microgateway/dist/microgateway-ent-linux-amd64 bin/mgw-ent-linux-amd64 2>/dev/null || true
	cp microgateway/dist/microgateway-ent-linux-arm64 bin/mgw-ent-linux-arm64 2>/dev/null || true
	cp microgateway/dist/microgateway-ent-darwin-amd64 bin/mgw-ent-darwin-amd64 2>/dev/null || true
	cp microgateway/dist/microgateway-ent-darwin-arm64 bin/mgw-ent-darwin-arm64 2>/dev/null || true
	chmod +x bin/* 2>/dev/null || true
	@echo "✅ Production ENT build complete"

# ============================================================================
# Platform-Specific Builds (CGO enabled)
# ============================================================================

# Linux AMD64 with CGO
build-linux-amd64: ent-link
	@echo "Building midsommar $(EDITION) for linux/amd64 with CGO..."
	CGO_ENABLED=1 GOOS=linux GOARCH=amd64 \
	$(call root_gowork,$(BUILD_TAGS)) go build $(BUILD_TAGS) $(PROD_LDFLAGS) \
	-o bin/midsommar-$(EDITION)-linux-amd64

# Linux ARM64 with CGO (requires cross-compiler)
build-linux-arm64: ent-link
	@echo "Building midsommar $(EDITION) for linux/arm64 with CGO..."
	@if ! which aarch64-linux-gnu-gcc > /dev/null 2>&1; then \
		echo "⚠️  Warning: aarch64-linux-gnu-gcc not found"; \
		echo "   Install: sudo apt-get install gcc-aarch64-linux-gnu (Ubuntu/Debian)"; \
		echo "   Or: brew install FiloSottile/musl-cross/musl-cross (macOS)"; \
		echo "   Attempting build anyway..."; \
	fi
	CGO_ENABLED=1 GOOS=linux GOARCH=arm64 \
	CC=aarch64-linux-gnu-gcc \
	$(call root_gowork,$(BUILD_TAGS)) go build $(BUILD_TAGS) $(PROD_LDFLAGS) \
	-o bin/midsommar-$(EDITION)-linux-arm64

# Darwin AMD64 with CGO
build-darwin-amd64: ent-link
	@echo "Building midsommar $(EDITION) for darwin/amd64 with CGO..."
	CGO_ENABLED=1 GOOS=darwin GOARCH=amd64 \
	$(call root_gowork,$(BUILD_TAGS)) go build $(BUILD_TAGS) $(PROD_LDFLAGS) \
	-o bin/midsommar-$(EDITION)-darwin-amd64

# Darwin ARM64 with CGO
build-darwin-arm64: ent-link
	@echo "Building midsommar $(EDITION) for darwin/arm64 with CGO..."
	CGO_ENABLED=1 GOOS=darwin GOARCH=arm64 \
	$(call root_gowork,$(BUILD_TAGS)) go build $(BUILD_TAGS) $(PROD_LDFLAGS) \
	-o bin/midsommar-$(EDITION)-darwin-arm64

# ============================================================================
# FIPS 140-3 Builds (Go Cryptographic Module v1.0.0, CMVP #5247)
# ============================================================================
# GOFIPS140 pins the frozen, CMVP-validated module; the binaries default to
# fips140=on. The fips tag is Tyk's marker for FIPS builds. Each binary is
# checked with scripts/fips-verify.sh. Release packages come from goreleaser
# (ci/goreleaser/*.yml, fips-* build ids).

FIPS_GOFIPS140 := v1.0.0
comma := ,
FIPS_TAGS = -tags $(if $(filter ent,$(EDITION)),fips$(comma)enterprise,fips)

.PHONY: build-fips build-linux-amd64-fips build-linux-arm64-fips

# Build FIPS Studio and microgateway binaries for the native platform
build-fips: ent-link build-frontend build-docs
	@echo "🔐 Building FIPS $(EDITION) for native platform..."
	@mkdir -p bin
	$(call root_gowork,$(FIPS_TAGS)) GOFIPS140=$(FIPS_GOFIPS140) CGO_ENABLED=1 go build $(FIPS_TAGS) $(PROD_LDFLAGS) -o bin/midsommar-$(EDITION)-fips
	scripts/fips-verify.sh --edition $(EDITION) --fips bin/midsommar-$(EDITION)-fips
	cd microgateway && $(MAKE) build-fips EDITION=$(EDITION)
	cp microgateway/dist/microgateway-$(EDITION)-fips bin/mgw-$(EDITION)-fips
	@echo "✅ FIPS build complete: bin/midsommar-$(EDITION)-fips and bin/mgw-$(EDITION)-fips"

# Linux AMD64 FIPS with CGO
build-linux-amd64-fips: ent-link
	@mkdir -p bin
	GOFIPS140=$(FIPS_GOFIPS140) CGO_ENABLED=1 GOOS=linux GOARCH=amd64 \
	$(call root_gowork,$(FIPS_TAGS)) go build $(FIPS_TAGS) $(PROD_LDFLAGS) \
	-o bin/midsommar-$(EDITION)-fips-linux-amd64
	scripts/fips-verify.sh --edition $(EDITION) --fips bin/midsommar-$(EDITION)-fips-linux-amd64

# Linux ARM64 FIPS with CGO (requires cross-compiler)
build-linux-arm64-fips: ent-link
	@mkdir -p bin
	GOFIPS140=$(FIPS_GOFIPS140) CGO_ENABLED=1 GOOS=linux GOARCH=arm64 \
	CC=aarch64-linux-gnu-gcc \
	$(call root_gowork,$(FIPS_TAGS)) go build $(FIPS_TAGS) $(PROD_LDFLAGS) \
	-o bin/midsommar-$(EDITION)-fips-linux-arm64
	scripts/fips-verify.sh --edition $(EDITION) --fips bin/midsommar-$(EDITION)-fips-linux-arm64

# ============================================================================
# Backward Compatibility Targets
# ============================================================================

# Build for local development (alias for build-native)
build-local: build-native

# Legacy build-community (now uses explicit CGO builds)
build-community: build-prod-ce
	@echo "Note: build-community now builds production artifacts with CGO"
	@echo "For quick local builds, use: make build-native-ce"

# Legacy build-enterprise (now uses explicit CGO builds)
build-enterprise: build-prod-ent
	@echo "Note: build-enterprise now builds production artifacts with CGO"
	@echo "For quick local builds, use: make build-native-ent"

# ============================================================================
# Package Building (RPM/DEB using GoReleaser + nfpm)
# ============================================================================
# These targets use the SAME GoReleaser configs and Docker image as CI,
# ensuring local packages are identical to release packages.
#
# Builds run inside the tykio/golang-cross Docker container (same as CI)
# because CGO cross-compilation requires Linux cross-compiler toolchains.
#
# Prerequisites:
#   Docker must be running
#
# Usage:
#   make package                    Build all packages (auto-detect edition)
#   make package-studio             Build AI Studio packages only
#   make package-microgateway       Build Microgateway packages only
#   make package-ce                 Build CE packages for both components
#   make package-ent                Build ENT packages for both components
# ============================================================================

GOLANG_CROSS_IMAGE ?= tykio/golang-cross:1.26-bullseye
GORELEASER_FLAGS ?= --snapshot --skip=sign --skip=publish --clean

# Internal helper: run goreleaser inside the cross-compilation Docker container.
# Usage: $(call run_goreleaser,<goreleaser-config>,<goflags>)
# EDITION (ent when the goflags carry the enterprise tag, else ce) names the
# packages: the goreleaser templates add -ee for ent.
# This matches CI exactly: same image, same env vars, same goreleaser invocation.
# NOTE: does NOT use --clean to allow building both components into the same dist/.
# Use `make clean-dist` to reset before a fresh build.
# The container runs as root and the checkout belongs to the host user, so
# git refuses it ("dubious ownership") and goreleaser and Go's VCS stamping
# fail: mark it safe, as release.yml's build script does.
define run_goreleaser
	docker run --rm --platform linux/amd64 \
		-e CGO_ENABLED=1 \
		-e GOFLAGS='$(2)' \
		-e EDITION='$(if $(findstring enterprise,$(2)),ent,ce)' \
		-e PACKAGECLOUD_REPO=local/dev \
		-e DEBVERS='unused' \
		-e RPMVERS='unused' \
		-e GOCACHE=/cache/go-build \
		-e GOMODCACHE=/go/pkg/mod \
		-v $(CURDIR):/go/src/github.com/TykTechnologies/midsommar \
		-v $(HOME)/go/pkg/mod:/go/pkg/mod \
		-v $(HOME)/.cache/go-build:/cache/go-build \
		-w /go/src/github.com/TykTechnologies/midsommar \
		$(GOLANG_CROSS_IMAGE) \
		sh -c 'git config --global --add safe.directory /go/src/github.com/TykTechnologies/midsommar && \
			goreleaser release -f $(1) $(GORELEASER_FLAGS)'
endef

# merge_staging copies the studio packages saved in .dist-staging/ back into
# dist/ after the microgateway run. goreleaser writes dist/ as root inside
# the container, so on Linux hosts and CI runners the user cannot write to
# it: copy through the same container.
define merge_staging
	docker run --rm --platform linux/amd64 \
		-v $(CURDIR):/go/src/github.com/TykTechnologies/midsommar \
		-w /go/src/github.com/TykTechnologies/midsommar \
		$(GOLANG_CROSS_IMAGE) \
		sh -c 'cp .dist-staging/* dist/'
endef

clean-dist:
	rm -rf dist/

.PHONY: package package-studio package-microgateway package-ce package-ent
.PHONY: package-studio-ce package-studio-ent package-microgateway-ce package-microgateway-ent
.PHONY: package-help test-package-smoke test-package-smoke-ent

# Build all packages for current edition
package: clean-dist package-studio package-microgateway
	@echo "✅ All packages built in dist/"
	@ls -la dist/*.deb dist/*.rpm 2>/dev/null || echo "No packages found"

