#!/bin/bash

set -euo pipefail

# ============================================================
# Orion Toolbar - Direct Distribution Build
# ============================================================

APP_NAME="OrionToolbar"
SCHEME="OrionToolbar"
PROJECT="OrionToolbar.xcodeproj"

# Change this if your Developer ID identity has a different name.
SIGNING_IDENTITY="B99D353C88996866C49E4389B375645F76870A3F"

# Existing notarytool Keychain profile.
# Change if you use a different profile name.
NOTARY_PROFILE="orion-notary"

ROOT_DIR="$(cd "$(dirname "$0")" && pwd)"
BUILD_DIR="$ROOT_DIR/build"
ARCHIVE_PATH="$BUILD_DIR/$APP_NAME.xcarchive"
EXPORT_DIR="$BUILD_DIR/export"
DMG_STAGE="$BUILD_DIR/dmg"
DMG_PATH="$ROOT_DIR/$APP_NAME.dmg"
EXPORT_OPTIONS="$BUILD_DIR/ExportOptions.plist"

echo
echo "============================================================"
echo " ORION TOOLBAR - DIRECT DISTRIBUTION"
echo "============================================================"
echo

cd "$ROOT_DIR"

# ------------------------------------------------------------
# Clean
# ------------------------------------------------------------

echo "==> Cleaning previous build..."

rm -rf "$BUILD_DIR"
rm -f "$DMG_PATH"

mkdir -p "$BUILD_DIR"
mkdir -p "$EXPORT_DIR"
mkdir -p "$DMG_STAGE"

# ------------------------------------------------------------
# Export options
# ------------------------------------------------------------

cat > "$EXPORT_OPTIONS" <<EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>method</key>
    <string>developer-id</string>

    <key>signingStyle</key>
    <string>automatic</string>

    <key>teamID</key>
    <string>39R6U3437D</string>
</dict>
</plist>
EOF

# ------------------------------------------------------------
# Archive
# ------------------------------------------------------------

echo
echo "==> Creating Release archive..."

xcodebuild \
    -project "$PROJECT" \
    -scheme "$SCHEME" \
    -configuration Release \
    -destination "generic/platform=macOS" \
    -archivePath "$ARCHIVE_PATH" \
    clean archive

echo
echo "==> Archive created."

# ------------------------------------------------------------
# Export Developer ID application
# ------------------------------------------------------------

echo
echo "==> Exporting Developer ID application..."

xcodebuild \
    -exportArchive \
    -archivePath "$ARCHIVE_PATH" \
    -exportPath "$EXPORT_DIR" \
    -exportOptionsPlist "$EXPORT_OPTIONS"

APP_PATH="$EXPORT_DIR/$APP_NAME.app"

if [ ! -d "$APP_PATH" ]; then
    echo
    echo "ERROR: Exported application not found:"
    echo "$APP_PATH"
    exit 1
fi

# ------------------------------------------------------------
# Verify application signature
# ------------------------------------------------------------

echo
echo "==> Verifying application signature..."

codesign \
    --verify \
    --deep \
    --strict \
    --verbose=2 \
    "$APP_PATH"

echo
echo "==> Signature information..."

codesign -dv --verbose=4 "$APP_PATH" 2>&1 | \
    grep -E "Identifier=|Authority=|TeamIdentifier=|Runtime Version=" || true

# ------------------------------------------------------------
# Notarize application
# ------------------------------------------------------------

echo
echo "==> Creating notarization ZIP..."

APP_ZIP="$BUILD_DIR/$APP_NAME.zip"

ditto \
    -c \
    -k \
    --keepParent \
    "$APP_PATH" \
    "$APP_ZIP"

echo
echo "==> Submitting application to Apple notarization..."

xcrun notarytool submit \
    "$APP_ZIP" \
    --keychain-profile "$NOTARY_PROFILE" \
    --wait

echo
echo "==> Stapling notarization ticket to application..."

xcrun stapler staple "$APP_PATH"

echo
echo "==> Validating application ticket..."

xcrun stapler validate "$APP_PATH"

echo
echo "==> Gatekeeper application check..."

spctl \
    --assess \
    --type execute \
    --verbose=4 \
    "$APP_PATH"

# ------------------------------------------------------------
# Build DMG contents
# ------------------------------------------------------------

echo
echo "==> Preparing DMG..."

rm -rf "$DMG_STAGE"
mkdir -p "$DMG_STAGE"

ditto "$APP_PATH" "$DMG_STAGE/$APP_NAME.app"

ln -s /Applications "$DMG_STAGE/Applications"

# ------------------------------------------------------------
# Create DMG
# ------------------------------------------------------------

echo
echo "==> Creating DMG..."

hdiutil create \
    -volname "$APP_NAME" \
    -srcfolder "$DMG_STAGE" \
    -ov \
    -format UDZO \
    "$DMG_PATH"

# ------------------------------------------------------------
# Sign DMG
# ------------------------------------------------------------

echo
echo "==> Signing DMG..."

codesign \
    --force \
    --timestamp \
    --sign "$SIGNING_IDENTITY" \
    "$DMG_PATH"

echo
echo "==> Verifying DMG signature..."

codesign \
    --verify \
    --verbose=2 \
    "$DMG_PATH"

# ------------------------------------------------------------
# Notarize DMG
# ------------------------------------------------------------

echo
echo "==> Submitting DMG to Apple notarization..."

xcrun notarytool submit \
    "$DMG_PATH" \
    --keychain-profile "$NOTARY_PROFILE" \
    --wait

echo
echo "==> Stapling notarization ticket to DMG..."

xcrun stapler staple "$DMG_PATH"

echo
echo "==> Validating DMG ticket..."

xcrun stapler validate "$DMG_PATH"

# ------------------------------------------------------------
# Final verification
# ------------------------------------------------------------

echo
echo "==> Final Gatekeeper assessment..."

spctl \
    --assess \
    --type open \
    --context context:primary-signature \
    --verbose=4 \
    "$DMG_PATH" || true

echo
echo "==> DMG information..."

ls -lh "$DMG_PATH"

echo
echo "==> SHA-256..."

shasum -a 256 "$DMG_PATH"

echo
echo "============================================================"
echo " RELEASE BUILD COMPLETE"
echo "============================================================"
echo
echo "DMG:"
echo "$DMG_PATH"
echo