Makefile

PROJECT := authorizer
DEFAULT_VERSION=0.1.0-local
VERSION := $(or $(VERSION),$(DEFAULT_VERSION))
DOCKER_IMAGE ?= quay.io/authorizer/authorizer:$(VERSION)

# Full module test run. Storage provider tests honour TEST_DBS (defaults to all).
# Integration tests and memory_store/db tests always use SQLite.
# Redis memory_store tests run only when TEST_ENABLE_REDIS=1.
GO_TEST_ALL := go test -p 1 -v ./...

.PHONY: all bootstrap build build-app build-dashboard build-local-image build-push-image trivy-scan

all: build build-app build-dashboard

bootstrap:
	go install github.com/mitchellh/gox@latest

build:
	CGO_ENABLED=0 gox \
		-mod=readonly \
		-osarch="linux/amd64 linux/arm64 darwin/amd64 darwin/arm64" \
		-ldflags="-w -X github.com/authorizerdev/authorizer/internal/constants.VERSION=$(VERSION)" \
		-output="./build/{{.OS}}/{{.Arch}}/$(PROJECT)" \
		-tags="netgo" \
		./...
build-app:
	cd web/app && npm ci && npm run build
build-dashboard:
	cd web/dashboard && npm ci && npm run build
build-local-image:
	docker build --build-arg VERSION=$(VERSION) -t $(DOCKER_IMAGE) .
build-push-image:
	docker buildx build --platform linux/amd64,linux/arm64 --push \
		-t $(DOCKER_IMAGE) \
		--build-arg VERSION=$(VERSION) \
		.
# Run Trivy vulnerability scan on the Docker image (default: $(DOCKER_IMAGE)). Use IMAGE=myimage:tag to scan another image.
trivy-scan:
	docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
		aquasec/trivy:latest image $(or $(IMAGE),$(DOCKER_IMAGE)) \
		--severity HIGH,CRITICAL --ignore-unfixed --exit-code 1
clean:
	rm -rf build
# Local-only dev overrides. Create local.mk (gitignored) and set DEV_FLAGS to
# extra `make dev` flags — real OAuth client IDs/secrets, SMTP creds, etc.
# Example local.mk:
#   DEV_FLAGS = --github-client-id=xxx --github-client-secret=yyy
-include local.mk

