#!/usr/bin/env bash
#
# build-macappstore-pkg-macos.sh - Build a Mac App Store upload package.
#
# This script uses the App Store sandbox build path, signs the app with an
# Apple-issued distribution identity, embeds the Mac App Store provisioning
# profile, then packages the app as a signed .pkg for App Store Connect upload.
#
# Required environment:
#   PRIVATEVOICE_APPSTORE_APP_IDENTITY
#     Example: "Apple Distribution: Example Team (TEAMID)"
#     Legacy:  "3rd Party Mac Developer Application: Example Team (TEAMID)"
#
#   PRIVATEVOICE_APPSTORE_INSTALLER_IDENTITY
#     Example: "3rd Party Mac Developer Installer: Example Team (TEAMID)"
#
#   PRIVATEVOICE_APPSTORE_PROVISIONING_PROFILE
#     Path to the Mac App Store provisioning profile for com.shanghai3168.privatevoicedictation.
#
# Optional environment:
#   PRIVATEVOICE_SIGNING_KEYCHAIN
#   PRIVATEVOICE_APPSTORE_MIN_SYSTEM_VERSION (default: 13.4)
#
# Usage:
#   cd privatevoice.src
#   PRIVATEVOICE_APPSTORE_APP_IDENTITY="Apple Distribution: ..." \
#   PRIVATEVOICE_APPSTORE_INSTALLER_IDENTITY="3rd Party Mac Developer Installer: ..." \
#   PRIVATEVOICE_APPSTORE_PROVISIONING_PROFILE="/path/to/profile.provisionprofile" \
#     ./scripts/build-macappstore-pkg-macos.sh arm64
#
set -euo pipefail

APP_NAME="PrivateVoice Dictation"
APPSTORE_APP_IDENTITY="${PRIVATEVOICE_APPSTORE_APP_IDENTITY:-}"
APPSTORE_INSTALLER_IDENTITY="${PRIVATEVOICE_APPSTORE_INSTALLER_IDENTITY:-}"
APPSTORE_PROVISIONING_PROFILE="${PRIVATEVOICE_APPSTORE_PROVISIONING_PROFILE:-}"
SIGNING_KEYCHAIN="${PRIVATEVOICE_SIGNING_KEYCHAIN:-}"
APPSTORE_MIN_SYSTEM_VERSION="${PRIVATEVOICE_APPSTORE_MIN_SYSTEM_VERSION:-13.4}"

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
PROJECT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"

INFO_PLIST="$PROJECT_DIR/build/darwin/Info.plist"
BASE_ENTITLEMENTS="$PROJECT_DIR/build/darwin/entitlements-appstore.plist"
GOMODCACHE="$(go env GOMODCACHE)"
SHERPA_MACOS_MODULE_VERSION="$(cd "$PROJECT_DIR" && go list -m -f '{{.Version}}' github.com/k2-fsa/sherpa-onnx-go-macos)"

VERSION="$(defaults read "$INFO_PLIST" CFBundleShortVersionString 2>/dev/null || echo "2.1.0")"
BUILD_ID="$(defaults read "$INFO_PLIST" CFBundleVersion 2>/dev/null || date +%Y%m%d.%H%M)"
BUNDLE_ID="$(defaults read "$INFO_PLIST" CFBundleIdentifier 2>/dev/null || echo "")"

step() {
  echo ""
  echo "==> $1"
}

fail() {
  echo "ERROR: $1" >&2
  exit 1
}

security_find_code_identities() {
  if [[ -n "$SIGNING_KEYCHAIN" ]]; then
    security find-identity -v -p codesigning "$SIGNING_KEYCHAIN"
  else
    security find-identity -v -p codesigning
  fi
}

security_find_installer_identities() {
  # Installer identities are not codesigning identities; do not filter with -p.
  if [[ -n "$SIGNING_KEYCHAIN" ]]; then
    security find-identity -v "$SIGNING_KEYCHAIN"
  else
    security find-identity -v
  fi
}

resolve_arch() {
  local target="$1"
  case "$target" in
    arm64)
      GOARCH="arm64"
      SHERPA_ARCH="aarch64-apple-darwin"
      OUT_ARCH="arm64"
      ;;
    x86_64|amd64)
      GOARCH="amd64"
      SHERPA_ARCH="x86_64-apple-darwin"
      OUT_ARCH="x86_64"
      ;;
    *)
      fail "Unknown architecture: $target (use arm64 or x86_64)"
      ;;
  esac