# Build AI Studio packages (current edition)
package-studio: build-frontend build-docs
	@echo "📦 Building AI Studio $(EDITION) packages..."
	$(call run_goreleaser,ci/goreleaser/goreleaser.yml,$(BUILD_TAGS))
	@echo "✅ AI Studio packages:"
	@ls -la dist/tyk-ai-studio*.deb dist/tyk-ai-studio*.rpm 2>/dev/null

# Build Microgateway packages (current edition)
package-microgateway:
	@echo "📦 Building Microgateway $(EDITION) packages..."
	$(call run_goreleaser,ci/goreleaser/goreleaser-microgateway.yml,$(BUILD_TAGS))
	@echo "✅ Microgateway packages:"
	@ls -la dist/tyk-microgateway*.deb dist/tyk-microgateway*.rpm 2>/dev/null

# CE variants
# GoReleaser uses --clean which wipes dist/ each run. For combined builds,
# we save studio packages to .dist-staging/ (outside dist/) then merge after mgw build.
package-ce: build-frontend build-docs
	@echo "📦 Building all CE packages..."
	$(call run_goreleaser,ci/goreleaser/goreleaser.yml,)
	@mkdir -p .dist-staging && cp dist/*.deb dist/*.rpm .dist-staging/ 2>/dev/null || true
	$(call run_goreleaser,ci/goreleaser/goreleaser-microgateway.yml,)
	$(call merge_staging)
	@rm -rf .dist-staging
	@echo "✅ CE packages:"
	@ls dist/*.deb dist/*.rpm 2>/dev/null

# ENT variants
package-ent: build-frontend build-docs
	@if [ ! -f enterprise/.git ]; then \
		echo "❌ ERROR: Enterprise submodule not initialized. Run: make init-enterprise"; \
		exit 1; \
	fi
	@echo "📦 Building all ENT packages..."
	$(call run_goreleaser,ci/goreleaser/goreleaser.yml,-tags=enterprise)
	@mkdir -p .dist-staging && cp dist/*.deb dist/*.rpm .dist-staging/ 2>/dev/null || true
	$(call run_goreleaser,ci/goreleaser/goreleaser-microgateway.yml,-tags=enterprise)
	$(call merge_staging)
	@rm -rf .dist-staging
	@echo "✅ ENT packages:"
	@ls dist/*.deb dist/*.rpm 2>/dev/null

# Package smoke tests
test-package-smoke: package-ce
	@echo "🧪 Running package smoke tests (CE)..."
	docker compose -f tests/packaging/compose.yml up -d --build --wait || \
		(docker compose -f tests/packaging/compose.yml logs; docker compose -f tests/packaging/compose.yml down -v; exit 1)
	cd tests/packaging && npm ci && npx playwright install --with-deps chromium && npx playwright test --reporter=list || \
		(docker compose -f ../../tests/packaging/compose.yml logs; docker compose -f ../../tests/packaging/compose.yml down -v; exit 1)
	docker compose -f tests/packaging/compose.yml down -v
	@echo "✅ Package smoke tests passed"
	$(MAKE) test-fips-smoke

# FIPS 140-3 runtime smoke test (tests/fipssmoke) of the -fips packages in
# dist/: as the -fips container images (ci/Dockerfile*.fips.distroless) and
# as installed .debs (tests/packaging/Dockerfile.deb-smoke PACKAGES=fips).
# Run by test-package-smoke[-ent]; on its own it needs dist/ from a package
# build. FIPS_SMOKE_ARCH picks the packages (default amd64).
.PHONY: test-fips-smoke
FIPS_SMOKE_ARCH ?= amd64
test-fips-smoke:
	@echo "🧪 Running FIPS 140-3 smoke tests ($(FIPS_SMOKE_ARCH))..."
	docker build -t fips-smoke-studio:local -f ci/Dockerfile.fips.distroless --build-arg TARGETARCH=$(FIPS_SMOKE_ARCH) dist
	docker build -t fips-smoke-gateway:local -f ci/Dockerfile.microgateway.fips.distroless --build-arg TARGETARCH=$(FIPS_SMOKE_ARCH) dist
	tests/fipssmoke/run.sh image fips-smoke-studio:local fips-smoke-gateway:local
	docker build -t fips-smoke-deb:local -f tests/packaging/Dockerfile.deb-smoke --build-arg TARGETARCH=$(FIPS_SMOKE_ARCH) --build-arg PACKAGES=fips .
	tests/fipssmoke/run.sh deb fips-smoke-deb:local
	@echo "✅ FIPS smoke tests passed"

test-package-smoke-ent: package-ent
	@echo "🧪 Running package smoke tests (ENT)..."
	@# Source license from dev/.env.secrets if available
	$(eval export TYK_AI_LICENSE=$(shell grep -s '^TYK_AI_LICENSE=' dev/.env.secrets | cut -d= -f2-))
	@if [ -z "$$TYK_AI_LICENSE" ]; then \
		echo "⚠️  Warning: TYK_AI_LICENSE not set. ENT smoke tests may fail."; \
		echo "   Set it in dev/.env.secrets or export TYK_AI_LICENSE=..."; \
	fi
	docker compose -f tests/packaging/compose.yml up -d --build --wait || \
		(docker compose -f tests/packaging/compose.yml logs; docker compose -f tests/packaging/compose.yml down -v; exit 1)
	cd tests/packaging && npm ci && npx playwright install --with-deps chromium && npx playwright test --reporter=list || \
		(docker compose -f ../../tests/packaging/compose.yml logs; docker compose -f ../../tests/packaging/compose.yml down -v; exit 1)
	docker compose -f tests/packaging/compose.yml down -v
	@echo "✅ Package smoke tests passed"
	$(MAKE) test-fips-smoke

# Package help
package-help:
	@echo "Package Building Targets (all run inside Docker for cross-compilation)"
	@echo ""
	@echo "  make package                    Build all packages (auto-detect edition)"
	@echo "  make package-studio             Build AI Studio packages"
	@echo "  make package-microgateway       Build Microgateway packages"
	@echo "  make package-ce                 Build all CE packages"
	@echo "  make package-ent                Build all ENT packages"
	@echo "  make package-studio-ce          Build AI Studio CE packages"
	@echo "  make package-studio-ent         Build AI Studio ENT packages"
	@echo "  make package-microgateway-ce    Build Microgateway CE packages"
	@echo "  make package-microgateway-ent   Build Microgateway ENT packages"
	@echo "  make test-package-smoke         Build CE packages and run smoke tests"
	@echo "  make test-package-smoke-ent     Build ENT packages and run smoke tests"
	@echo ""
	@echo "Packages output to dist/ directory"
	@echo "Override Docker image: GOLANG_CROSS_IMAGE=... make package"

# Build all plugins
plugins:
	@echo "Building studio plugins..."
	@failed_plugins=""; \
	for plugin in examples/plugins/studio/*/; do \
		if [ -d "$$plugin/server" ]; then \
			plugin_name=$$(basename "$$plugin"); \
			echo "Building studio plugin: $$plugin_name"; \
			if (cd "$$plugin/server" && go build -o ../$$plugin_name); then \
				echo "  ✓ Successfully built $$plugin_name"; \
			else \
				echo "  ✗ Failed to build $$plugin_name"; \
				failed_plugins="$$failed_plugins $$plugin_name"; \
			fi; \
		fi; \
	done; \
	echo "Building gateway plugins..."; \
	for plugin in examples/plugins/gateway/*/; do \
		if [ -f "$$plugin/main.go" ]; then \
			plugin_name=$$(basename "$$plugin"); \
			echo "Building gateway plugin: $$plugin_name"; \
			if (cd microgateway && go build -o "../$$plugin/$$plugin_name" "../$$plugin"); then \
				echo "  ✓ Successfully built $$plugin_name"; \
			else \
				echo "  ✗ Failed to build $$plugin_name"; \
				failed_plugins="$$failed_plugins $$plugin_name"; \
			fi; \
		fi; \
	done; \
	if [ -n "$$failed_plugins" ]; then \
		echo ""; \
		echo "⚠️  Some plugins failed to build:$$failed_plugins"; \
		echo "The following plugins built successfully can be used."; \
	else \
		echo ""; \
		echo "✅ All plugins built successfully!"; \
	fi

# ============================================================================
# Plugin Scaffolding
# ============================================================================
# Usage:
#   make plugin-new NAME=my-plugin TYPE=studio
#   make plugin-new NAME=my-plugin TYPE=studio CAPABILITIES=studio_ui,post_auth,on_response
#   make plugin-new NAME=my-enricher TYPE=gateway
#   make plugin-new NAME=my-assistant TYPE=agent
#   make plugin-help

.PHONY: plugin-new plugin-help tools

# Build all development tools
tools: bin/plugin-scaffold
	@echo "✅ Development tools built successfully"
	@echo "   - bin/plugin-scaffold (plugin scaffolding)"

# Build the scaffolding tool (rebuilds only if source changes)
bin/plugin-scaffold: $(wildcard cmd/plugin-scaffold/*.go)
	@echo "Building plugin-scaffold tool..."
	@mkdir -p bin
	@go build -o bin/plugin-scaffold ./cmd/plugin-scaffold

# Scaffold a new plugin
plugin-new: bin/plugin-scaffold
	@if [ -z "$(NAME)" ] || [ -z "$(TYPE)" ]; then \
		echo "Usage: make plugin-new NAME=my-plugin TYPE=studio|gateway|agent|data-collector [CAPABILITIES=cap1,cap2]"; \
		echo ""; \
		echo "Run 'make plugin-help' for more information."; \
		exit 1; \
	fi
	@./bin/plugin-scaffold -name="$(NAME)" -type="$(TYPE)" -capabilities="$(CAPABILITIES)"

# Show plugin scaffolding help
plugin-help: bin/plugin-scaffold
	@./bin/plugin-scaffold -help

# ============================================================================
# Schema snapshots
# ============================================================================
.PHONY: schema-golden
schema-golden: ## Regenerate the schema snapshot goldens (SQLite + postgres:16 in Docker) after a model change
	@scripts/schema-golden.sh

