#!/bin/bash
# Formal direct-download release guardrail for Aligner.
# This script is intentionally separate from package-app.sh, which remains the
# local QA package entry and may use ad-hoc or local-only signing.

set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
OUTPUT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
SOURCE_ROOT="$OUTPUT_ROOT/C1.source"
INFO_PLIST="$SOURCE_ROOT/Resources/Aligner-Info.plist"

fail() {
  echo "release-app.sh failed: $*" >&2
  exit 1
}

usage() {
  cat <<'USAGE'
Usage:
  03-O/C3.tools/release-app.sh --check-tools
  03-O/C3.tools/release-app.sh --check-config
  03-O/C3.tools/release-app.sh --check-notary-profile

Required environment for a real public release:
  ALIGNER_DEVELOPER_IDENTITY="Developer ID Application: ..."
  ALIGNER_NOTARY_PROFILE="<notarytool keychain profile>"
  ALIGNER_RELEASE_GITHUB_REPOSITORY="<owner/repo>"

Phase 1 currently establishes release-chain guardrails only. It refuses to
produce a public release until Developer ID signing, notarization, stapling,
Gatekeeper validation, manifest generation, and upload policy are all wired.
USAGE
}

read_plist_value() {
  /usr/libexec/PlistBuddy -c "Print :$1" "$INFO_PLIST" 2>/dev/null \
    || fail "unable to read $1 from $INFO_PLIST"
}

assert_tool() {
  command -v "$1" >/dev/null 2>&1 || fail "missing required tool: $1"
}

assert_xcrun_tool() {
  xcrun --find "$1" >/dev/null 2>&1 || fail "missing required xcrun tool: $1"
}

assert_tools() {
  assert_tool codesign
  assert_tool hdiutil
  assert_tool shasum
  assert_tool spctl
  assert_tool xcrun
  assert_xcrun_tool notarytool
  assert_xcrun_tool stapler

  echo "Release tools OK"
}

assert_config() {
  local version
  local build
  local minimum_macos

  assert_tools

  version="$(read_plist_value CFBundleShortVersionString)"
  build="$(read_plist_value CFBundleVersion)"
  minimum_macos="$(read_plist_value LSMinimumSystemVersion)"

  [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] \
    || fail "CFBundleShortVersionString must be MAJOR.MINOR.PATCH, got: $version"
  [[ "$build" =~ ^[0-9]{8}\.[0-9]{4}$ ]] \
    || fail "CFBundleVersion must be YYYYMMDD.HHMM, got: $build"
  [[ "$minimum_macos" =~ ^[0-9]+(\.[0-9]+)?$ ]] \
    || fail "LSMinimumSystemVersion must be numeric, got: $minimum_macos"
  [ "$minimum_macos" = "14.0" ] \
    || fail "LSMinimumSystemVersion must be 14.0 for Round01.5 macOS 14 compatibility, got: $minimum_macos"

  if [ -z "${ALIGNER_DEVELOPER_IDENTITY:-}" ]; then
    fail "missing ALIGNER_DEVELOPER_IDENTITY; formal releases must use Developer ID Application signing"
  fi
  if [[ "${ALIGNER_DEVELOPER_IDENTITY:-}" != Developer\ ID\ Application:* ]]; then
    fail "ALIGNER_DEVELOPER_IDENTITY must start with 'Developer ID Application:'"
  fi
  if [ -z "${ALIGNER_NOTARY_PROFILE:-}" ]; then
    fail "missing ALIGNER_NOTARY_PROFILE; formal releases must use notarytool"
  fi
  if [ -z "${ALIGNER_RELEASE_GITHUB_REPOSITORY:-}" ]; then
    fail "missing ALIGNER_RELEASE_GITHUB_REPOSITORY; expected owner/repo for GitHub Releases"
  fi
  if [[ "${ALIGNER_RELEASE_GITHUB_REPOSITORY:-}" != */* ]]; then
    fail "ALIGNER_RELEASE_GITHUB_REPOSITORY must use owner/repo format"
  fi

  echo "Release config OK for Aligner $version build $build, minimum macOS $minimum_macos"
}

assert_notary_profile() {
  assert_config

  xcrun notarytool history \
    --keychain-profile "$ALIGNER_NOTARY_PROFILE" \
    --output-format json >/dev/null 2>&1 \
    || fail "notarytool profile is not usable: $ALIGNER_NOTARY_PROFILE"

  echo "Notary profile OK: $ALIGNER_NOTARY_PROFILE"
}

case "${1:-}" in
  --check-tools)
    assert_tools
    ;;
  --check-config)
    assert_config
    ;;
  --check-notary-profile)
    assert_notary_profile
    ;;
  -h|--help)
    usage
    ;;
  "")
    assert_config
    fail "formal release packaging is not enabled in Phase 1 skeleton yet"
    ;;
  *)
    usage
    fail "unknown argument: $1"
    ;;
esac