#!/usr/bin/env bash
set -euo pipefail
NOTARIZE_REQUESTED=0
[[ "${1:-}" == "--notarize" ]] && { NOTARIZE_REQUESTED=1; shift; }
[[ "${1:-}" == "--" ]] && shift
SIGNING_HOME="${MACOS_SIGNING_HOME:-$HOME/.config/macos-signing}"
[[ -f "$SIGNING_HOME/config.env" ]] || { echo 'Personal signing configuration is missing.' >&2; exit 2; }
source "$SIGNING_HOME/config.env"
: "${APPLE_SIGNING_IDENTITY:?Personal signing identity is missing}"
security find-identity -v -p codesigning | grep -qF "$APPLE_SIGNING_IDENTITY" || { echo 'Requested signing identity is unavailable.' >&2; exit 2; }
export CODESIGN_IDENTITY="$APPLE_SIGNING_IDENTITY" NOTARIZE="$NOTARIZE_REQUESTED"
if [[ "$NOTARIZE_REQUESTED" == 1 ]]; then
  if [[ -n "${APPLE_API_KEY_PATH:-}" ]]; then
    [[ -f "$APPLE_API_KEY_PATH" ]] || { echo 'Configured notarization key file is missing.' >&2; exit 2; }
  else
    shopt -s nullglob
    SIGNING_KEYS=("$SIGNING_HOME"/AuthKey_*.p8)
    [[ "${#SIGNING_KEYS[@]}" == 1 ]] || { echo 'Select APPLE_API_KEY_PATH explicitly when there is not exactly one key.' >&2; exit 2; }
    APPLE_API_KEY_PATH="${SIGNING_KEYS[0]}"
  fi
  : "${APPLE_API_KEY_ID:?Missing notarization key ID}" "${APPLE_API_ISSUER:?Missing notarization issuer}"
  export APPLE_API_KEY_PATH APPLE_API_KEY_ID APPLE_API_ISSUER
fi
PACK="${PACK_SCRIPT:-}"
if [[ -z "$PACK" ]]; then
  for candidate in scripts/package_app.sh script/build_and_run.sh; do
    [[ -x "$candidate" ]] && { PACK="$candidate"; break; }
  done
fi
[[ -n "$PACK" && -x "$PACK" ]] || { echo 'Select an executable project packaging script with PACK_SCRIPT.' >&2; exit 2; }
PACK_TMP="$(mktemp -d)"
trap 'rm -rf "$PACK_TMP"' EXIT
PACK_HELPER="$(cd "$(dirname "$0")" && pwd)/verify_artifacts.py"
python3 "$PACK_HELPER" snapshot > "$PACK_TMP/before.json"
echo "Packaging with the project's script: $PACK"
"$PACK" "$@"
PACK_VERIFY_ARGS=(verify --baseline "$PACK_TMP/before.json" --identity "$APPLE_SIGNING_IDENTITY")
[[ "$NOTARIZE_REQUESTED" == 1 ]] && PACK_VERIFY_ARGS+=(--notarized)
python3 "$PACK_HELPER" "${PACK_VERIFY_ARGS[@]}"