#!/bin/bash
# Report the local code signing identity that package-app.sh will use.

set -euo pipefail

PREFERRED_IDENTITY="Aligner Local Code Signing"
REQUESTED_IDENTITY="${ALIGNER_CODE_SIGN_IDENTITY:-}"
IDENTITIES="$(security find-identity -v -p codesigning 2>/dev/null || true)"

if [ -n "$REQUESTED_IDENTITY" ]; then
  SELECTED_IDENTITY="$REQUESTED_IDENTITY"
  SELECTION_REASON="ALIGNER_CODE_SIGN_IDENTITY"
elif echo "$IDENTITIES" | grep -Fq "\"$PREFERRED_IDENTITY\""; then
  SELECTED_IDENTITY="$PREFERRED_IDENTITY"
  SELECTION_REASON="preferred project identity"
else
  SELECTED_IDENTITY="$(echo "$IDENTITIES" | sed -n 's/.*"\([^"]*Local Code Signing\)".*/\1/p' | head -n 1)"
  SELECTION_REASON="fallback local identity"
fi

echo "Signing identity check"

if [ -z "$SELECTED_IDENTITY" ]; then
  echo "  selected: ad-hoc"
  echo "  risk: TCC permissions may reset after rebuilds"
  exit 0
fi

if ! echo "$IDENTITIES" | grep -Fq "\"$SELECTED_IDENTITY\""; then
  echo "  selected: $SELECTED_IDENTITY"
  echo "  error: selected identity is not available in this keychain" >&2
  exit 1
fi

echo "  selected: $SELECTED_IDENTITY"
echo "  reason: $SELECTION_REASON"

if [ "$SELECTED_IDENTITY" != "$PREFERRED_IDENTITY" ]; then
  echo "  warning: preferred project identity '$PREFERRED_IDENTITY' is not active"
fi