Makefile

# Canonical versions pinned across multiple Dockerfiles. The Dockerfiles carry
# matching ARG defaults so external builders work unaided; this exports the value
# so compose overrides them from one place. Export only this, not every variable.
include build-versions.env
export INFISICAL_CLI_VERSION

build:
	docker-compose -f docker-compose.yml build

push:
	docker-compose -f docker-compose.yml push

up-dev:
	docker compose -f docker-compose.dev.yml up --build

up-dev-metrics:
	docker compose -f docker-compose.dev.yml --profile metrics up --build

up-prod:
	docker compose -f docker-compose.prod.yml up --build

down:
	docker compose -f docker-compose.dev.yml down

# Wipes the persisted Vite dep-prebundle cache. Reach for this when the dev server serves
# stale or broken /node_modules/.vite/deps chunks; it re-optimizes on the next `make up-dev`.
COMPOSE_PROJECT_NAME ?= $(notdir $(CURDIR))
# docker compose normalizes the project name (lowercased, chars outside [a-z0-9_-] dropped)
# before prefixing volume names, so normalize it the same way to match dirs like PLATFOR-532.
COMPOSE_VOLUME_PREFIX = $(shell echo '$(COMPOSE_PROJECT_NAME)' | tr '[:upper:]' '[:lower:]' | tr -cd 'a-z0-9_-')
clear-frontend-cache:
	docker compose -f docker-compose.dev.yml rm -sf frontend
	docker volume rm -f $(COMPOSE_VOLUME_PREFIX)_frontend_vite_cache

reviewable-ui:
	cd frontend && \
	npm run lint:fix && \
	npm run type:check

reviewable-api:
	cd backend && \
	npm run lint:fix && \
	npm run type:check

reviewable: reviewable-ui reviewable-api

# The API suites run against the throwaway stack in docker-compose.test.yml, never the dev one.
# That is not a preference: the e2e harness runs `DROP SCHEMA public CASCADE` on whatever
# database it is pointed at, so aiming it at the dev database takes your data with it.
# Everything else (image, environment, mounts, service dependencies) is declared there.
TEST_SUITE_COMPOSE = docker compose -f docker-compose.test.yml --profile runner
# The secret rotation specs reach these by service name on the shared test network, which is why
# docker-compose.e2e-dbs.yml pins the same compose project. A full suite run needs them up; the
# rest of the specs do not, and the Oracle image is large, so they are a separate target.
ROTATION_DB_COMPOSE = docker compose -f docker-compose.e2e-dbs.yml

build-test-suite-image:
	$(TEST_SUITE_COMPOSE) build api-tests

# Only needed to run a suite from the host, against the published ports in .env.test.
# `make test-api-e2e` starts them itself and waits for them to report healthy.
up-test-suite-containers:
	$(TEST_SUITE_COMPOSE) up -d --wait db redis

# Needed only for a full suite run, and only for the secret rotation specs.
up-rotation-databases:
	$(ROTATION_DB_COMPOSE) up -d --wait --wait-timeout 300

# Shares a compose project with the test stack, so this removes the rotation databases too.
down-test-suite-containers:
	$(TEST_SUITE_COMPOSE) down -v

# Narrow a run with SPEC=<pattern>, e.g. `make test-api-e2e SPEC=secret-sync`.
test-api-unit: build-test-suite-image
	$(TEST_SUITE_COMPOSE) run --rm api-tests npm run test:unit -- $(SPEC)

test-api-e2e: build-test-suite-image
	$(TEST_SUITE_COMPOSE) run --rm api-tests npm run test:e2e -- $(SPEC)

test-api: test-api-unit test-api-e2e

lint-docs:
	@./docs/scripts/lint-docs.sh --all

lint-docs-branch:
	@./docs/scripts/lint-docs.sh --changed

up-dev-oidc:
	docker compose -f docker-compose.dev.yml --profile oidc up --build

up-dev-ldap:
	docker compose -f docker-compose.dev.yml --profile ldap up --build

up-dev-saml:
	docker compose -f docker-compose.dev.yml --profile saml up --build

up-dev-pingfed:
	docker compose -f docker-compose.dev.yml --profile pingfed up --build