# ============================================================================
# API docs
# ============================================================================
.PHONY: swagger
SWAG_VERSION ?= v1.16.4
swagger: ## Regenerate docs/swagger from the handler annotations (general info in api/api.go)
	@go run github.com/swaggo/swag/cmd/swag@$(SWAG_VERSION) init -g api/api.go -o docs/swagger --overridesFile docs/swagger/.swaggo

# ============================================================================
# gorm: AI Studio's own copy (see third_party/README.md)
# ============================================================================
.PHONY: gorm-vendor gorm-verify
gorm-vendor: ## Rebuild third_party/gorm.io from the pins in third_party/gorm-pin/go.mod
	@scripts/gorm-vendor.sh

gorm-verify: ## Check third_party/gorm.io matches its pins and nothing imports gorm.io
	@scripts/gorm-verify.sh

.PHONY: vet
vet: ent-link ## go vet the root, microgateway and enterprise modules in both editions, excluding third_party/ (VET_EDITION=ce|ent|all)
	@scripts/vet.sh $(or $(VET_EDITION),all)

.PHONY: ent-link
ent-link: ## Link enterprise tests and registrations of core packages in from enterprise/_coretests (no-op without the submodule)
	@scripts/enterprise-link-tests.sh

.PHONY: tidy
tidy: ## go mod tidy the root module (unlinks the enterprise files first, which tidy cannot resolve, and relinks them)
	@scripts/enterprise-link-tests.sh --unlink
	GOWORK=off go mod tidy
	@scripts/enterprise-link-tests.sh

.PHONY: sdk-consumer-check
sdk-consumer-check: ## Check a plugin importing the SDK resolves its whole module graph from the public Go proxy
	@scripts/sdk-consumer-check.sh

.PHONY: agent-tracing-docs agent-tracing-docs-verify
agent-tracing-docs: ## Regenerate the OTel attribute tables in docs/site/docs/agent-tracing.md from the enterprise mapping profile
	@cd enterprise && UPDATE_DOCS=1 go test -tags enterprise -count=1 -run TestAttributeTableDocInSync ./features/agenttracing/otelexport/

agent-tracing-docs-verify: ## Check those tables match the mapping profile (no-op without the enterprise submodule)
	@if [ -d enterprise/features/agenttracing/otelexport ]; then \
		cd enterprise && go test -tags enterprise -count=1 -run TestAttributeTableDocInSync ./features/agenttracing/otelexport/; \
	else echo "agent-tracing-docs-verify: no enterprise submodule, skipped"; fi

.PHONY: enterprise-import-guard
enterprise-import-guard: ## Check no public package imports the private enterprise module
	@scripts/enterprise-import-guard.sh

.PHONY: fips-guard
fips-guard: ## Check first-party Go code adds no non-FIPS-approved crypto (allowlist: scripts/fips-guard.allowlist)
	@scripts/fips-guard.sh --self-test
	@scripts/fips-guard.sh

.PHONY: logging-guard
logging-guard: ## Check the control-plane packages log only through the logger package (an embedding host's logger)
	@scripts/logging-guard.sh

.PHONY: langchaingo-verify
langchaingo-verify: ## Check nothing builds with upstream github.com/tmc/langchaingo (use third_party/langchaingo)
	@scripts/langchaingo-verify.sh

# PLUGIN_MOD_ROOTS limits the directories searched (default: examples,
# enterprise/plugins, community/plugins, tyk-internal/plugins where present).
.PHONY: plugins-mod-check
plugins-mod-check: ## Check every in-repo plugin module's go.mod is tidy against this tree (PLUGIN_MOD_BUILD=1 also builds them)
	@scripts/plugins-mod-check.sh $(if $(PLUGIN_MOD_BUILD),--build) $(PLUGIN_MOD_ROOTS)

# ============================================================================
# Plugin Release (build -> sign -> push -> marketplace index entry)
# ============================================================================
# One command takes a plugin from source to a signed, indexed marketplace
# release.  The version comes from the plugin's manifest.json and is used
# verbatim as the OCI tag, and the digest written into the marketplace entry is
# read back from the registry - so the tag, the binary and the index entry
# cannot drift apart.
#
# Usage:
#   make plugin-publish NAME=llm-cache SIGN_KEY=~/keys/plugin-ci.key
#   make plugin-publish NAME=llm-cache DRY_RUN=1        # print the plan, push nothing
#   make plugin-publish NAME=llm-cache YES=1            # no confirmation prompt (CI)
#   make plugin-publish NAME=llm-cache NO_PUSH=1        # commit the entry, don't push it
#   make plugin-verify  NAME=llm-cache [VERSION=1.0.1] PUB_KEY=~/keys/plugin-ci.pub
#
# Variables: NAME (required), VERSION, REG, PLATFORMS, SIGN_KEY, PUB_KEY,
#            MIN_STUDIO_VERSION, DRY_RUN, YES, NO_PUSH, FORCE, SKIP_SIGN,
#            SKIP_UI, SKIP_MARKETPLACE
#
# Full guide: docs/site/docs/plugins-publishing.md

.PHONY: plugin-publish plugin-verify

# This Makefile defines its own VERSION (the git describe of the platform), so
# only forward VERSION to the script when it was set on the command line - and
# blank it in the recipe environment so the platform version can never be
# mistaken for a plugin version.
PLUGIN_VERSION_FLAG :=
ifeq ($(origin VERSION),command line)
PLUGIN_VERSION_FLAG := --version "$(VERSION)"
endif

plugin-publish:
	@if [ -z "$(NAME)" ]; then \
		echo "Usage: make plugin-publish NAME=<plugin> [VERSION=x.y.z] SIGN_KEY=/path/to/plugin-ci.key"; \
		echo ""; \
		echo "Plugins are looked up under community/plugins, enterprise/plugins,"; \
		echo "tyk-internal/plugins and examples/plugins."; \
		echo "Add DRY_RUN=1 to see the full plan without pushing anything."; \
		echo ""; \
		echo "Full guide: docs/site/docs/plugins-publishing.md"; \
		echo "All flags:  ./tools/publish-plugin.sh --help"; \
		exit 1; \
	fi
	@env VERSION= ./tools/publish-plugin.sh publish "$(NAME)" $(PLUGIN_VERSION_FLAG)

plugin-verify:
	@if [ -z "$(NAME)" ]; then \
		echo "Usage: make plugin-verify NAME=<plugin>|all [VERSION=x.y.z] [PUB_KEY=/path/to/plugin-ci.pub]"; \
		echo ""; \
		echo "NAME=all audits every published entry in both marketplace repos."; \
		echo "Full guide: docs/site/docs/plugins-publishing.md"; \
		exit 1; \
	fi
	@env VERSION= ./tools/publish-plugin.sh verify "$(NAME)" $(PLUGIN_VERSION_FLAG)

# Test target (legacy - use test-all for more control)
test: ent-link
	$(call root_gowork,$(BUILD_TAGS)) go test $(BUILD_TAGS) ./...
	cd microgateway && go test $(BUILD_TAGS) ./...

# ============================================================================
# Unified Testing System
# ============================================================================
# Usage:
#   make test-all                           # Run unit + integration tests (auto-detect edition)
#   make test-all EDITION=ent               # Run with enterprise edition
#   make test-quick                         # Unit tests only (fast feedback)
#   make test-ci                            # CI tests with coverage
#   make test-all TEST_COMPONENTS="studio"  # Test only studio
#   make test-all TEST_TYPES="unit"         # Unit tests only
#
# Components: studio, microgateway, frontend, plugins
# Types: unit, integration, e2e
# Editions: ce, ent

# Test configuration variables (can be overridden)
TEST_COMPONENTS ?= studio microgateway frontend plugins enterprise
TEST_TYPES ?= unit integration
TEST_EDITION ?= $(EDITION)
TEST_VERBOSE ?= false
TEST_COVERAGE ?= false
TEST_TIMEOUT ?= 30m

# Determine build tags based on edition
ifeq ($(TEST_EDITION),ent)
    TEST_BUILD_TAGS := -tags enterprise
else
    TEST_BUILD_TAGS :=
endif

# Verbose flag
ifeq ($(TEST_VERBOSE),true)
    TEST_VERBOSE_FLAG := -v
else
    TEST_VERBOSE_FLAG :=
endif

# Coverage flag
ifeq ($(TEST_COVERAGE),true)
    TEST_COVERAGE_FLAG := -coverprofile=coverage.out -covermode=atomic
else
    TEST_COVERAGE_FLAG :=
endif

# Primary unified test target
.PHONY: test-all
test-all: ## Run all tests with configurable options
	@echo "=========================================="
	@echo "Tyk AI Studio Unified Test Suite"
	@echo "=========================================="
	@echo "Edition:    $(TEST_EDITION)"
	@echo "Components: $(TEST_COMPONENTS)"
	@echo "Types:      $(TEST_TYPES)"
	@echo "Timeout:    $(TEST_TIMEOUT)"
	@echo "=========================================="
	@failed=0; \
	for component in $(TEST_COMPONENTS); do \
		for type in $(TEST_TYPES); do \
			target="test-$${component}-$${type}"; \
			if $(MAKE) -n $$target > /dev/null 2>&1; then \
				echo ""; \
				echo ">>> Running: $$target"; \
				if ! $(MAKE) $$target TEST_EDITION=$(TEST_EDITION) TEST_VERBOSE=$(TEST_VERBOSE) TEST_COVERAGE=$(TEST_COVERAGE) TEST_TIMEOUT=$(TEST_TIMEOUT); then \
					echo "FAILED: $$target"; \
					failed=1; \
				fi; \
			fi; \
		done; \
	done; \
	if [ $$failed -eq 1 ]; then \
		echo ""; \
		echo "=========================================="; \
		echo "SOME TESTS FAILED"; \
		echo "=========================================="; \
		exit 1; \
	fi; \
	echo ""; \
	echo "=========================================="; \
	echo "ALL TESTS PASSED"; \
	echo "=========================================="

.PHONY: test-quick
test-quick: ## Run only unit tests (fast feedback)
	$(MAKE) test-all TEST_TYPES="unit" TEST_COMPONENTS="studio microgateway frontend"

.PHONY: test-fips
test-fips: ent-link ## Run the Go unit tests in FIPS 140-3 strict mode (GOFIPS140=v1.0.0 GODEBUG=fips140=only; EDITION=ent adds the enterprise module)
	@scripts/test-fips.sh $(TEST_EDITION)

.PHONY: test-ci
test-ci: ## Run CI-appropriate tests (unit + integration, with coverage)
	$(MAKE) test-all TEST_TYPES="unit integration" TEST_COVERAGE=true TEST_VERBOSE=true

# ============================================================================
# AI Studio Tests
# ============================================================================

.PHONY: test-studio-unit
test-studio-unit: ent-link ## Run AI Studio unit tests
	@echo "Running AI Studio unit tests ($(TEST_EDITION))..."
	$(call root_gowork,$(TEST_BUILD_TAGS)) go test $(TEST_BUILD_TAGS) $(TEST_VERBOSE_FLAG) $(TEST_COVERAGE_FLAG) \
		-timeout $(TEST_TIMEOUT) -race -short ./...