  BUILD_DIR="$PROJECT_DIR/build/macappstore/$OUT_ARCH"
  APP_BUNDLE="$BUILD_DIR/$APP_NAME.app"
  PKG_PATH="$BUILD_DIR/PrivateVoice-Dictation-$VERSION-build$BUILD_ID-$OUT_ARCH-macappstore.pkg"
  SHERPA_LIB_DIR="$GOMODCACHE/github.com/k2-fsa/sherpa-onnx-go-macos@$SHERPA_MACOS_MODULE_VERSION/lib/$SHERPA_ARCH"
  ONNXRUNTIME_DYLIB=""
  ONNXRUNTIME_DYLIB_NAME=""
}

sign_plain() {
  local item="$1"
  codesign --force \
    --options runtime \
    --timestamp \
    --sign "$APPSTORE_APP_IDENTITY" \
    "$item"
}

sign_sandboxed() {
  local item="$1"
  codesign --force \
    --options runtime \
    --timestamp \
    --entitlements "$SIGNING_ENTITLEMENTS" \
    --sign "$APPSTORE_APP_IDENTITY" \
    "$item"
}

plist_set_string() {
  local plist="$1"
  local key="$2"
  local value="$3"
  /usr/libexec/PlistBuddy -c "Delete :$key" "$plist" >/dev/null 2>&1 || true
  /usr/libexec/PlistBuddy -c "Add :$key string $value" "$plist"
}

strip_extended_attributes() {
  local item="$1"
  if command -v xattr >/dev/null; then
    xattr -cr "$item" 2>/dev/null || true
  fi
}

assert_no_quarantine_attributes() {
  local item="$1"
  if command -v xattr >/dev/null; then
    local found
    found="$(xattr -lr "$item" 2>/dev/null | grep -F "com.apple.quarantine" | head -n 20 || true)"
    [[ -z "$found" ]] || fail "com.apple.quarantine attributes remain under $item:
$found"
  fi
}

TARGET_ARCH="${1:-$(uname -m)}"
resolve_arch "$TARGET_ARCH"

step "Preflight checks"
[[ -n "$APPSTORE_APP_IDENTITY" ]] || fail "PRIVATEVOICE_APPSTORE_APP_IDENTITY is required"
[[ -n "$APPSTORE_INSTALLER_IDENTITY" ]] || fail "PRIVATEVOICE_APPSTORE_INSTALLER_IDENTITY is required"
[[ -n "$APPSTORE_PROVISIONING_PROFILE" ]] || fail "PRIVATEVOICE_APPSTORE_PROVISIONING_PROFILE is required"
[[ -f "$APPSTORE_PROVISIONING_PROFILE" ]] || fail "Provisioning profile not found: $APPSTORE_PROVISIONING_PROFILE"
[[ -f "$INFO_PLIST" ]] || fail "Info.plist not found at $INFO_PLIST"
[[ -n "$BUNDLE_ID" ]] || fail "CFBundleIdentifier is missing from $INFO_PLIST"
[[ -f "$BASE_ENTITLEMENTS" ]] || fail "App Store entitlements not found at $BASE_ENTITLEMENTS"
[[ -f "$PROJECT_DIR/build/darwin/icon.icns" ]] || fail "icon.icns not found"
[[ -d "$SHERPA_LIB_DIR" ]] || fail "sherpa-onnx dylibs not found at $SHERPA_LIB_DIR"
ONNXRUNTIME_DYLIB="$(find "$SHERPA_LIB_DIR" -maxdepth 1 -type f -name 'libonnxruntime.*.dylib' | sort | tail -n 1)"
[[ -f "$ONNXRUNTIME_DYLIB" ]] || fail "onnxruntime dylib not found in $SHERPA_LIB_DIR"
ONNXRUNTIME_DYLIB_NAME="$(basename "$ONNXRUNTIME_DYLIB")"
security_find_code_identities | grep -Fq "$APPSTORE_APP_IDENTITY" ||
  fail "App Store app signing identity not found: $APPSTORE_APP_IDENTITY"
security_find_installer_identities | grep -Fq "$APPSTORE_INSTALLER_IDENTITY" ||
  fail "App Store installer signing identity not found: $APPSTORE_INSTALLER_IDENTITY"
command -v productbuild >/dev/null || fail "productbuild not found"
command -v pkgutil >/dev/null || fail "pkgutil not found"

