#!/bin/bash
#
#  release.sh
#  OS Vault
#
#  Author: Simon-Pierre Boucher
#  Mail: contact@spboucher.ai
#
# Developer ID signing, notarization and stapling for OS Vault.
# Identity and notarytool profile reused from the Zyquo Local/Term pipeline.
#
# Usage:
#   scripts/release.sh          # full: build + bundle + sign + notarize + staple + dmg
#   scripts/release.sh sign|notarize|dmg   # individual steps

set -euo pipefail
cd "$(dirname "$0")/.."

IDENTITY="Developer ID Application: Simon-Pierre Boucher (3YM54G49SN)"
KEYCHAIN_PROFILE="MacLustr-Notarize"
APP_DIR="dist/OS Vault.app"
ZIP_NAME="dist/OSVault.zip"
DMG_NAME="dist/OSVault.dmg"
ENTITLEMENTS="Support/entitlements.plist"

build() {
    echo "=== Release build + bundle ==="
    make bundle-release
}

sign() {
    [ -d "$APP_DIR" ] || { echo "ERROR: $APP_DIR missing — run 'make bundle-release' first" >&2; exit 1; }
    echo "=== Signing (Developer ID, hardened runtime, sandboxed) ==="
    codesign --force --options runtime --timestamp \
        --entitlements "$ENTITLEMENTS" \
        --sign "$IDENTITY" "$APP_DIR"
    codesign --verify --deep --strict --verbose=2 "$APP_DIR"
    echo "Signature valid."
}

notarize() {
    echo "=== Notarizing app (profile: $KEYCHAIN_PROFILE) ==="
    rm -f "$ZIP_NAME"
    ditto -c -k --keepParent "$APP_DIR" "$ZIP_NAME"
    xcrun notarytool submit "$ZIP_NAME" --keychain-profile "$KEYCHAIN_PROFILE" --wait
    xcrun stapler staple "$APP_DIR"
    xcrun stapler validate "$APP_DIR"
    spctl -a -vv "$APP_DIR"
    echo "App notarized and stapled."
}

dmg() {
    echo "=== Creating signed + notarized DMG (custom volume icon) ==="
    rm -f "$DMG_NAME"
    DMG_TEMP="dist/dmg_temp"
    DMG_RW="dist/OSVault-rw.dmg"
    rm -rf "$DMG_TEMP" "$DMG_RW"
    mkdir -p "$DMG_TEMP"
    cp -R "$APP_DIR" "$DMG_TEMP/"
    ln -s /Applications "$DMG_TEMP/Applications"
    cp assets/icon/AppIcon.icns "$DMG_TEMP/.VolumeIcon.icns"

    # Read-write image first so the volume's custom-icon flag can be set,
    # then compress to the final UDZO.
    hdiutil create -volname "OS Vault" -srcfolder "$DMG_TEMP" -ov -format UDRW "$DMG_RW"
    MOUNT_DIR=$(hdiutil attach "$DMG_RW" -nobrowse | awk -F'\t' '/\/Volumes\//{print $NF; exit}')
    SetFile -a C "$MOUNT_DIR"
    hdiutil detach "$MOUNT_DIR" -quiet
    hdiutil convert "$DMG_RW" -format UDZO -o "$DMG_NAME"
    rm -rf "$DMG_TEMP" "$DMG_RW"

    codesign --force --sign "$IDENTITY" --timestamp "$DMG_NAME"
    xcrun notarytool submit "$DMG_NAME" --keychain-profile "$KEYCHAIN_PROFILE" --wait
    xcrun stapler staple "$DMG_NAME"
    echo "DMG ready: $DMG_NAME"
}

case "${1:-dist}" in
    sign) sign ;;
    notarize) notarize ;;
    dmg) dmg ;;
    dist) build; sign; notarize; dmg ;;
    *) echo "Usage: $0 {sign|notarize|dmg|dist}" >&2; exit 64 ;;
esac