dev:
	@PRIVATE_KEY=$$(printf '%s\n' \
		"-----BEGIN RSA PRIVATE KEY-----" \
		"MIIEowIBAAKCAQEA5dC50fVvQIDm66bBYW+qI+MypP9Pv9SMoHIz9cpcOj9sNhXI" \
		"HTllAM5dhi/+HIaJdPugVQt1rlTJVSFR+ynSmwa89RPHs0o7CBytskGaaf2RJ6zD" \
		"AY3TXKQQVAT3Qvb6ZOQh3+Hh8EOguqdE2iORo9s0KMk7tqS+/y4H3qrC6ngyt2QT" \
		"6VqWbs92N/aO0p/FaL/Q7rGZ+9hTlu3L/T70r3nyeA636kM48XUSqcjDrs4/E+Vx" \
		"XL2Y9Wo4kuaDmMPvMkdl6/wGOwAuIuHpmdfGh0hyLMdgpMqvFyEHuagCy+yFV6ES" \
		"gVi2rOp1g28iISbjpMTkNikbCBuL/TeaSdmEPwIDAQABAoIBABDpeCXmI2Ps+HwN" \
		"VKbNzQirZA3gsfw3xoovd/kVsA14nwcojtuZCStILyQRrRK+qH1A39l8/ecwhckW" \
		"KiPLE0dloAstrkut4e6PZGLn/AE3xUeqVDFtlUkjKQZzKm+1oCiY4eX0B/335BXy" \
		"+u34ocjxTS3Wh+aWyhgaSZROdF3vtcH0PHDroDd8oT/H0xN8fX/T1JozLN3jbxXz" \
		"G4KznKNmx74SrV/y6/wmmQqIsghJBNRZGbg5bn/xcExkcRhWQ3Eka8yAlu31XBQV" \
		"G5AtHEVO8lEi+a2PCA7t1xquw/8b48lc226aaN0pjaySNtyLB7EaKUxBDB2aGx3s" \
		"nVIuOsUCgYEA5xWJ67BKy6MyHphhltTLvre/AGXKDhoV3IR3Hm1cu/iXCT/oOFje" \
		"SYAAqqHXKEB+HZ4xKk7PnBzXkyLXqkCbEIBsv+GZpmboqZrPMfRgS6QcPWWMV9pZ" \
		"f1h68hWpXfyY+yEhAvPKFFhjAt0f5uMiRaAUskZJTFiRJqxz+z0AdD0CgYEA/pgq" \
		"Tk8WMKJBTic3m224FrR4qDok8tQp8FCerS7T5fFnSXZx64ucREn+Wm9ym5UTtbQz" \
		"pne4diIsNIIlVFOjOV7jHjzBS5oly2N/2AT5+ST7O4GZfh/I9VKQWuIh+i3p3s9x" \
		"7PSIlaql9ddV582gCMiL7/QDkHDFBVEz+vq31isCgYB2UoQFZ4ZU0OI34kSN67XL" \
		"mOA2/ue/4sFw4W7w6ISERxxnAw8P0wk2z1EIDchSdvtchQSdqi8Ju4bycvPE3EHJ" \
		"6EhG0+hN2QGm3nrbFEs+T/CZy2ZaEZaj6xVA4bCQTGe0ptj1XwkI89z2uWy9V23U" \
		"Asy2H+EmM29XQxQ7/5c87QKBgQCUO+i1+5pB6tb3OCJKXxHGNoHiASiuMhXRFD+v" \
		"OgqqYWnv/gTKTllH8YUlBqrGJ4B4VVmVXTOLpM30LKqrdJ8esj6uxlUNPc0vpNk0" \
		"34DkLUISHZ1PMBaDr/TY1b1OuxjmYAZHHwG/ksJaZ2xfMPwy4QGJTpwcp2wvcl4/" \
		"jWcoTQKBgALNq5XD/ufvZO2YQq9phF0EQza9zr45zSENF0cOsyVcEG4wfFv4Sg03" \
		"JjTG57oYDCWeLrFCRQpysFi1pDUUCQ1Z/Kf9xKZ/OoE1mXGCKGilBGUijQasuO5Q" \
		"GU+S3Xlk6TWCb2jTgc9UTjlp1FOgQSad4M6TW8vXGkSMODEj5g0S" \
		"-----END RSA PRIVATE KEY-----") && \
	PUBLIC_KEY=$$(printf '%s\n' \
		"-----BEGIN RSA PUBLIC KEY-----" \
		"MIIBCgKCAQEA5dC50fVvQIDm66bBYW+qI+MypP9Pv9SMoHIz9cpcOj9sNhXIHTll" \
		"AM5dhi/+HIaJdPugVQt1rlTJVSFR+ynSmwa89RPHs0o7CBytskGaaf2RJ6zDAY3T" \
		"XKQQVAT3Qvb6ZOQh3+Hh8EOguqdE2iORo9s0KMk7tqS+/y4H3qrC6ngyt2QT6VqW" \
		"bs92N/aO0p/FaL/Q7rGZ+9hTlu3L/T70r3nyeA636kM48XUSqcjDrs4/E+VxXL2Y" \
		"9Wo4kuaDmMPvMkdl6/wGOwAuIuHpmdfGh0hyLMdgpMqvFyEHuagCy+yFV6ESgVi2" \
		"rOp1g28iISbjpMTkNikbCBuL/TeaSdmEPwIDAQAB" \
		"-----END RSA PUBLIC KEY-----") && \
	go run main.go \
		--database-type=sqlite \
		--database-url=test.db \
		--jwt-type=RS256 \
		--jwt-private-key="$$PRIVATE_KEY" \
		--jwt-public-key="$$PUBLIC_KEY" \
		--admin-secret=admin \
		--encryption-key=dev-encryption-key-not-for-production \
		--client-id=kbyuFDidLLm280LIwVFiazOqjO3ty8KH \
		--client-secret=60Op4HFM0I8ajz0WdiStAbziZ-VFQttXuxixHHs2R7r7-CW8GR79l-mmLqMhc-Sa \
		--allowed-origins=localhost:8080,localhost:8090,localhost:9091,localhost:5173,localhost:5174 \
		$(DEV_FLAGS)

test:
	go clean --testcache && TEST_DBS="sqlite" $(GO_TEST_ALL)