PROFILE_PLIST="$(mktemp)"
SIGNING_ENTITLEMENTS="$(mktemp)"
trap 'rm -f "$PROFILE_PLIST" "$SIGNING_ENTITLEMENTS"' EXIT
security cms -D -i "$APPSTORE_PROVISIONING_PROFILE" >"$PROFILE_PLIST" ||
  fail "Unable to decode provisioning profile: $APPSTORE_PROVISIONING_PROFILE"
PROFILE_APP_IDENTIFIER="$(/usr/libexec/PlistBuddy -c "Print :Entitlements:com.apple.application-identifier" "$PROFILE_PLIST" 2>/dev/null || true)"
PROFILE_TEAM_IDENTIFIER="$(/usr/libexec/PlistBuddy -c "Print :Entitlements:com.apple.developer.team-identifier" "$PROFILE_PLIST" 2>/dev/null || true)"
PROFILE_KEYCHAIN_GROUP="$(/usr/libexec/PlistBuddy -c "Print :Entitlements:keychain-access-groups:0" "$PROFILE_PLIST" 2>/dev/null || true)"
PROFILE_BUNDLE_ID="${PROFILE_APP_IDENTIFIER#*.}"
[[ "$PROFILE_BUNDLE_ID" == "$BUNDLE_ID" ]] ||
  fail "Provisioning profile bundle ID mismatch: profile has $PROFILE_BUNDLE_ID, app has $BUNDLE_ID"
[[ -n "$PROFILE_TEAM_IDENTIFIER" ]] || fail "Provisioning profile missing com.apple.developer.team-identifier entitlement"

cp "$BASE_ENTITLEMENTS" "$SIGNING_ENTITLEMENTS"
plist_set_string "$SIGNING_ENTITLEMENTS" "com.apple.application-identifier" "$PROFILE_APP_IDENTIFIER"
plist_set_string "$SIGNING_ENTITLEMENTS" "com.apple.developer.team-identifier" "$PROFILE_TEAM_IDENTIFIER"
if [[ -n "$PROFILE_KEYCHAIN_GROUP" ]]; then
  /usr/libexec/PlistBuddy -c "Delete :keychain-access-groups" "$SIGNING_ENTITLEMENTS" >/dev/null 2>&1 || true
  /usr/libexec/PlistBuddy -c "Add :keychain-access-groups array" "$SIGNING_ENTITLEMENTS"
  /usr/libexec/PlistBuddy -c "Add :keychain-access-groups:0 string $PROFILE_KEYCHAIN_GROUP" "$SIGNING_ENTITLEMENTS"
fi

step "Cleaning old Mac App Store build"
rm -rf "$BUILD_DIR"
mkdir -p "$BUILD_DIR"

step "Building frontend"
cd "$PROJECT_DIR/frontend"
if [[ ! -d node_modules ]]; then
  npm ci --prefer-offline
fi
npm run build

step "Building Go binary ($OUT_ARCH, appstore tag)"
cd "$PROJECT_DIR"
CGO_ENABLED=1 GOOS=darwin GOARCH="$GOARCH" \
  MACOSX_DEPLOYMENT_TARGET="$APPSTORE_MIN_SYSTEM_VERSION" \
  CGO_CFLAGS="${CGO_CFLAGS:-} -mmacosx-version-min=$APPSTORE_MIN_SYSTEM_VERSION" \
  CGO_LDFLAGS="${CGO_LDFLAGS:-} -mmacosx-version-min=$APPSTORE_MIN_SYSTEM_VERSION" \
  go build -tags appstore -buildvcs=false -gcflags=all="-l" -ldflags="-s -w" \
  -o "$BUILD_DIR/$APP_NAME"

