#!/usr/bin/env bash
#
# build-appstore-developerid-macos.sh - Build a distributable App Sandbox POC DMG.
#
# This builds the appstore-tagged sandbox variant, signs it with Developer ID,
# submits the DMG for notarization, and staples the notarization ticket. Use this
# for cross-machine Sandbox POC testing before moving to App Store Connect.
#
# Prerequisites:
#   1. Install the Developer ID Application certificate in Keychain.
#   2. Store notarization credentials, for example:
#      xcrun notarytool store-credentials "privatevoice" \
#        --apple-id "your@apple.id" --team-id "3HY4G7M2AL" \
#        --password "app-specific-password"
#
# Usage:
#   cd VoiceSnapGo
#   ./scripts/build-appstore-developerid-macos.sh [arm64|x86_64|all]
#
set -euo pipefail

APP_NAME="PrivateVoice Dictation"
DEVELOPER_IDENTITY="${PRIVATEVOICE_DEVELOPER_IDENTITY:-Developer ID Application: Ningbo Zhuozhi Innovation Network Technology Co., Ltd. (3HY4G7M2AL)}"
KEYCHAIN_PROFILE="${PRIVATEVOICE_NOTARY_PROFILE:-privatevoice}"
SIGNING_KEYCHAIN="${PRIVATEVOICE_SIGNING_KEYCHAIN:-}"
APPSTORE_MIN_SYSTEM_VERSION="${PRIVATEVOICE_APPSTORE_MIN_SYSTEM_VERSION:-13.4}"

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
PROJECT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"

INFO_PLIST="$PROJECT_DIR/build/darwin/Info.plist"
ENTITLEMENTS="$PROJECT_DIR/build/darwin/entitlements-appstore.plist"
GOMODCACHE="$(go env GOMODCACHE)"
SHERPA_MACOS_MODULE_VERSION="$(cd "$PROJECT_DIR" && go list -m -f '{{.Version}}' github.com/k2-fsa/sherpa-onnx-go-macos)"

VERSION="$(defaults read "$INFO_PLIST" CFBundleShortVersionString 2>/dev/null || echo "2.1.12")"
BUILD_ID="$(defaults read "$INFO_PLIST" CFBundleVersion 2>/dev/null || date +%Y%m%d.%H%M)"

step() {
  echo ""
  echo "==> $1"
}

fail() {
  echo "ERROR: $1" >&2
  exit 1
}

security_find_identities() {
  if [[ -n "$SIGNING_KEYCHAIN" ]]; then
    security find-identity -v -p codesigning "$SIGNING_KEYCHAIN"
  else
    security find-identity -v -p codesigning
  fi
}

resolve_arch() {
  local target="$1"
  case "$target" in
    arm64)
      GOARCH="arm64"
      SHERPA_ARCH="aarch64-apple-darwin"
      OUT_ARCH="arm64"
      ;;
    x86_64|amd64)
      GOARCH="amd64"
      SHERPA_ARCH="x86_64-apple-darwin"
      OUT_ARCH="x86_64"
      ;;
    *)
      fail "Unknown architecture: $target (use arm64, x86_64, or all)"
      ;;
  esac

  BUILD_DIR="$PROJECT_DIR/build/appstore-developerid/$OUT_ARCH"
  APP_BUNDLE="$BUILD_DIR/$APP_NAME.app"
  DMG_PATH="$BUILD_DIR/$APP_NAME-$VERSION-build$BUILD_ID-$OUT_ARCH-developerid-sandbox-poc.dmg"
  SHERPA_LIB_DIR="$GOMODCACHE/github.com/k2-fsa/sherpa-onnx-go-macos@$SHERPA_MACOS_MODULE_VERSION/lib/$SHERPA_ARCH"
  ONNXRUNTIME_DYLIB=""
  ONNXRUNTIME_DYLIB_NAME=""
}

sign_plain() {
  local item="$1"
  codesign --force \
    --options runtime \
    --timestamp \
    --sign "$DEVELOPER_IDENTITY" \
    "$item"
}

sign_sandboxed() {
  local item="$1"
  codesign --force \
    --options runtime \
    --timestamp \
    --entitlements "$ENTITLEMENTS" \
    --sign "$DEVELOPER_IDENTITY" \
    "$item"
}

build_one_arch() {
  local target="$1"
  resolve_arch "$target"

  step "Preflight checks ($OUT_ARCH)"
  [[ -f "$INFO_PLIST" ]] || fail "Info.plist not found at $INFO_PLIST"
  [[ -f "$ENTITLEMENTS" ]] || fail "App Store entitlements not found at $ENTITLEMENTS"
  [[ -f "$PROJECT_DIR/build/darwin/icon.icns" ]] || fail "icon.icns not found"
  [[ -d "$SHERPA_LIB_DIR" ]] || fail "sherpa-onnx dylibs not found at $SHERPA_LIB_DIR"
  ONNXRUNTIME_DYLIB="$(find "$SHERPA_LIB_DIR" -maxdepth 1 -type f -name 'libonnxruntime.*.dylib' | sort | tail -n 1)"
  [[ -f "$ONNXRUNTIME_DYLIB" ]] || fail "onnxruntime dylib not found in $SHERPA_LIB_DIR"
  ONNXRUNTIME_DYLIB_NAME="$(basename "$ONNXRUNTIME_DYLIB")"
  command -v xcrun >/dev/null || fail "xcrun not found"
  security_find_identities | grep -Fq "$DEVELOPER_IDENTITY" ||
    fail "Developer ID signing identity not found: $DEVELOPER_IDENTITY"