# Release smoke tests: build the real binary and exercise every public API
# surface (GraphQL, REST, gRPC, MCP) end to end, including an authenticated
# FGA decision on each. Gated behind the `smoke` build tag so regular test
# runs skip them. CI runs this on every release.
.PHONY: smoke
smoke:
	go test -tags smoke -count=1 -v -timeout 5m ./internal/e2e/

test-postgres: test-cleanup-postgres
	docker run -d --name authorizer_postgres -p 5434:5432 -e POSTGRES_PASSWORD=postgres -e POSTGRES_DB=postgres postgres
	@# Wait for readiness, then ALWAYS tear the container down — including when
	@# the tests fail — and exit with the TESTS' status, not the teardown's.
	@# Previously `sleep N` guessed at readiness and `docker rm` sat on its own
	@# recipe line, so a failing test aborted the recipe before teardown and left
	@# the port bound, breaking the NEXT run for an unrelated reason.
	sh scripts/wait-for-test-dbs.sh postgres && \
	{ go clean --testcache; TEST_DBS="postgres" $(GO_TEST_ALL); }; \
	status=$$?; \
	docker rm -vf authorizer_postgres; \
	exit $$status

test-sqlite:
	go clean --testcache && TEST_DBS="sqlite" $(GO_TEST_ALL)

test-mongodb: test-cleanup-mongodb
	docker run -d --name authorizer_mongodb_db -p 27017:27017 mongo:4.4.15
	@# Wait for readiness, then ALWAYS tear the container down — including when
	@# the tests fail — and exit with the TESTS' status, not the teardown's.
	@# Previously `sleep N` guessed at readiness and `docker rm` sat on its own
	@# recipe line, so a failing test aborted the recipe before teardown and left
	@# the port bound, breaking the NEXT run for an unrelated reason.
	sh scripts/wait-for-test-dbs.sh mongodb && \
	{ go clean --testcache; TEST_DBS="mongodb" $(GO_TEST_ALL); }; \
	status=$$?; \
	docker rm -vf authorizer_mongodb_db; \
	exit $$status

test-scylladb: test-cleanup-scylladb
	docker run -d --name authorizer_scylla_db -p 9042:9042 scylladb/scylla
	@# Wait for readiness, then ALWAYS tear the container down — including when
	@# the tests fail — and exit with the TESTS' status, not the teardown's.
	@# Previously `sleep N` guessed at readiness and `docker rm` sat on its own
	@# recipe line, so a failing test aborted the recipe before teardown and left
	@# the port bound, breaking the NEXT run for an unrelated reason.
	sh scripts/wait-for-test-dbs.sh scylladb && \
	{ go clean --testcache; TEST_DBS="scylladb" $(GO_TEST_ALL); }; \
	status=$$?; \
	docker rm -vf authorizer_scylla_db; \
	exit $$status

test-arangodb: test-cleanup-arangodb
	docker run -d --name authorizer_arangodb -p 8529:8529 -e ARANGO_NO_AUTH=1 arangodb/arangodb:3.10.3
	@# Wait for readiness, then ALWAYS tear the container down — including when
	@# the tests fail — and exit with the TESTS' status, not the teardown's.
	@# Previously `sleep N` guessed at readiness and `docker rm` sat on its own
	@# recipe line, so a failing test aborted the recipe before teardown and left
	@# the port bound, breaking the NEXT run for an unrelated reason.
	sh scripts/wait-for-test-dbs.sh arangodb && \
	{ go clean --testcache; TEST_DBS="arangodb" $(GO_TEST_ALL); }; \
	status=$$?; \
	docker rm -vf authorizer_arangodb; \
	exit $$status