.PHONY: test-studio-integration
test-studio-integration: ent-link ## Run AI Studio integration tests
	@echo "Running AI Studio integration tests ($(TEST_EDITION))..."
	$(call root_gowork,$(TEST_BUILD_TAGS)) go test $(TEST_BUILD_TAGS) $(TEST_VERBOSE_FLAG) \
		-timeout $(TEST_TIMEOUT) -count=1 ./tests/...

# ============================================================================
# Microgateway Tests
# ============================================================================

.PHONY: test-microgateway-unit
test-microgateway-unit: ## Run Microgateway unit tests
	@echo "Running Microgateway unit tests ($(TEST_EDITION))..."
	cd microgateway && go test $(TEST_BUILD_TAGS) $(TEST_VERBOSE_FLAG) \
		-timeout $(TEST_TIMEOUT) -race -short ./...

.PHONY: test-microgateway-integration
test-microgateway-integration: ## Run Microgateway integration tests
	@echo "Running Microgateway integration tests ($(TEST_EDITION))..."
	cd microgateway && go test $(TEST_BUILD_TAGS) $(TEST_VERBOSE_FLAG) \
		-timeout $(TEST_TIMEOUT) -count=1 ./tests/integration/...

# ============================================================================
# Live Vendor Conformance Tests
# ============================================================================
#
# Calls REAL LLM vendors and spends REAL money. Gated twice over -- the
# `vendorlive` build tag AND VENDOR_TESTS_ENABLED=true -- so it can never be
# picked up by `go test ./...`, `make test-all` or CI by accident.
#
# Setup:   cp test-secrets/vendors.env.example test-secrets/vendors.env
#          $EDITOR test-secrets/vendors.env
# Design:  features/VendorConformance.md
#
# Filters (all optional, comma separated):
#   VENDORS=openai,anthropic     SURFACES=shim,universal     SCENARIOS=tools

VENDOR_TEST_TIMEOUT ?= 30m

.PHONY: test-vendors
test-vendors: ## Run live vendor conformance tests (needs test-secrets/vendors.env)
	@if [ ! -f test-secrets/vendors.env ]; then \
		echo "test-secrets/vendors.env not found."; \
		echo "  cp test-secrets/vendors.env.example test-secrets/vendors.env"; \
		exit 1; \
	fi
	@echo "Running live vendor conformance tests (gateway surfaces)..."
	cd microgateway && VENDOR_TESTS_VENDORS="$(VENDORS)" \
		VENDOR_TESTS_SURFACES="$(SURFACES)" \
		VENDOR_TESTS_SCENARIOS="$(SCENARIOS)" \
		go test -tags vendorlive -v -count=1 \
		-timeout $(VENDOR_TEST_TIMEOUT) ./tests/vendorconformance/...

.PHONY: test-vendors-preflight
test-vendors-preflight: ## Verify vendor credentials and model IDs without spending on completions
	cd microgateway && VENDOR_TESTS_VENDORS="$(VENDORS)" \
		go test -tags vendorlive -v -count=1 \
		-timeout 5m -run 'TestPreflight' ./tests/vendorconformance/...

.PHONY: test-vendors-update-golden
test-vendors-update-golden: ## Refresh golden envelope snapshots
	cd microgateway && VENDOR_TESTS_UPDATE_GOLDEN=true \
		VENDOR_TESTS_VENDORS="$(VENDORS)" \
		go test -tags vendorlive -v -count=1 \
		-timeout $(VENDOR_TEST_TIMEOUT) ./tests/vendorconformance/...

.PHONY: test-vendors-filters
test-vendors-filters: ## Live check that request filters run on the Bedrock /ai/ and /anthropic/ paths (needs Bedrock credentials; enterprise scripting)
	cd microgateway && VENDOR_TESTS_VENDORS=bedrock \
		go test -tags "vendorlive enterprise" -v -count=1 \
		-timeout 15m -run 'TestBedrockRequestFilters' ./tests/vendorconformance/...

# Decision models (OpenAI /v1/decisions, System One / TypeSafe Jev / llama.cpp)
# through the shim, sdk and universal surfaces: schemas, translation, errors,
# equivalence and analytics. Needs VT_OPENAI_MODEL_DECISION and/or VT_SYSTEMONE_*.
#   VENDORS=openai,systemone   SURFACES=shim,universal   (both optional)
.PHONY: test-vendors-decisions
test-vendors-decisions: ## Live decision-model conformance (needs VT_OPENAI_MODEL_DECISION or VT_SYSTEMONE_* in test-secrets/vendors.env)
	cd microgateway && VENDOR_TESTS_VENDORS="$(VENDORS)" \
		VENDOR_TESTS_SURFACES="$(SURFACES)" \
		go test -tags vendorlive -v -count=1 \
		-timeout 15m -run 'TestPreflightDecision|TestDecision' ./tests/vendorconformance/...

.PHONY: test-vendors-harness
test-vendors-harness: ## Run the credential-free unit tests that protect the conformance harness itself
	go test -count=1 ./pkg/testinfra/vendorconformance/...

# Guardrail provider conformance: drives every configured guardrail provider
# (Lakera, Azure Content Safety, Azure Language PII, Presidio, Bedrock
# Guardrails, a generic HTTP classifier) against the real service, directly and
# then through the data plane as filters on a real vendor route.
#   GUARDRAILS=lakera,azure_cs    VENDORS=openai   (both optional)

.PHONY: test-guardrails
test-guardrails: ent-link ## Live guardrail provider conformance (needs VT_GUARD_* in test-secrets/vendors.env; enterprise)
	@if [ ! -f test-secrets/vendors.env ]; then \
		echo "test-secrets/vendors.env not found."; \
		echo "  cp test-secrets/vendors.env.example test-secrets/vendors.env"; \
		exit 1; \
	fi
	@echo "Running guardrail provider conformance (direct provider calls)..."
	VENDOR_TESTS_GUARDRAILS="$(GUARDRAILS)" \
		$(ENT_GOWORK) go test -tags "vendorlive enterprise" -v -count=1 \
		-timeout 15m ./tests/guardrailconformance/...
	@echo "Running guardrail filters through the data plane..."
	cd microgateway && VENDOR_TESTS_VENDORS="$(VENDORS)" \
		VENDOR_TESTS_GUARDRAILS="$(GUARDRAILS)" \
		go test -tags "vendorlive enterprise" -v -count=1 \
		-timeout 15m -run 'TestGuardrail' ./tests/vendorconformance/...

.PHONY: test-guardrails-preflight
test-guardrails-preflight: ent-link ## Verify guardrail provider credentials with one benign probe each
	VENDOR_TESTS_GUARDRAILS="$(GUARDRAILS)" \
		$(ENT_GOWORK) go test -tags "vendorlive enterprise" -v -count=1 \
		-timeout 5m -run 'TestGuardrailPreflight' ./tests/guardrailconformance/...

# ============================================================================
# Frontend Tests
# ============================================================================

.PHONY: test-frontend-unit
test-frontend-unit: ## Run frontend Jest tests
	@echo "Running frontend unit tests..."
	cd ui/admin-frontend && npm test

# ============================================================================
# Plugin Tests
# ============================================================================

.PHONY: test-plugins-unit
test-plugins-unit: ## Run plugin unit tests (all community + enterprise plugin modules)
	@echo "Running plugin unit tests ($(TEST_EDITION))..."
	@failed=""; \
	for mod in $$(find community/plugins -name go.mod 2>/dev/null | sort); do \
		dir=$$(dirname $$mod); \
		echo ""; echo ">>> $$dir"; \
		( cd $$dir && go test $(TEST_VERBOSE_FLAG) -timeout $(TEST_TIMEOUT) ./... ) \
			|| failed="$$failed $$dir"; \
	done; \
	if [ "$(TEST_EDITION)" = "ent" ]; then \
		for mod in $$(find enterprise/plugins -name go.mod 2>/dev/null | sort); do \
			dir=$$(dirname $$mod); \
			echo ""; echo ">>> $$dir (enterprise)"; \
			( cd $$dir && go test -tags enterprise $(TEST_VERBOSE_FLAG) -timeout $(TEST_TIMEOUT) ./... ) \
				|| failed="$$failed $$dir"; \
		done; \
	else \
		echo "Skipping enterprise plugin unit tests (set EDITION=ent to enable)"; \
	fi; \
	if [ -n "$$failed" ]; then \
		echo ""; echo "FAILED plugin modules:$$failed"; exit 1; \
	fi

# ============================================================================
# Enterprise Module Tests
# ============================================================================

.PHONY: test-enterprise-unit
test-enterprise-unit: ## Run enterprise module unit tests (features/, scripting/, ...)
	@if [ "$(TEST_EDITION)" != "ent" ] || [ ! -f enterprise/go.mod ]; then \
		echo "Skipping enterprise module unit tests (set EDITION=ent to enable)"; \
		exit 0; \
	fi; \
	echo "Running enterprise module unit tests..."; \
	cd enterprise && go test -tags enterprise $(TEST_VERBOSE_FLAG) -timeout $(TEST_TIMEOUT) ./...

