#!/bin/bash
set -euo pipefail
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
PROJECT="$ROOT/RsyncManager.xcodeproj"

echo "== Rsync Manager project security checks =="
grep -q 'ENABLE_HARDENED_RUNTIME = YES' "$PROJECT/project.pbxproj"
grep -q 'ENABLE_APP_SANDBOX = NO' "$PROJECT/project.pbxproj"
grep -q 'INFOPLIST_KEY_CFBundleIconName = AppIcon' "$PROJECT/project.pbxproj"
test -f "$ROOT/RsyncManager/Resources/PrivacyInfo.xcprivacy"

if grep -R --line-number -E 'StrictHostKeyChecking[ =]+no|UserKnownHostsFile[ =]+/dev/null|sshpass' "$ROOT/RsyncManager" --include='*.swift'; then
    echo "Unsafe SSH configuration detected." >&2
    exit 1
fi

grep -q 'BatchMode=yes' "$ROOT/RsyncManager/Services/RsyncCommandBuilder.swift"
grep -q 'allowUnattendedDelete' "$ROOT/RsyncManager/Models/SyncJob.swift"
grep -q 'RsyncSecurityValidator' "$ROOT/RsyncManager/Services/RsyncCommandBuilder.swift"
grep -q 'isSafeRemotePath' "$ROOT/RsyncManager/Services/RsyncCommandBuilder.swift"
grep -q 'hasBalancedShellSyntax' "$ROOT/RsyncManager/Services/RsyncCommandBuilder.swift"
grep -q -- '--files-from' "$ROOT/RsyncManager/Services/RsyncCommandBuilder.swift"
grep -q -- '--log-file' "$ROOT/RsyncManager/Services/RsyncCommandBuilder.swift"

echo "Static policy checks passed."
echo ""
echo "After creating a signed Release app, also run:"
echo "  codesign --verify --deep --strict --verbose=2 /path/to/RsyncManager.app"
echo "  spctl --assess --type execute --verbose=4 /path/to/RsyncManager.app"
echo "  xcrun stapler validate /path/to/RsyncManager.app"