IMAGE ?= webrestrict/control:0.7.0-phase9
BUILD_VERSION ?= 0.7.0-phase9

# Bounded docker helper for the Go toolchain. The container runs as the current
# user, so the repository and the module cache stay owned by you.
GO_IMAGE ?= golang:1.25-alpine
GO_RUN = timeout 600 docker run --rm --network host --user "$$(id -u):$$(id -g)" \
	  -e HOME=/src/.gocache -e GOMODCACHE=/src/.gocache/mod -e GOCACHE=/src/.gocache/build \
	  -v "$$PWD":/src -w /src $(GO_IMAGE)

# Scratch broker used by `make mqtt-verify` (see deploy/mosquitto/README.md).
MQTT_VERIFY_PORT ?= 18883
MQTT_IMAGE ?= eclipse-mosquitto:latest

.PHONY: help test vet build up down restart logs ps hash-password deps fmt \
        mqtt-tls mqtt-verify mqtt-config verify-phase8

help:
	@echo "make test           run go test ./... in golang:1.25-alpine"
	@echo "make vet            run go vet ./... in golang:1.25-alpine"
	@echo "make build          build the container image ($(IMAGE))"
	@echo "make up             docker compose up -d --build"
	@echo "make down           docker compose down"
	@echo "make logs           follow container logs"
	@echo "make ps             docker compose ps"
	@echo "make hash-password  generate a bcrypt hash (PASSWORD=...)"
	@echo "make deps           go mod tidy + download (writes go.mod/go.sum)"
	@echo "make mqtt-tls       generate the lab CA and broker certificate"
	@echo "make mqtt-config    build the scratch broker config in deploy/mosquitto/build/"
	@echo "make mqtt-verify    prove TLS + credentials + topic ACLs on a scratch broker"
	@echo "make verify-phase8  prove an API lock reaches a device in under a second"
	@echo "make verify-phase9  prove the Hub answers and the Apprise alerts deliver"

test:
	$(GO_RUN) go test ./...

vet:
	$(GO_RUN) go vet ./...

deps:
	$(GO_RUN) sh -c 'go mod tidy'

fmt:
	$(GO_RUN) sh -c 'go fmt ./...'

build:
	docker build --build-arg VERSION=$(BUILD_VERSION) -t $(IMAGE) .

up:
	docker compose up -d --build

down:
	docker compose down

restart:
	docker compose restart control

logs:
	docker compose logs -f control

ps:
	docker compose ps

hash-password:
	@test -n "$(PASSWORD)" || (echo "usage: make hash-password PASSWORD=secret"; exit 2)
	docker run --rm --entrypoint /app/control $(IMAGE) hash-password '$(PASSWORD)'

# --- MQTT ---------------------------------------------------------------
# These targets never touch the shared Mosquitto. They build the material and
# prove it on a scratch broker on $(MQTT_VERIFY_PORT). See deploy/mosquitto/README.md.

mqtt-tls:
	deploy/mosquitto/generate-tls.sh

mqtt-config: mqtt-tls
	deploy/mosquitto/build-config.sh

mqtt-verify: mqtt-config
	MQTT_VERIFY_PORT=$(MQTT_VERIFY_PORT) MQTT_IMAGE=$(MQTT_IMAGE) \
	  deploy/mosquitto/verify-isolation.sh

# Phase 8 definition of done: lock through the admin API, measured until a real
# broker subscriber receives the retained config. Never touches the 1883 plane.
verify-phase8:
	deploy/verify-phase8.sh

# Phase 9 definition of done: /capabilities, /ask, the alert engine and /notify
# against the deployed service, with Apprise delivery checked in the alerts
# table. Never touches the 1883 plane.
verify-phase9:
	deploy/verify-phase9.sh