.PHONY: test-plugins-integration
test-plugins-integration: ## Run plugin integration tests (requires Docker)
	@if [ "$(TEST_EDITION)" != "ent" ]; then \
		echo "Skipping enterprise plugin integration tests (set EDITION=ent to enable)"; \
		exit 0; \
	fi
	@echo "Running enterprise plugin integration tests..."
	@echo ">>> advanced-llm-cache integration tests"
	cd enterprise/plugins/advanced-llm-cache && \
		go test -v -count=1 -tags="integration,enterprise" \
		-timeout $(TEST_TIMEOUT) ./tests/integration/...
	@echo ">>> llm-load-balancer integration tests"
	cd enterprise/plugins/llm-load-balancer && \
		go test -v -count=1 -tags="integration,enterprise" \
		-timeout $(TEST_TIMEOUT) ./tests/integration/...
	@echo ">>> github-rag-ingest Vault integration tests"
	@if [ -d "community/plugins/github-rag-ingest/server" ]; then \
		cd community/plugins/github-rag-ingest/server && \
		go test -v -count=1 -tags=integration -timeout $(TEST_TIMEOUT) ./secrets/... || true; \
	fi

.PHONY: test-plugins-e2e
test-plugins-e2e: ## Run plugin E2E tests (requires Docker)
	@if [ "$(TEST_EDITION)" != "ent" ]; then \
		echo "Skipping enterprise plugin e2e tests (set EDITION=ent to enable)"; \
		exit 0; \
	fi
	@echo "Running enterprise plugin E2E tests..."
	cd enterprise/plugins/llm-load-balancer && \
		go test -v -count=1 -tags="e2e,enterprise" \
		-timeout $(TEST_TIMEOUT) ./tests/e2e/...

# ============================================================================
# UI E2E Tests (Playwright)
# ============================================================================

.PHONY: test-ui-e2e
test-ui-e2e: ## Run UI E2E tests (requires Docker Compose environment)
	@echo "Running UI E2E tests..."
	@echo "Note: Requires Docker Compose test environment to be running"
	@echo "Start with: make start-test-env"
	@# Uses --workers=1 because tests share database state and will fail with race conditions if run in parallel
	cd tests/ui && npm ci && npx playwright install --with-deps chromium && npm run test:serial

.PHONY: test-ui-e2e-with-env
test-ui-e2e-with-env: ## Start test env and run UI E2E tests
	@echo "Starting test environment (postgres + studio + frontend)..."
	docker compose -f tests/compose.yml up -d --build
	@echo "Waiting for test environment to be ready..."
	@attempts=0; \
	max_attempts=120; \
	while true; do \
		backend=$$(curl -s -o /dev/null -w '%{http_code}' http://localhost:8081/login 2>/dev/null); \
		frontend=$$(curl -s -o /dev/null -w '%{http_code}' http://localhost:3000 2>/dev/null); \
		if [ "$$backend" = "200" ] && [ "$$frontend" = "200" ]; then break; fi; \
		attempts=$$((attempts+1)); \
		echo "Waiting for AI Studio (backend=$$backend frontend=$$frontend) ($$attempts/$$max_attempts)"; \
		if [ $$attempts -ge $$max_attempts ]; then \
			echo "Timed out waiting for test environment"; \
			docker compose -f tests/compose.yml logs --tail=100; \
			docker compose -f tests/compose.yml down -v; \
			exit 1; \
		fi; \
		sleep 5; \
	done
	@echo "Test environment is ready, running tests..."
	$(MAKE) test-ui-e2e || (docker compose -f tests/compose.yml down -v && exit 1)
	docker compose -f tests/compose.yml down -v

# ============================================================================
# Test Help and Discovery
# ============================================================================

.PHONY: test-help
test-help: ## Show testing system help
	@echo "Tyk AI Studio Unified Testing System"
	@echo ""
	@echo "Primary Targets:"
	@echo "  make test-all              Run all tests (default: unit + integration)"
	@echo "  make test-quick            Run only unit tests (fast feedback)"
	@echo "  make test-ci               Run CI tests with coverage"
	@echo ""
	@echo "Component Targets:"
	@echo "  make test-studio-unit            AI Studio Go unit tests"
	@echo "  make test-studio-integration     AI Studio integration tests"
	@echo "  make test-microgateway-unit      Microgateway unit tests"
	@echo "  make test-microgateway-integration  Microgateway integration tests"
	@echo "  make test-frontend-unit          Frontend Jest tests"
	@echo "  make test-plugins-unit           Plugin unit tests"
	@echo "  make test-plugins-integration    Plugin integration tests (Docker required)"
	@echo "  make test-plugins-e2e            Plugin E2E tests (Docker required)"
	@echo "  make test-ui-e2e                 UI Playwright E2E tests"
	@echo "  make test-ui-e2e-with-env        UI E2E with auto-started environment"
	@echo ""
	@echo "Configuration Variables:"
	@echo "  TEST_EDITION=ce|ent        Edition to test (default: auto-detect)"
	@echo "  TEST_COMPONENTS=\"...\"      Components to test (space-separated)"
	@echo "  TEST_TYPES=\"...\"           Test types to run (space-separated)"
	@echo "  TEST_VERBOSE=true          Enable verbose output"
	@echo "  TEST_COVERAGE=true         Generate coverage report"
	@echo "  TEST_TIMEOUT=30m           Test timeout duration"
	@echo ""
	@echo "Components: studio, microgateway, frontend, plugins"
	@echo "Types: unit, integration, e2e"
	@echo ""
	@echo "Examples:"
	@echo "  make test-all EDITION=ent"
	@echo "  make test-all TEST_COMPONENTS=\"studio frontend\" TEST_TYPES=\"unit\""
	@echo "  make test-all TEST_VERBOSE=true TEST_COVERAGE=true"

.PHONY: test-list
test-list: ## List all available test targets
	@echo "Available test targets:"
	@grep -E '^test-[a-zA-Z0-9_-]+:.*##' $(MAKEFILE_LIST) | \
		awk 'BEGIN {FS = ":.*## "}; {printf "  %-35s %s\n", $$1, $$2}'

# ============================================================================
# Integration Tests (Enterprise) - Legacy targets preserved
# ============================================================================
# Note: The advanced-llm-cache plugin has its own go.mod, so tests run from
# within the plugin directory

# Run all enterprise integration tests (requires Docker)
# Note: -count=1 disables test caching so env vars are respected on each run
test-integration:
	@echo "Running all enterprise integration tests..."
	cd enterprise/plugins/advanced-llm-cache && go test -v -count=1 -tags="integration,enterprise" ./tests/integration/...

# Run integration tests for advanced-llm-cache plugin
test-integration-plugin-cache:
	@echo "Running advanced-llm-cache integration tests..."
	cd enterprise/plugins/advanced-llm-cache && go test -v -count=1 -tags="integration,enterprise" ./tests/integration/...

# Run full integration tests with all optional features enabled
test-integration-plugin-cache-full:
	@echo "Running full advanced-llm-cache integration tests (all features)..."
	cd enterprise/plugins/advanced-llm-cache && INTEGRATION_REDIS_CLUSTER=1 INTEGRATION_SYSLOG=1 \
		go test -v -count=1 -tags="integration,enterprise" ./tests/integration/...

# Run integration tests with coverage
test-integration-plugin-cache-coverage:
	@echo "Running advanced-llm-cache integration tests with coverage..."
	cd enterprise/plugins/advanced-llm-cache && go test -v -count=1 -tags="integration,enterprise" -coverprofile=integration-coverage.out \
		./tests/integration/...
	cd enterprise/plugins/advanced-llm-cache && go tool cover -func=integration-coverage.out | tail -1

# Run integration tests with Redis cluster (slower startup)
test-integration-plugin-cache-cluster:
	@echo "Running Redis cluster integration tests..."
	cd enterprise/plugins/advanced-llm-cache && INTEGRATION_REDIS_CLUSTER=1 \
		go test -v -count=1 -tags="integration,enterprise" -run ".*Cluster.*" \
		./tests/integration/...

# Run integration tests with Syslog
test-integration-plugin-cache-syslog:
	@echo "Running Syslog audit integration tests..."
	cd enterprise/plugins/advanced-llm-cache && INTEGRATION_SYSLOG=1 \
		go test -v -count=1 -tags="integration,enterprise" -run ".*Syslog.*" \
		./tests/integration/...

# Run Vault integration tests for github-rag-ingest plugin
test-integration-plugin-github-rag:
	@echo "Running github-rag-ingest Vault integration tests..."
	cd community/plugins/github-rag-ingest/server && \
		go test -v -count=1 -tags=integration ./secrets/...

