#!/bin/bash
set -euo pipefail
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
PBX="$ROOT/Rsync Studio.xcodeproj/project.pbxproj"
EXPECTED_BUNDLE_ID="net.absdev.RsyncStudio"
EXPECTED_VERSION="1.0.0"
EXPECTED_BUILD="1"
EXPECTED_MIN_MACOS="14.0"

fail() { echo "ERROR: $*" >&2; exit 1; }
pass() { echo "OK: $*"; }

[[ -f "$PBX" ]] || fail "Missing Xcode project file"

[[ $(grep -c "PRODUCT_BUNDLE_IDENTIFIER = $EXPECTED_BUNDLE_ID;" "$PBX") -ge 2 ]] || fail "Bundle identifier must remain $EXPECTED_BUNDLE_ID in all app configurations"
pass "Bundle identifier is $EXPECTED_BUNDLE_ID"

[[ $(grep -c "MARKETING_VERSION = $EXPECTED_VERSION;" "$PBX") -ge 2 ]] || fail "Marketing version must be $EXPECTED_VERSION"
pass "Marketing version is $EXPECTED_VERSION"

[[ $(grep -c "CURRENT_PROJECT_VERSION = $EXPECTED_BUILD;" "$PBX") -ge 2 ]] || fail "Build number must be $EXPECTED_BUILD"
pass "Build number is $EXPECTED_BUILD"

[[ $(grep -c 'ENABLE_HARDENED_RUNTIME = YES;' "$PBX") -ge 2 ]] || fail "Hardened Runtime must be enabled"
pass "Hardened Runtime is enabled"

[[ $(grep -c 'ENABLE_APP_SANDBOX = NO;' "$PBX") -ge 2 ]] || fail "App Sandbox baseline changed unexpectedly"
pass "App Sandbox remains intentionally disabled for direct distribution"

[[ $(grep -c "MACOSX_DEPLOYMENT_TARGET = $EXPECTED_MIN_MACOS;" "$PBX") -ge 2 ]] || fail "macOS deployment target must remain $EXPECTED_MIN_MACOS"
pass "Minimum macOS is $EXPECTED_MIN_MACOS"

[[ $(grep -c 'INFOPLIST_KEY_LSApplicationCategoryType = "public.app-category.utilities";' "$PBX") -ge 2 ]] || fail "Application category is missing"
pass "Application category is Utilities"

if grep -q 'CODE_SIGN_IDENTITY = "Apple Development"' "$PBX"; then
  fail "A project-level Apple Development identity is pinned; Release distribution must use Developer ID Application"
fi
pass "No development certificate is pinned into the project"

if grep -q 'com.apple.security.get-task-allow' "$ROOT/Rsync Studio"/*.entitlements 2>/dev/null; then
  fail "get-task-allow must never ship in a commercial Release build"
fi
pass "No get-task-allow entitlement is present in source entitlements"

cat <<'MSG'

Release identity baseline passed.
Before the first commercial archive, select your Apple Developer Team in Xcode and ensure the archived app is signed with a "Developer ID Application" certificate. The exact certificate identity is intentionally not committed to source control.
MSG