.PHONY: install dev test lint format type-check security coverage clean \
       docker-build docker-up docker-down sign-flows verify-flows \
       help check-all

PYTHON   ?= python3
PIP      ?= pip
VENV     ?= .venv
SRC_DIR  := src/kore_platform
TEST_DIR := tests
FLOW_DIR := flows

# Default target
help: ## Show this help
	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | \
		awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-18s\033[0m %s\n", $$1, $$2}'

# ---------------------------------------------------------------------------
# Installation
# ---------------------------------------------------------------------------
install: ## Install core dependencies
	$(PIP) install -e .

dev: ## Install all dependencies including dev tools
	$(PIP) install -e ".[all,dev]"
	pre-commit install
	@echo "\n\033[32mDevelopment environment ready.\033[0m"

# ---------------------------------------------------------------------------
# Quality
# ---------------------------------------------------------------------------
lint: ## Run linters (ruff)
	ruff check $(SRC_DIR) $(TEST_DIR) scripts/
	ruff format --check $(SRC_DIR) $(TEST_DIR) scripts/

format: ## Auto-format code
	ruff check --fix $(SRC_DIR) $(TEST_DIR) scripts/
	ruff format $(SRC_DIR) $(TEST_DIR) scripts/

type-check: ## Run static type checking (mypy)
	mypy $(SRC_DIR)

security: ## Run security checks (bandit via ruff S rules + pip-audit)
	ruff check --select S $(SRC_DIR)
	@command -v pip-audit >/dev/null 2>&1 && pip-audit || \
		echo "pip-audit not installed -- skipping dependency audit"

# ---------------------------------------------------------------------------
# Testing
# ---------------------------------------------------------------------------
test: ## Run test suite
	pytest $(TEST_DIR) -v

coverage: ## Run tests with coverage report
	pytest $(TEST_DIR) \
		--cov=$(SRC_DIR) \
		--cov-report=term-missing \
		--cov-report=html \
		--cov-report=xml:coverage.xml \
		-v

# ---------------------------------------------------------------------------
# Combined checks
# ---------------------------------------------------------------------------
check-all: lint type-check test ## Run all quality gates (lint + type-check + test)

# ---------------------------------------------------------------------------
# Flow signing
# ---------------------------------------------------------------------------
sign-flows: ## Cryptographically sign all YAML flows
	@if [ -z "$$KORE_SIGNING_KEY" ]; then \
		echo "\033[31mError: KORE_SIGNING_KEY env var not set\033[0m"; exit 1; \
	fi
	$(PYTHON) scripts/sign_flows.py

verify-flows: ## Verify all flow signatures
	$(PYTHON) scripts/verify_signatures.py

# ---------------------------------------------------------------------------
# Docker
# ---------------------------------------------------------------------------
docker-build: ## Build Docker images
	docker compose -f docker/docker-compose.yml build

docker-up: ## Start development containers
	docker compose -f docker/docker-compose.yml up -d
	@echo "\n\033[32mServices running. App: http://localhost:8000\033[0m"

docker-down: ## Stop development containers
	docker compose -f docker/docker-compose.yml down -v

# ---------------------------------------------------------------------------
# Cleanup
# ---------------------------------------------------------------------------
clean: ## Remove build artifacts, caches, and temp files
	rm -rf build/ dist/ *.egg-info .eggs/
	rm -rf .pytest_cache/ .mypy_cache/ .ruff_cache/
	rm -rf htmlcov/ coverage.xml .coverage .coverage.*
	find . -type d -name __pycache__ -exec rm -rf {} + 2>/dev/null || true
	find . -type f -name "*.pyc" -delete 2>/dev/null || true
	@echo "\033[32mClean.\033[0m"