# Performance testing targets
perf-test:
	@echo "Running performance test suite..."
	go test -bench=BenchmarkProxy* ./proxy/ -benchmem
	go test -bench=BenchmarkGateway* ./pkg/aigateway/ -benchmem
	go test -bench=BenchmarkAnalytics* ./analytics/ -benchmem
	go test -bench=BenchmarkService* ./services/ -benchmem
	go test -bench=BenchmarkLoad* ./tests/performance/ -benchtime=30s

perf-profile:
	@echo "Running performance tests with profiling..."
	go test -bench=BenchmarkProxyRequest ./proxy/ -cpuprofile=cpu.prof -memprofile=mem.prof -benchmem
	@echo "Profile files generated: cpu.prof, mem.prof"
	@echo "Analyze with: go tool pprof cpu.prof or go tool pprof mem.prof"

perf-baseline:
	@echo "Establishing performance baseline..."
	@mkdir -p performance/baselines
	go test -bench=. ./... -benchmem -count=5 > performance/baselines/baseline-$(shell date +%Y%m%d-%H%M%S).txt
	@echo "Baseline saved to performance/baselines/"

perf-compare:
	@echo "Comparing current performance to baseline..."
	@if [ ! -d performance/baselines ]; then \
		echo "No baselines found. Run 'make perf-baseline' first."; \
		exit 1; \
	fi
	@LATEST_BASELINE=$$(ls -t performance/baselines/baseline-*.txt | head -n 1); \
	go test -bench=. ./... -benchmem -count=5 > performance/current-run.txt; \
	echo "Comparing against: $$LATEST_BASELINE"; \
	echo "Current results saved to: performance/current-run.txt"; \
	echo "Use benchstat to compare: benchstat $$LATEST_BASELINE performance/current-run.txt"

perf-report:
	@echo "Generating performance report..."
	@mkdir -p performance/reports
	@REPORT_FILE=performance/reports/report-$(shell date +%Y%m%d-%H%M%S).html; \
	echo "<!DOCTYPE html><html><head><title>Performance Report</title></head><body>" > $$REPORT_FILE; \
	echo "<h1>Midsommar Performance Report - $(shell date)</h1>" >> $$REPORT_FILE; \
	echo "<h2>System Info</h2><pre>" >> $$REPORT_FILE; \
	go version >> $$REPORT_FILE; \
	echo "CPU: $(shell nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null || echo 'unknown')" >> $$REPORT_FILE; \
	echo "Memory: $(shell free -h 2>/dev/null | grep '^Mem:' | awk '{print $$2}' || echo 'unknown')" >> $$REPORT_FILE; \
	echo "</pre><h2>Benchmark Results</h2><pre>" >> $$REPORT_FILE; \
	go test -bench=. ./... -benchmem >> $$REPORT_FILE 2>&1; \
	echo "</pre></body></html>" >> $$REPORT_FILE; \
	echo "Report generated: $$REPORT_FILE"

perf-clean:
	@echo "Cleaning performance test artifacts..."
	rm -f *.prof
	rm -f performance/current-run.txt
	rm -rf performance/reports/*
	@echo "Performance artifacts cleaned"

# Gateway latency benchmarks (benchmarks/gateway/README.md).
# The stack reads TYK_AI_LICENSE from BENCH_ENV_FILE; vendor keys for the
# real-upstream scenario come from $(BENCH_VENDORS_DIR)/vendors.env.
BENCH_DIR          := benchmarks/gateway
BENCH_ENV_FILE     ?= dev/.env.secrets
BENCH_VENDORS_DIR  ?= $(CURDIR)/test-secrets
# PC_PLUGIN_DIR (a directory holding a Linux prompt-compressor binary, see
# bench-plugin-compressor) mounts the plugin for the S8 compressor scenarios.
BENCH_COMPOSE       = GWBENCH_GIT_SHA=$$(git rev-parse HEAD) \
	GWBENCH_GIT_DIRTY=$$(test -n "$$(git status --porcelain --untracked-files=no)" && echo true || echo false) \
	VENDORS_ENV_DIR=$(BENCH_VENDORS_DIR) \
	$(if $(PC_PLUGIN_DIR),PC_PLUGIN_DIR=$(abspath $(PC_PLUGIN_DIR))) \
	docker compose --env-file $(BENCH_ENV_FILE) -f $(BENCH_DIR)/compose/docker-compose.yml \
	$(if $(PC_PLUGIN_DIR),-f $(BENCH_DIR)/compose/prompt-compressor.yaml)
BENCH_RUN           = $(BENCH_COMPOSE) run --rm gwbench
BENCH_SCENARIOS     = /bench/$(BENCH_DIR)/scenarios

bench-up: ## Build and start the benchmark stack (Studio + edge + mock)
	@test -f $(BENCH_ENV_FILE) || { echo "$(BENCH_ENV_FILE) not found: set BENCH_ENV_FILE to a file with TYK_AI_LICENSE"; exit 1; }
	@mkdir -p $(BENCH_DIR)/results $(BENCH_DIR)/.state
	$(BENCH_COMPOSE) --profile tools build
	$(BENCH_COMPOSE) up -d --wait

bench-down: ## Stop the benchmark stack and delete its data
	$(BENCH_COMPOSE) --profile tools down -v

bench-seed: ## Configure Studio + edge for benchmarking (mock LLMs only)
	$(BENCH_RUN) seed

bench-seed-vendors: ## Configure Studio + edge including real OpenAI/Anthropic LLMs
	$(BENCH_RUN) seed -vendors

bench-smoke: ## Quick end-to-end run of S0, S1 and S4 (not publishable)
	$(BENCH_RUN) run -quick $(BENCH_SCENARIOS)/s0-aa-calibration.yaml $(BENCH_SCENARIOS)/s1-overhead-floor.yaml $(BENCH_SCENARIOS)/s4-capacity-ramp.yaml

bench-overhead: ## S0 calibration, S1 overhead floor, S2 payload sensitivity
	$(BENCH_RUN) run $(BENCH_SCENARIOS)/s0-aa-calibration.yaml $(BENCH_SCENARIOS)/s1-overhead-floor.yaml $(BENCH_SCENARIOS)/s2-payload-size.yaml

bench-real: ## S3 against real vendors (needs bench-seed-vendors and vendors.env)
	$(BENCH_RUN) run -vendors $(BENCH_SCENARIOS)/s0-aa-calibration.yaml $(BENCH_SCENARIOS)/s3-real-vendors.yaml

bench-stress: ## S4 capacity ramp and S5 throughput ceiling
	$(BENCH_RUN) run $(BENCH_SCENARIOS)/s4-capacity-ramp.yaml $(BENCH_SCENARIOS)/s5-throughput-ceiling.yaml

bench-spike: ## S6 burst (size with BENCH_RATE_SCALE=<S4 sustained rps / 200>)
	$(BENCH_RUN) run -rate-scale $(or $(BENCH_RATE_SCALE),1) $(BENCH_SCENARIOS)/s6-spike.yaml

bench-soak: ## S7 one-hour soak (size with BENCH_RATE_SCALE=<S4 sustained rps / 200>)
	$(BENCH_RUN) run -rate-scale $(or $(BENCH_RATE_SCALE),1) $(BENCH_SCENARIOS)/s7-soak.yaml

bench-plugin-compressor: ## Build the Prompt Compressor for the bench stack into PC_PLUGIN_DIR (default .state/plugins)
	cd community/plugins/prompt-compressor && GOOS=linux GOARCH=$$(go env GOARCH) CGO_ENABLED=0 GOWORK=off \
		go build -o $(abspath $(or $(PC_PLUGIN_DIR),$(BENCH_DIR)/.state/plugins))/prompt-compressor .

bench-compressor: ## S8 + S8b Prompt Compressor overhead (run bench-up and this with PC_PLUGIN_DIR set)
	@test -n "$(PC_PLUGIN_DIR)" || { echo "set PC_PLUGIN_DIR (see make bench-plugin-compressor) for bench-up and bench-compressor"; exit 1; }
	$(BENCH_RUN) seed -compressor file:///opt/microgateway/plugins/prompt-compressor
	$(BENCH_RUN) run $(BENCH_SCENARIOS)/s8-prompt-compressor.yaml $(BENCH_SCENARIOS)/s8b-prompt-compressor-large.yaml

bench-build-gateway: ## Build an edge image from another checkout: make bench-build-gateway SRC=<path> TAG=<tag>
	@test -n "$(SRC)" && test -n "$(TAG)" || { echo "usage: make bench-build-gateway SRC=<checkout path> TAG=<tag>"; exit 1; }
	docker build -f "$(SRC)/microgateway/deployments/Dockerfile" --build-arg "EDITION=$(or $(EDITION),ent)" -t "gwbench-microgateway:$(TAG)" "$(SRC)"

bench-swap: ## Run the edge from another image and re-seed: make bench-swap TAG=<tag>
	@test -n "$(TAG)" || { echo "usage: make bench-swap TAG=<tag> (an image gwbench-microgateway:<tag>)"; exit 1; }
	GATEWAY_IMAGE=gwbench-microgateway:$(TAG) $(BENCH_COMPOSE) up -d --no-build --force-recreate --wait gateway
	$(BENCH_RUN) seed

bench-report: ## Regenerate reports: make bench-report RUN=<results dir name>
	$(BENCH_RUN) report /bench/$(BENCH_DIR)/results/$(RUN)

.PHONY: bench-up bench-down bench-seed bench-seed-vendors bench-smoke bench-overhead bench-real \
	bench-stress bench-spike bench-soak bench-report bench-unit bench-build-gateway bench-swap \
	bench-plugin-compressor bench-compressor

bench-unit: ## Unit tests for the benchmark tooling and Server-Timing
	go test ./benchmarks/... ./pkg/testinfra/mockllm/ ./metrics/
	go test ./proxy/ -run 'ServerTiming|InnerTiming'

bench-agent-tracing: ## Agent tracing overhead (added p50 gated; quiet machine) and per-request capture cost; BENCH_EDITION=enterprise adds full content
	scripts/agent-tracing-bench-gate.sh overhead $(or $(BENCH_EDITION),ce)

bench-agent-tracing-ci: ## The blocking CI perf gate: allocations, write amplification, overhead reported
	scripts/agent-tracing-bench-gate.sh ci $(or $(BENCH_EDITION),ce)

bench-agent-tracing-soak: ## Assembler gate: seed ~4M spans, then 15 min at GOMAXPROCS=2, every minute >= 2,000 spans/s (AGENT_TRACE_SOAK=1h on Linux/CI; needs DATABASE_URL, Postgres limited to 2 CPUs)
	scripts/agent-tracing-bench-gate.sh soak enterprise

.PHONY: bench-agent-tracing bench-agent-tracing-ci bench-agent-tracing-soak

# Clean target
clean:
	rm -f midsommar*
	rm -rf bin/
	rm -rf $(ADMIN_FRONTEND_DIR)/build
	cd microgateway && rm -rf bin/ dist/