step "Assembling $APP_NAME.app"
mkdir -p "$APP_BUNDLE/Contents/MacOS"
mkdir -p "$APP_BUNDLE/Contents/Frameworks"
mkdir -p "$APP_BUNDLE/Contents/Resources"

cp "$INFO_PLIST" "$APP_BUNDLE/Contents/Info.plist"
/usr/libexec/PlistBuddy -c "Set :LSMinimumSystemVersion $APPSTORE_MIN_SYSTEM_VERSION" \
  "$APP_BUNDLE/Contents/Info.plist"
cp "$APPSTORE_PROVISIONING_PROFILE" "$APP_BUNDLE/Contents/embedded.provisionprofile"
cp "$BUILD_DIR/$APP_NAME" "$APP_BUNDLE/Contents/MacOS/$APP_NAME"
cp "$PROJECT_DIR/build/darwin/icon.icns" "$APP_BUNDLE/Contents/Resources/icon.icns"
find "$PROJECT_DIR/build/darwin" -maxdepth 1 -type d -name "*.lproj" \
  -exec cp -R {} "$APP_BUNDLE/Contents/Resources/" \;
cp "$SHERPA_LIB_DIR/libsherpa-onnx-c-api.dylib" "$APP_BUNDLE/Contents/Frameworks/"
cp "$ONNXRUNTIME_DYLIB" "$APP_BUNDLE/Contents/Frameworks/"

step "Removing extended attributes from app bundle"
strip_extended_attributes "$APP_BUNDLE"
assert_no_quarantine_attributes "$APP_BUNDLE"

step "Fixing rpaths"
install_name_tool -add_rpath @executable_path/../Frameworks \
  "$APP_BUNDLE/Contents/MacOS/$APP_NAME" 2>/dev/null || true
install_name_tool -id @rpath/libsherpa-onnx-c-api.dylib \
  "$APP_BUNDLE/Contents/Frameworks/libsherpa-onnx-c-api.dylib"
install_name_tool -id "@rpath/$ONNXRUNTIME_DYLIB_NAME" \
  "$APP_BUNDLE/Contents/Frameworks/$ONNXRUNTIME_DYLIB_NAME"

step "Code signing for Mac App Store"
sign_plain "$APP_BUNDLE/Contents/Frameworks/$ONNXRUNTIME_DYLIB_NAME"
sign_plain "$APP_BUNDLE/Contents/Frameworks/libsherpa-onnx-c-api.dylib"
sign_sandboxed "$APP_BUNDLE/Contents/MacOS/$APP_NAME"
sign_sandboxed "$APP_BUNDLE"

step "Removing extended attributes after signing"
strip_extended_attributes "$APP_BUNDLE"
assert_no_quarantine_attributes "$APP_BUNDLE"

step "Verifying app signature and entitlements"
codesign -vvv --deep --strict "$APP_BUNDLE"
codesign -d --entitlements :- "$APP_BUNDLE"
SIGNED_ENTITLEMENTS="$(mktemp)"
codesign -d --entitlements :- "$APP_BUNDLE" >"$SIGNED_ENTITLEMENTS" 2>/dev/null
SIGNED_APP_IDENTIFIER="$(/usr/libexec/PlistBuddy -c "Print :com.apple.application-identifier" "$SIGNED_ENTITLEMENTS" 2>/dev/null || true)"
rm -f "$SIGNED_ENTITLEMENTS"
[[ "$SIGNED_APP_IDENTIFIER" == "$PROFILE_APP_IDENTIFIER" ]] ||
  fail "Signed app application-identifier mismatch: signed has $SIGNED_APP_IDENTIFIER, profile has $PROFILE_APP_IDENTIFIER"

step "Creating signed installer package"
productbuild \
  --sign "$APPSTORE_INSTALLER_IDENTITY" \
  --component "$APP_BUNDLE" /Applications \
  "$PKG_PATH"

step "Verifying installer package signature"
pkgutil --check-signature "$PKG_PATH"

step "Mac App Store package complete"
echo "  App: $APP_BUNDLE"
echo "  PKG: $PKG_PATH"
echo "  App signing identity: $APPSTORE_APP_IDENTITY"
echo "  Installer signing identity: $APPSTORE_INSTALLER_IDENTITY"