test-dynamodb: test-cleanup-dynamodb
	docker run -d --name authorizer_dynamodb -p 8000:8000 amazon/dynamodb-local:latest
	@# Wait for readiness, then ALWAYS tear the container down — including when
	@# the tests fail — and exit with the TESTS' status, not the teardown's.
	@# Previously `sleep N` guessed at readiness and `docker rm` sat on its own
	@# recipe line, so a failing test aborted the recipe before teardown and left
	@# the port bound, breaking the NEXT run for an unrelated reason.
	sh scripts/wait-for-test-dbs.sh dynamodb && \
	{ go clean --testcache; TEST_DBS="dynamodb" $(GO_TEST_ALL); }; \
	status=$$?; \
	docker rm -vf authorizer_dynamodb; \
	exit $$status

test-couchbase: test-cleanup-couchbase
	docker run -d --name authorizer_couchbase -p 8091-8097:8091-8097 -p 11210:11210 -p 11207:11207 -p 18091-18095:18091-18095 -p 18096:18096 -p 18097:18097 couchbase:latest
	@# couchbase-test.sh already provisions and waits, so no readiness poll
	@# here — but the teardown still has to survive a failing test run.
	sh scripts/couchbase-test.sh && \
	{ go clean --testcache; TEST_DBS="couchbase" $(GO_TEST_ALL); }; \
	status=$$?; \
	docker rm -vf authorizer_couchbase; \
	exit $$status

# Prerequisites are `test-cleanup test-docker-up`, NOT
# `test-cleanup test-docker-up test-cleanup`. The trailing duplicate looked like
# "tear down afterwards" but never did anything: make deduplicates prerequisites,
# so it silently collapsed into the leading one. Teardown belongs in the recipe,
# below, where it can also run when the tests FAIL.
test-all-db: test-cleanup test-docker-up
	@# Always tear the containers down, including on failure, and exit with the
	@# TESTS' status rather than the teardown's.
	@#
	@# `go test ... ; make test-cleanup` (two recipe lines) aborted the recipe on
	@# a failing test and never reached cleanup, leaking seven containers and
	@# leaving ports 5434/27017/9042/8529/8000/8091 bound — so the NEXT run
	@# failed to start them and produced a second, misleading failure. Same
	@# capture-status-then-clean shape the e2e-playground target already uses.
	go clean --testcache; \
	TEST_DBS="couchbase,postgres,sqlite,mongodb,arangodb,scylladb,dynamodb" $(GO_TEST_ALL); \
	status=$$?; \
	$(MAKE) test-cleanup; \
	exit $$status

# Start all test database containers
test-docker-up:
	docker run -d --name authorizer_redis -p 6380:6379 redis
	docker run -d --name authorizer_postgres -p 5434:5432 -e POSTGRES_PASSWORD=postgres -e POSTGRES_DB=postgres postgres
	docker run -d --name authorizer_mongodb_db -p 27017:27017 mongo:4.4.15
	docker run -d --name authorizer_scylla_db -p 9042:9042 scylladb/scylla
	docker run -d --name authorizer_arangodb -p 8529:8529 -e ARANGO_NO_AUTH=1 arangodb/arangodb:3.10.3
	docker run -d --name authorizer_dynamodb -p 8000:8000 amazon/dynamodb-local:latest
	docker run -d --name authorizer_couchbase -p 8091-8097:8091-8097 -p 11210:11210 -p 11207:11207 -p 18091-18095:18091-18095 -p 18096:18096 -p 18097:18097 couchbase:latest
	sh scripts/couchbase-test.sh
	sh scripts/wait-for-test-dbs.sh

# Remove all test database containers
test-cleanup:
	-docker rm -vf authorizer_postgres
	-docker rm -vf authorizer_scylla_db
	-docker rm -vf authorizer_mongodb_db
	-docker rm -vf authorizer_arangodb
	-docker rm -vf authorizer_dynamodb
	-docker rm -vf authorizer_couchbase
	-docker rm -vf authorizer_redis

test-cleanup-postgres:
	-docker rm -vf authorizer_postgres
test-cleanup-mongodb:
	-docker rm -vf authorizer_mongodb_db
test-cleanup-scylladb:
	-docker rm -vf authorizer_scylla_db
test-cleanup-arangodb:
	-docker rm -vf authorizer_arangodb
test-cleanup-dynamodb:
	-docker rm -vf authorizer_dynamodb
test-cleanup-couchbase:
	-docker rm -vf authorizer_couchbase
generate-graphql:
	go run github.com/99designs/gqlgen --verbose generate && go mod tidy
generate-db-template:
	cp -rf internal/storage/db/provider_template internal/storage/db/${dbname}
	find internal/storage/db/${dbname} -type f -exec sed -i -e 's/provider_template/${dbname}/g' {} \;

