#!/bin/bash
set -euo pipefail
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
PROJECT="$ROOT/Rsync Studio.xcodeproj"
SCHEME="Rsync Studio"

if [[ "$(uname -s)" != "Darwin" ]]; then
  echo "release-preflight.sh must run on macOS with Xcode installed." >&2
  exit 2
fi

for tool in xcodebuild plutil codesign spctl; do
  command -v "$tool" >/dev/null || { echo "Missing required tool: $tool" >&2; exit 2; }
done

"$SCRIPT_DIR/verify-release-config.sh"
"$SCRIPT_DIR/security-check.sh"
if ! grep -Eq 'INFOPLIST_KEY_RsyncStudioLicensePublicKey = "[A-Za-z0-9+/_=-]{40,}";' "$PROJECT/project.pbxproj"; then
  echo "RsyncStudioLicensePublicKey is not configured. Generate the licensing keypair and embed the PUBLIC key before a commercial release." >&2
  exit 1
fi
plutil -lint "$ROOT/Rsync Studio/Resources/PrivacyInfo.xcprivacy"

BUILD_DIR="$ROOT/build/preflight"
rm -rf "$BUILD_DIR"

xcodebuild \
  -project "$PROJECT" \
  -scheme "$SCHEME" \
  -configuration Release \
  -destination 'platform=macOS' \
  -derivedDataPath "$BUILD_DIR" \
  CODE_SIGNING_ALLOWED=NO \
  clean build

APP="$BUILD_DIR/Build/Products/Release/Rsync Studio.app"
test -d "$APP" || { echo "Release app was not produced at $APP" >&2; exit 1; }

echo "Unsigned Release build passed: $APP"
echo "Next: Archive with Developer ID, notarise, staple, then run the signed-app checks in Docs/RELEASE.md."