# Development targets (LEGACY - consider using 'make dev' instead)
# The new Docker Compose-based environment provides hot reloading and multi-component support.
# See 'make dev-help' for more information.
start-dev: stop-dev
	@echo "⚠️  Note: 'make start-dev' is the legacy approach."
	@echo "   Consider using 'make dev' for hot reloading and better DX."
	@echo ""
	@if [ ! -f .env ]; then \
		cp .env.example .env; \
		echo ".env file created from .env.example"; \
	fi
	@if [ ! -d "../langchaingo" ]; then \
		git clone https://github.com/lonelycode/langchaingo ../langchaingo; \
		echo "langchaingo repository cloned"; \
	fi
	@screen -dmS midsommar -t frontend bash -c 'cd $(ADMIN_FRONTEND_DIR) && SITE_URL=http://localhost:8080 npm start; read -n 1'
	@screen -S midsommar -X screen -t backend bash -c 'go build && ./midsommar; read -n 1'
	@screen -r midsommar

stop-dev:
	@pkill -f "npm start" || true
	@pkill -f "./midsommar" || true
	@screen -S midsommar -X quit || true

# ============================================================================
# Docker Compose Development Environment (NEW - Recommended)
# ============================================================================
# Modern Docker Compose-based development with hot reloading.
# See dev/README.md for full documentation.
#
# Quick Start:
#   make dev          - Start minimal dev env (Studio + Frontend + Postgres)
#   make dev-full     - Start full stack (+ Gateway + Plugins watcher)
#   make dev-ent      - Start enterprise dev env
#   make dev-full-ent - Start full enterprise stack (no plugin builds)
#   make dev-full-ent-plugins - Full enterprise stack + plugin builder/watcher
#
# Go services rebuild on container restart. Use 'make dev-restart-<service>' to rebuild.
# Frontend uses React HMR for live updates.

.PHONY: dev dev-full dev-ent dev-full-ent dev-full-ent-plugins dev-start-full-ent-plugins dev-down dev-logs dev-clean dev-status dev-rebuild

# Start minimal development environment (Studio + Frontend + PostgreSQL)
dev:
	@echo "🚀 Starting minimal development environment..."
	@echo "   Services: postgres, studio (with hot reload), frontend (with HMR)"
	@echo ""
	@if [ ! -f dev/.env ]; then \
		cp dev/.env.dev dev/.env; \
		echo "📝 Created dev/.env from template"; \
		echo "   Edit dev/.env to add your API keys"; \
		echo ""; \
	fi
	cd dev && docker compose up --build

# Start full development environment (+ Gateway + Plugin watcher)
dev-full:
	@echo "🚀 Starting full development environment..."
	@echo "   Services: postgres, studio, frontend, gateway, plugins"
	@echo ""
	@if [ ! -f dev/.env ]; then \
		cp dev/.env.dev dev/.env; \
		echo "📝 Created dev/.env from template"; \
		echo "   Edit dev/.env to add your API keys"; \
		echo ""; \
	fi
	@if [ ! -f dev/.env.gateway ]; then \
		cp dev/.env.gateway.dev dev/.env.gateway; \
		echo "📝 Created dev/.env.gateway from template"; \
	fi
	cd dev && docker compose --profile plugins -f docker-compose.yml -f docker-compose.full.yml up --build

# Start enterprise development environment (minimal)
dev-ent: ent-link
	@if [ ! -d "enterprise/.git" ] && [ ! -f "enterprise/.git" ]; then \
		echo "❌ ERROR: Enterprise submodule not initialized."; \
		echo "   Run: make init-enterprise"; \
		exit 1; \
	fi
	@echo "🏢 Starting enterprise development environment..."
	@if [ ! -f dev/.env ]; then \
		cp dev/.env.dev dev/.env; \
		echo "📝 Created dev/.env from template"; \
	fi
	@if [ -f dev/.env.secrets ]; then \
		echo "🔐 Merging dev/.env.secrets into dev/.env"; \
		while IFS= read -r line || [ -n "$$line" ]; do \
			key=$$(echo "$$line" | cut -d= -f1); \
			if [ -n "$$key" ] && [ "$${key#\#}" = "$$key" ]; then \
				sed -i.bak "/^$$key=/d" dev/.env 2>/dev/null || sed -i '' "/^$$key=/d" dev/.env; \
				echo "$$line" >> dev/.env; \
			fi; \
		done < dev/.env.secrets; \
		rm -f dev/.env.bak; \
	fi
	@if ! grep -q "^TYK_AI_LICENSE=" dev/.env || [ "$$(grep "^TYK_AI_LICENSE=" dev/.env | cut -d= -f2)" = "" ]; then \
		echo "⚠️  Warning: TYK_AI_LICENSE not set"; \
		echo "   Create dev/.env.secrets with:"; \
		echo "     TYK_AI_LICENSE=your-license-key"; \
		echo ""; \
	fi
	cd dev && docker compose -f docker-compose.yml -f docker-compose.ent.yml up --build

# Start full enterprise development environment
dev-full-ent: ent-link
	@if [ ! -d "enterprise/.git" ] && [ ! -f "enterprise/.git" ]; then \
		echo "❌ ERROR: Enterprise submodule not initialized."; \
		echo "   Run: make init-enterprise"; \
		exit 1; \
	fi
	@echo "🏢 Starting full enterprise development environment..."
	@if [ ! -f dev/.env ]; then \
		cp dev/.env.dev dev/.env; \
		echo "📝 Created dev/.env from template"; \
	fi
	@if [ -f dev/.env.secrets ]; then \
		echo "🔐 Merging dev/.env.secrets into dev/.env"; \
		while IFS= read -r line || [ -n "$$line" ]; do \
			key=$$(echo "$$line" | cut -d= -f1); \
			if [ -n "$$key" ] && [ "$${key#\#}" = "$$key" ]; then \
				sed -i.bak "/^$$key=/d" dev/.env 2>/dev/null || sed -i '' "/^$$key=/d" dev/.env; \
				echo "$$line" >> dev/.env; \
			fi; \
		done < dev/.env.secrets; \
		rm -f dev/.env.bak; \
	fi
	@if [ ! -f dev/.env.gateway ]; then \
		cp dev/.env.gateway.dev dev/.env.gateway; \
		echo "📝 Created dev/.env.gateway from template"; \
	fi
	cd dev && docker compose $(PLUGIN_PROFILE) -f docker-compose.yml -f docker-compose.full.yml -f docker-compose.ent.yml -f docker-compose.full-ent.yml up --build

# Start full enterprise environment including the plugin builder/watcher.
# Reuses dev-full-ent; the target-specific variable turns the profile on, so
# plugin builds stay an opt-in phase rather than a cost on every start.
dev-full-ent-plugins: PLUGIN_PROFILE = --profile plugins
dev-full-ent-plugins: dev-full-ent

# Stop development environment (handles all compose file combinations)
dev-down:
	@echo "🛑 Stopping development environment..."
	@# Stop containers by name to avoid env file dependency issues
	docker stop midsommar-studio midsommar-frontend midsommar-postgres midsommar-gateway midsommar-plugins 2>/dev/null || true
	docker rm midsommar-studio midsommar-frontend midsommar-postgres midsommar-gateway midsommar-plugins 2>/dev/null || true
	@# Also try compose down with just the base file as fallback
	cd dev && docker compose down 2>/dev/null || true

# View all logs
dev-logs:
	cd dev && docker compose logs -f

# View logs for specific service (usage: make dev-logs-studio, make dev-logs-gateway, etc.)
dev-logs-%:
	cd dev && docker compose logs -f $*

# Shell into a service (usage: make dev-shell-studio, make dev-shell-gateway, etc.)
dev-shell-%:
	cd dev && docker compose exec $* sh

# Rebuild a specific service's Docker image (usage: make dev-rebuild-studio)
dev-rebuild-%:
	cd dev && docker compose up --build -d $*

# Restart a service to trigger a code rebuild (usage: make dev-restart-studio)
dev-restart-%:
	cd dev && docker compose restart $*

# Clean development environment (stops containers and removes volumes including postgres data)
dev-clean: dev-down
	@echo "🧹 Cleaning development environment..."
	@echo "   Removing Docker volumes..."
	docker volume rm midsommar-postgres-data 2>/dev/null || true
	docker volume rm midsommar-studio-tmp 2>/dev/null || true
	docker volume rm midsommar-studio-data 2>/dev/null || true
	docker volume rm midsommar-go-cache 2>/dev/null || true
	rm -f dev/.env dev/.env.gateway
	@echo "✅ Development environment cleaned (including postgres data)"
	@echo "   Run 'make dev' to start fresh"

# Show development environment status
dev-status:
	@echo "Development Environment Status:"
	@echo ""
	cd dev && docker compose ps 2>/dev/null || echo "No containers running"