# ----------------------------------------------------------------------------
# Protobuf (Phase 0+): public-API source of truth under ./proto.
# `buf` is installed on demand into $(GOBIN) if missing.
# ----------------------------------------------------------------------------
BUF ?= $(shell command -v buf 2>/dev/null)
BUF_VERSION ?= v1.47.2

.PHONY: proto-tools proto-lint proto-breaking proto-gen proto-check proto-gen-clients proto-check-clients

proto-tools:
	@if [ -z "$(BUF)" ]; then \
		echo "Installing buf $(BUF_VERSION) via go install"; \
		go install github.com/bufbuild/buf/cmd/buf@$(BUF_VERSION); \
	fi

proto-lint: proto-tools
	cd proto && buf lint

# Compare the working tree's proto against origin/main; fails on breaking changes.
# Override BUF_BREAKING_AGAINST for local runs (e.g. "main" or a SHA).
# The `#` must stay escaped: make treats a bare one as a comment, which silently
# truncated this to `.git` — no subdir, so every import failed to resolve, and
# no branch, so it compared against the working tree rather than origin/main.
BUF_BREAKING_AGAINST ?= .git\#branch=origin/main,subdir=proto
proto-breaking: proto-tools
	cd proto && buf breaking --against '../$(BUF_BREAKING_AGAINST)'

proto-gen: proto-tools
	cd proto && buf dep update && buf generate

# Fail when proto sources changed but gen/ was not regenerated and committed.
proto-check: proto-gen
	@git diff --exit-code -- gen/ || (echo "gen/ is stale; run make proto-gen and commit the result" && exit 1)

# Client-SDK stub generation (separate template from proto-gen above). Outputs
# gen/ts, vendored into authorizer-js. Go and Python stubs are no longer
# generated here — they live in the dedicated authorizer-proto-go /
# authorizer-proto-python packages (BSR-driven, consumed as real dependencies).
# NOT covered by proto-gen/proto-check, so gen/ts needs its own staleness gate.
proto-gen-clients: proto-tools
	cd proto && buf dep update && buf generate --template buf.gen.clients.yaml --include-imports

# Fail when proto sources changed but the vendored TS stubs were not
# regenerated and committed.
proto-check-clients: proto-gen-clients
	@git diff --exit-code -- gen/ts || (echo "client SDK stubs (gen/ts) are stale; run make proto-gen-clients and commit the result" && exit 1)

# ----------------------------------------------------------------------------
# Formatting & linting (Go + TypeScript). `make fmt` before committing,
# `make lint` in CI. golangci-lint is installed on demand if missing.
# ----------------------------------------------------------------------------
GOLANGCI_LINT ?= $(shell command -v golangci-lint 2>/dev/null)
GOLANGCI_LINT_VERSION ?= v2.11.4

.PHONY: fmt fmt-go fmt-ts lint lint-go lint-ts lint-tools

# Format everything.
fmt: fmt-go fmt-ts

# gofmt -s over all hand-written Go sources (generated protobuf output under
# gen/ is excluded — it is owned by buf).
fmt-go:
	@gofmt -s -w $(shell find . -type f -name '*.go' -not -path './gen/*')

# Prettier over both web apps via their configured format scripts.
fmt-ts:
	cd web/app && npm run format
	cd web/dashboard && npm run format

# Lint everything.
lint: lint-go lint-ts

lint-tools:
	@if [ -z "$(GOLANGCI_LINT)" ]; then \
		echo "Installing golangci-lint $(GOLANGCI_LINT_VERSION)"; \
		go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@$(GOLANGCI_LINT_VERSION); \
	fi

# golangci-lint over the module. Generated code under gen/ is excluded via
# .golangci.yml.
lint-go: lint-tools
	golangci-lint run ./...

