#!/bin/bash
set -euo pipefail

APP="${1:-}"
[[ -n "$APP" ]] || { echo "Usage: $0 /path/to/Rsync Studio.app" >&2; exit 2; }
[[ -d "$APP" ]] || { echo "ERROR: App not found: $APP" >&2; exit 2; }

for tool in codesign spctl; do
  command -v "$tool" >/dev/null || { echo "ERROR: Missing required tool: $tool" >&2; exit 2; }
done

echo "== Verifying code signature =="
codesign --verify --deep --strict --verbose=2 "$APP"

echo "== Inspecting signing authority =="
SIGNING_INFO="$(codesign -dvvv "$APP" 2>&1)"
printf '%s\n' "$SIGNING_INFO"
grep -q 'Authority=Developer ID Application:' <<<"$SIGNING_INFO" || {
  echo "ERROR: App is not signed with Developer ID Application." >&2
  exit 1
}

echo "== Checking Hardened Runtime =="
grep -Eq '^CodeDirectory .* flags=.*runtime' <<<"$SIGNING_INFO" || {
  echo "ERROR: Hardened Runtime flag was not found in the signed app." >&2
  exit 1
}

echo "== Checking release entitlements =="
ENTITLEMENTS="$(codesign -d --entitlements :- "$APP" 2>/dev/null || true)"
if grep -q 'com.apple.security.get-task-allow' <<<"$ENTITLEMENTS"; then
  echo "ERROR: Release app contains com.apple.security.get-task-allow." >&2
  exit 1
fi

if grep -q '<true/>' <<<"$(printf '%s\n' "$ENTITLEMENTS" | sed -n '/com.apple.security.app-sandbox/,+1p')"; then
  echo "ERROR: App Sandbox is unexpectedly enabled in the direct-distribution build." >&2
  exit 1
fi

echo "== Gatekeeper assessment =="
spctl --assess --type execute --verbose=4 "$APP"

echo "Signed Developer ID app verification passed: $APP"