  if [[ "${PRIVATEVOICE_SKIP_NOTARY_PROFILE_CHECK:-0}" != "1" ]]; then
    xcrun notarytool history --keychain-profile "$KEYCHAIN_PROFILE" >/dev/null 2>&1 ||
      fail "Notary keychain profile is not usable: $KEYCHAIN_PROFILE"
  fi

  step "Cleaning old Developer ID sandbox build"
  rm -rf "$APP_BUNDLE" "$DMG_PATH"
  mkdir -p "$BUILD_DIR"

  step "Building frontend"
  cd "$PROJECT_DIR/frontend"
  if [[ ! -d node_modules ]]; then
    npm ci --prefer-offline
  fi
  npm run build

  step "Building Go binary ($OUT_ARCH, appstore tag)"
  cd "$PROJECT_DIR"
  CGO_ENABLED=1 GOOS=darwin GOARCH="$GOARCH" \
    MACOSX_DEPLOYMENT_TARGET="$APPSTORE_MIN_SYSTEM_VERSION" \
    CGO_CFLAGS="${CGO_CFLAGS:-} -mmacosx-version-min=$APPSTORE_MIN_SYSTEM_VERSION" \
    CGO_LDFLAGS="${CGO_LDFLAGS:-} -mmacosx-version-min=$APPSTORE_MIN_SYSTEM_VERSION" \
    go build -tags appstore -buildvcs=false -gcflags=all="-l" -ldflags="-s -w" \
    -o "$BUILD_DIR/$APP_NAME"

  step "Assembling $APP_NAME.app"
  mkdir -p "$APP_BUNDLE/Contents/MacOS"
  mkdir -p "$APP_BUNDLE/Contents/Frameworks"
  mkdir -p "$APP_BUNDLE/Contents/Resources"

  cp "$INFO_PLIST" "$APP_BUNDLE/Contents/Info.plist"
  /usr/libexec/PlistBuddy -c "Set :LSMinimumSystemVersion $APPSTORE_MIN_SYSTEM_VERSION" \
    "$APP_BUNDLE/Contents/Info.plist"
  cp "$BUILD_DIR/$APP_NAME" "$APP_BUNDLE/Contents/MacOS/$APP_NAME"
  cp "$PROJECT_DIR/build/darwin/icon.icns" "$APP_BUNDLE/Contents/Resources/icon.icns"
  cp "$SHERPA_LIB_DIR/libsherpa-onnx-c-api.dylib" "$APP_BUNDLE/Contents/Frameworks/"
  cp "$ONNXRUNTIME_DYLIB" "$APP_BUNDLE/Contents/Frameworks/"

  step "Fixing rpaths"
  install_name_tool -add_rpath @executable_path/../Frameworks \
    "$APP_BUNDLE/Contents/MacOS/$APP_NAME" 2>/dev/null || true
  install_name_tool -id @rpath/libsherpa-onnx-c-api.dylib \
    "$APP_BUNDLE/Contents/Frameworks/libsherpa-onnx-c-api.dylib"
  install_name_tool -id "@rpath/$ONNXRUNTIME_DYLIB_NAME" \
    "$APP_BUNDLE/Contents/Frameworks/$ONNXRUNTIME_DYLIB_NAME"

  step "Code signing with Developer ID"
  sign_plain "$APP_BUNDLE/Contents/Frameworks/$ONNXRUNTIME_DYLIB_NAME"
  sign_plain "$APP_BUNDLE/Contents/Frameworks/libsherpa-onnx-c-api.dylib"
  sign_sandboxed "$APP_BUNDLE/Contents/MacOS/$APP_NAME"
  sign_sandboxed "$APP_BUNDLE"

  step "Verifying signature and entitlements"
  codesign -vvv --deep --strict "$APP_BUNDLE"
  codesign -d --entitlements :- "$APP_BUNDLE"

  step "Creating DMG"
  local dmg_temp="$BUILD_DIR/dmg-staging"
  rm -rf "$dmg_temp"
  mkdir -p "$dmg_temp"
  cp -R "$APP_BUNDLE" "$dmg_temp/"
  ln -s /Applications "$dmg_temp/Applications"
  hdiutil create -volname "$APP_NAME Sandbox POC" \
    -srcfolder "$dmg_temp" \
    -ov -format UDZO \
    "$DMG_PATH"
  rm -rf "$dmg_temp"

  step "Signing DMG"
  codesign --force --timestamp --sign "$DEVELOPER_IDENTITY" "$DMG_PATH"

  step "Submitting DMG for notarization"
  xcrun notarytool submit "$DMG_PATH" \
    --keychain-profile "$KEYCHAIN_PROFILE" \
    --wait

  step "Stapling notarization ticket"
  xcrun stapler staple "$DMG_PATH"
  xcrun stapler validate "$DMG_PATH"
  spctl -a -vvv -t open "$DMG_PATH"

  step "Developer ID sandbox POC build complete"
  echo "  App: $APP_BUNDLE"
  echo "  DMG: $DMG_PATH"
  echo "  Signing identity: $DEVELOPER_IDENTITY"
  echo "  Notary profile: $KEYCHAIN_PROFILE"
}

TARGET_ARCH="${1:-$(uname -m)}"
if [[ "$TARGET_ARCH" == "all" ]]; then
  build_one_arch arm64
  build_one_arch x86_64
else
  build_one_arch "$TARGET_ARCH"
fi