# Prettier in --check mode: fails (non-zero) if any web source is unformatted.
lint-ts:
	cd web/app && npx prettier --check 'src/**/*.(ts|tsx|js|jsx)'
	cd web/dashboard && npx prettier --check 'src/**/*.(ts|tsx|js|jsx)'

# --- Performance testing (see perf/README.md) ---
# BASE_URL/VUS/DURATION/ADMIN_SECRET/CLIENT_ID/CLIENT_SECRET/TUPLES are read
# from the environment by the underlying k6 scripts; export before invoking.

# Embedded FGA engine in-process ceiling — no HTTP/DB round trip.
# Override background tuple volume: FGA_BENCH_TUPLES=1000000 make perf-fga-bench
.PHONY: perf-fga-bench
perf-fga-bench:
	go test ./internal/authorization/engine/openfga/... -run '^$$' -bench . -benchmem

.PHONY: perf-seed
perf-seed:
	k6 run perf/k6/seed_fga.js

.PHONY: perf-k6-login
perf-k6-login:
	k6 run perf/k6/login.js

.PHONY: perf-k6-s2s
perf-k6-s2s:
	k6 run perf/k6/s2s_client_credentials.js

.PHONY: perf-k6-validate
perf-k6-validate:
	k6 run perf/k6/validate_jwt.js

.PHONY: perf-k6-check
perf-k6-check:
	k6 run perf/k6/fga_check.js

.PHONY: e2e-playground
e2e-playground: ## Run the live-playground e2e suite (OIDC/SAML/SCIM/SSO/OAuth/MFA) against an ephemeral docker-compose stack
# The explicit `build` below is load-bearing: `docker compose up` builds an image
# only when one does not already exist, so without it a second run silently
# reuses the image from the FIRST run and the whole suite tests stale server
# code. `down -v` at the end removes containers and volumes, never images, so a
# stale image survives indefinitely. Building every service (rather than adding
# --build to the `up` list) covers the instances started implicitly through the
# playwright service's depends_on — authorizer-webauthn, -magic-link,
# -mfa-enforced, -mfa-magic-link, -replica-a/-b, webhook-sink — which are never
# named in the `up` line and so would otherwise never be rebuilt. Layer caching
# makes this close to free when nothing changed.
	export DOCKER_DEFAULT_PLATFORM=linux/$$(uname -m | sed -e 's/x86_64/amd64/' -e 's/aarch64/arm64/'); \
	docker compose -f e2e-playground/docker-compose.yml build; \
	status=$$?; \
	if [ $$status -eq 0 ]; then \
		docker compose -f e2e-playground/docker-compose.yml up -d --wait authorizer authorizer-sso authorizer-email-verify mock-oauth mock-saml-idp mailpit sms-sink; \
		status=$$?; \
	fi; \
	if [ $$status -eq 0 ]; then \
		docker compose -f e2e-playground/docker-compose.yml run --rm --build playwright npx playwright test; \
		status=$$?; \
	fi; \
	docker compose -f e2e-playground/docker-compose.yml down -v; \
	exit $$status

.PHONY: e2e-playground-sdk
e2e-playground-sdk: ## Run the SDK-driven Go suite (drives authorizer-go over the enterprise/MFA surface) against an ephemeral docker-compose stack
	export DOCKER_DEFAULT_PLATFORM=linux/$$(uname -m | sed -e 's/x86_64/amd64/' -e 's/aarch64/arm64/'); \
	docker compose -f e2e-playground/docker-compose.yml up -d --wait --build authorizer authorizer-webauthn authorizer-mfa-enforced authorizer-mfa-magic-link mock-oauth mock-saml-idp mailpit sms-sink webhook-sink; \
	status=$$?; \
	if [ $$status -eq 0 ]; then \
		docker compose -f e2e-playground/docker-compose.yml run --rm --build go-sdk-tests; \
		status=$$?; \
	fi; \
	docker compose -f e2e-playground/docker-compose.yml down -v; \
	exit $$status