# Development help
dev-help:
	@echo "Docker Compose Development Environment"
	@echo ""
	@echo "Quick Start:"
	@echo "  make dev              Start minimal env (Studio + Frontend + Postgres)"
	@echo "  make dev-full         Start full stack (+ Gateway + Plugins watcher)"
	@echo ""
	@echo "Enterprise Edition:"
	@echo "  make dev-ent          Start enterprise minimal env"
	@echo "  make dev-full-ent     Start enterprise full stack (no plugin builds)"
	@echo "  make dev-full-ent-plugins Enterprise full stack + plugin builder"
	@echo ""
	@echo "Detached Mode (for automation/Claude):"
	@echo "  make dev-start        Start minimal env (detached)"
	@echo "  make dev-start-full   Start full stack (detached)"
	@echo "  make dev-start-ent    Start enterprise minimal (detached)"
	@echo "  make dev-start-full-ent Start enterprise full (detached, no plugin builds)"
	@echo "  make dev-start-full-ent-plugins Enterprise full + plugins (detached)"
	@echo ""
	@echo "Management:"
	@echo "  make dev-down         Stop all containers"
	@echo "  make dev-logs         View all logs"
	@echo "  make dev-logs-studio  View studio logs only"
	@echo "  make dev-logs-gateway View gateway logs only"
	@echo "  make dev-shell-studio Shell into studio container"
	@echo "  make dev-status       Show container status"
	@echo "  make dev-clean        Stop and remove all data"
	@echo ""
	@echo "Non-blocking Logs (for automation/Claude):"
	@echo "  make dev-tail-studio  Last 100 lines of studio logs"
	@echo "  make dev-tail-gateway Last 100 lines of gateway logs"
	@echo "  make dev-tail LINES=50 Custom line count"
	@echo ""
	@echo "Ports:"
	@echo "  3000  Frontend (React dev server; override with FRONTEND_PORT=3100)"
	@echo "  8080  Studio REST API (override with STUDIO_PORT=8090)"
	@echo "  50051 Studio gRPC (control server)"
	@echo "  8081  Gateway REST API"
	@echo "  55432 PostgreSQL (host) → 5432 (container)"
	@echo ""
	@echo "Hot Reloading:"
	@echo "  - Edit Go files → Air rebuilds in ~2-3 seconds"
	@echo "  - Edit React files → HMR updates instantly"
	@echo "  - Edit plugins → Auto-rebuilt by watcher (full mode; *-plugins targets in ent)"
	@echo ""
	@echo "See dev/README.md for full documentation"

# ============================================================================
# Detached Mode Development (for automation/Claude Code)
# ============================================================================
# These targets run the dev environment in detached mode (-d flag) so that
# the command returns immediately. Useful for automation and Claude Code skills.

# Start minimal dev env in detached mode
dev-start:
	@echo "🚀 Starting minimal development environment (detached)..."
	@if [ ! -f dev/.env ]; then \
		cp dev/.env.dev dev/.env; \
		echo "📝 Created dev/.env from template"; \
	fi
	cd dev && docker compose up --build -d
	@echo "✅ Environment started. Use 'make dev-status' to check."

# Start full dev env in detached mode
dev-start-full:
	@echo "🚀 Starting full development environment (detached)..."
	@if [ ! -f dev/.env ]; then \
		cp dev/.env.dev dev/.env; \
		echo "📝 Created dev/.env from template"; \
	fi
	@if [ ! -f dev/.env.gateway ]; then \
		cp dev/.env.gateway.dev dev/.env.gateway; \
		echo "📝 Created dev/.env.gateway from template"; \
	fi
	cd dev && docker compose --profile plugins -f docker-compose.yml -f docker-compose.full.yml up --build -d
	@echo "✅ Environment started. Use 'make dev-status' to check."

# Start enterprise dev env in detached mode
dev-start-ent: ent-link
	@if [ ! -d "enterprise/.git" ] && [ ! -f "enterprise/.git" ]; then \
		echo "❌ ERROR: Enterprise submodule not initialized. Run: make init-enterprise"; \
		exit 1; \
	fi
	@echo "🏢 Starting enterprise development environment (detached)..."
	@if [ ! -f dev/.env ]; then \
		cp dev/.env.dev dev/.env; \
		echo "📝 Created dev/.env from template"; \
	fi
	@if [ -f dev/.env.secrets ]; then \
		echo "🔐 Merging dev/.env.secrets into dev/.env"; \
		while IFS= read -r line || [ -n "$$line" ]; do \
			key=$$(echo "$$line" | cut -d= -f1); \
			if [ -n "$$key" ] && [ "$${key#\#}" = "$$key" ]; then \
				sed -i.bak "/^$$key=/d" dev/.env 2>/dev/null || sed -i '' "/^$$key=/d" dev/.env; \
				echo "$$line" >> dev/.env; \
			fi; \
		done < dev/.env.secrets; \
		rm -f dev/.env.bak; \
	fi
	cd dev && docker compose -f docker-compose.yml -f docker-compose.ent.yml up --build -d
	@echo "✅ Environment started. Use 'make dev-status' to check."

# Start full enterprise dev env in detached mode
dev-start-full-ent: ent-link
	@if [ ! -d "enterprise/.git" ] && [ ! -f "enterprise/.git" ]; then \
		echo "❌ ERROR: Enterprise submodule not initialized. Run: make init-enterprise"; \
		exit 1; \
	fi
	@echo "🏢 Starting full enterprise development environment (detached)..."
	@if [ ! -f dev/.env ]; then \
		cp dev/.env.dev dev/.env; \
		echo "📝 Created dev/.env from template"; \
	fi
	@if [ -f dev/.env.secrets ]; then \
		echo "🔐 Merging dev/.env.secrets into dev/.env"; \
		while IFS= read -r line || [ -n "$$line" ]; do \
			key=$$(echo "$$line" | cut -d= -f1); \
			if [ -n "$$key" ] && [ "$${key#\#}" = "$$key" ]; then \
				sed -i.bak "/^$$key=/d" dev/.env 2>/dev/null || sed -i '' "/^$$key=/d" dev/.env; \
				echo "$$line" >> dev/.env; \
			fi; \
		done < dev/.env.secrets; \
		rm -f dev/.env.bak; \
	fi
	@if [ ! -f dev/.env.gateway ]; then \
		cp dev/.env.gateway.dev dev/.env.gateway; \
		echo "📝 Created dev/.env.gateway from template"; \
	fi
	cd dev && docker compose $(PLUGIN_PROFILE) -f docker-compose.yml -f docker-compose.full.yml -f docker-compose.ent.yml -f docker-compose.full-ent.yml up --build -d
	@echo "✅ Environment started. Use 'make dev-status' to check."

# Start full enterprise environment with the plugin builder (detached)
dev-start-full-ent-plugins: PLUGIN_PROFILE = --profile plugins
dev-start-full-ent-plugins: dev-start-full-ent

# ============================================================================
# Non-blocking Log Commands (for automation/Claude Code)
# ============================================================================
# These targets fetch logs without following (-f), returning immediately.
# Use LINES=N to control how many lines to fetch (default: 100).

# View last N lines of all logs (default 100, non-blocking)
dev-tail:
	cd dev && docker compose logs --tail=$(or $(LINES),100)

# View last N lines of specific service logs (usage: make dev-tail-studio LINES=50)
dev-tail-%:
	cd dev && docker compose logs --tail=$(or $(LINES),100) $*

# Start pre-defined test env in docker
start-test-env:
	echo "Make sure the frontend is already built"
	@if [ ! -f .env ]; then \
		cp .env.example .env; \
		echo ".env file created from .env.example"; \
	fi
	echo "Creating copy of the postgres test data"
	mkdir -p ./tests/postgres_data_temp
	cp -r tests/postgres_data ./tests/postgres_data_temp
	echo "Starting the test environment"
	docker compose --env-file .env -f tests/compose.yml up

# Stop pre-defined test env in docker
stop-test-env:
	echo "Stopping the test environment"
	docker compose --env-file .env -f tests/compose.yml down
	echo "Removing the copy of the postgres test data"
	rm -rf /tests/postgres_temp

# Build extras only (transformer and reranker)
build-docker-extras:
	cd extra/transformer_server && \
	docker buildx build --platform linux/amd64,linux/arm64 -t tykio/transformer_server_cpu:latest --push -f dockerfile.cpu .
	cd extra/reranker && \
	docker buildx build --platform linux/amd64,linux/arm64 -t tykio/reranker_cpu:latest --push -f dockerfile.cpu .

# ============================================================================
# Enterprise Submodule Management
# ============================================================================

.PHONY: init-enterprise
init-enterprise:
	@echo "🔐 Initializing enterprise submodule..."
	@git submodule init
	@git submodule update --remote
	@if [ -f enterprise/.git ]; then \
		echo "✅ Enterprise edition initialized successfully"; \
		scripts/enterprise-link-tests.sh; \
		echo "Run 'make build' to build enterprise edition"; \
	else \
		echo "❌ Failed to initialize enterprise submodule"; \
		echo "You may not have access to the private repository"; \
		echo "For enterprise access: contact enterprise@tyk.io"; \
		exit 1; \
	fi

.PHONY: update-enterprise
update-enterprise:
	@if [ ! -f enterprise/.git ]; then \
		echo "❌ Enterprise submodule not initialized"; \
		echo "Run: make init-enterprise"; \
		exit 1; \
	fi
	@echo "Updating enterprise submodule..."
	@git submodule update --remote enterprise
	@git add enterprise
	@echo "✅ Enterprise submodule updated"
	@echo "Commit the change: git commit -m 'Update enterprise submodule'"

.PHONY: show-edition
show-edition:
	@echo "Current edition: $(EDITION)"
	@if [ "$(ENTERPRISE_EXISTS)" = "yes" ]; then \
		echo "Enterprise commit:"; \
		cd enterprise && git log -1 --oneline; \
	else \
		echo "Enterprise submodule: not initialized"; \
	fi

.PHONY: all build help build-frontend \
	build-native build-native-ce build-native-ent \
	build-prod build-prod-ce build-prod-ent \
	build-linux-amd64 build-linux-arm64 build-darwin-amd64 build-darwin-arm64 \
	build-local build-community build-enterprise \
	plugins test clean start-dev stop-dev \
	dev dev-full dev-ent dev-full-ent dev-down dev-logs dev-clean dev-status dev-help \
	dev-start dev-start-full dev-start-ent dev-start-full-ent dev-tail \
	perf-test perf-profile perf-baseline perf-compare perf-report perf-clean \
	init-enterprise update-enterprise show-edition \
	test-integration test-integration-plugin-cache test-integration-plugin-cache-full \
	test-integration-plugin-cache-coverage test-integration-plugin-cache-cluster \
	test-integration-plugin-cache-syslog test-integration-plugin-github-rag \
	test-all test-quick test-ci test-help test-list \
	test-studio-unit test-studio-integration \
	test-microgateway-unit test-microgateway-integration \
	test-frontend-unit \
	test-plugins-unit test-plugins-integration test-plugins-e2e \
	test-ui-e2e test-ui-e2e-with-env \
	plugin-new plugin-help tools