up-dev-ad:
	docker compose -f docker-compose.dev.yml --profile ad up --build

seed-dev-ad:
	docker compose -f docker-compose.dev.yml exec samba-ad bash -c '\
	  samba-tool domain trust namespaces --add-upn-suffix=infisical.com 2>/dev/null || true; \
	  samba-tool user delete jdoe 2>/dev/null || true; \
	  samba-tool user delete asmith 2>/dev/null || true; \
	  samba-tool group delete infisical-users 2>/dev/null || true; \
	  samba-tool user create jdoe "password123!" --given-name=John --surname=Doe --mail-address=jdoe@infisical.com; \
	  samba-tool user create asmith "password123!" --given-name=Alice --surname=Smith --mail-address=asmith@infisical.com; \
	  samba-tool user rename jdoe --upn=jdoe@infisical.com; \
	  samba-tool user rename asmith --upn=asmith@infisical.com; \
	  samba-tool group add infisical-users; \
	  samba-tool group addmembers infisical-users jdoe,asmith \
	'

seed-dev-ldap:
	# Seeds OpenLDAP entries (idempotent) and the Infisical side for LDAP SSO testing: an
	# ldap@infisical.com admin, a verified domain, and an active LDAP config. With ORG_ID=<uuid>
	# it configures that org; otherwise it bootstraps a dedicated `ldap` org. Needs the stack up
	# (`make up-dev-ldap`).
	@docker compose -f docker-compose.dev.yml exec -T openldap \
	  ldapadd -c -x -D "cn=admin,dc=ldap,dc=com" -w admin < docker/openldap/bootstrap.ldif; \
	  status=$$?; \
	  if [ $$status -ne 0 ] && [ $$status -ne 68 ]; then exit $$status; fi; \
	  if [ $$status -eq 68 ]; then echo "LDAP entries already exist, continuing."; fi
	docker compose -f docker-compose.dev.yml exec -T backend npx tsx ./src/db/seed-ldap.ts $(ORG_ID)

seed-dev-oidc:
	# Sets up the Infisical side for OIDC SSO testing: an admin@oidc.com admin, a verified
	# domain, and an active OIDC config. With ORG_ID=<uuid> it configures that existing org;
	# otherwise it bootstraps a dedicated `oidc` org. Needs the stack up (`make up-dev-oidc`).
	docker compose -f docker-compose.dev.yml exec -T backend npx tsx ./src/db/seed-oidc.ts $(ORG_ID)

seed-dev-saml:
	# Sets up SAML SSO + real SCIM provisioning against the local Authentik IdP. Bootstraps a
	# dedicated `saml` org (admin@saml.com, verified saml.com domain, active SAML config, SCIM token),
	# configures Authentik (SAML + SCIM providers, app, john/alice@saml.com), and provisions those
	# users into Infisical via SCIM. Needs the stack up (`make up-dev-saml`).
	docker compose -f docker-compose.dev.yml exec -T backend npx tsx ./src/db/seed-saml.ts


# Golang commands
go-generate:
	cd backend-go && \
	goa gen github.com/infisical/api/internal/server/design -o ./internal/server/

validate-upgrade-impact:
	cd upgrade-impact && \
	npm run type:check && \
	npm test && \
	npm run validate

generate-upgrade-impact:
ifndef TAG
	$(error TAG is required. Usage: make generate-upgrade-impact TAG=v0.159.23)
endif
	cd upgrade-impact && \
	npm run generate -- --tag $(TAG)

generate-upgrade-impact-dry-run:
ifndef TAG
	$(error TAG is required. Usage: make generate-upgrade-impact-dry-run TAG=v0.159.23)
endif
	cd upgrade-impact && \
	npm run generate:dry-run -- --tag $(TAG)