#!/bin/bash
set -euo pipefail
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
source "$ROOT/scripts/common.sh"
METHOD=release-testing
PROVISIONING=()
while (($#)); do
    case "$1" in
        --method)
            [[ $# -ge 2 ]] || { echo '--method needs a value' >&2; exit 2; }
            METHOD="$2"; shift ;;
        --allow-provisioning-updates) PROVISIONING=(-allowProvisioningUpdates) ;;
        -h|--help)
            echo 'Usage: scripts/release.sh [--method release-testing|debugging] [--allow-provisioning-updates]'
            echo 'Always archives Release configuration. Default: registered-device distribution IPA.'
            exit 0 ;;
        *) echo "Unknown option: $1" >&2; exit 2 ;;
    esac
    shift
done
case "$METHOD" in release-testing|debugging) ;; *) echo 'Supported methods: release-testing, debugging' >&2; exit 2 ;; esac
TEAM="${DEVELOPMENT_TEAM:-39R6U3437D}"
BASE="${RELEASE_OUTPUT_DIR:-$ROOT/build/releases}"
mkdir -p "$BASE"
OUTPUT="$(mktemp -d "$BASE/$(date +%Y%m%d-%H%M%S)-$METHOD.XXXXXX")"
DERIVED_DATA="$(mktemp -d "$TARNAX_SCRATCH_ROOT/release-derived.XXXXXX")"
ARCHIVE="$OUTPUT/Tarnax.xcarchive"
EXPORT="$OUTPUT/export"
echo "Release output: $OUTPUT"
python3 - "$OUTPUT/ExportOptions.plist" "$METHOD" "$TEAM" <<'PY'
import plistlib, sys
with open(sys.argv[1], 'wb') as f:
    plistlib.dump({'method':sys.argv[2], 'teamID':sys.argv[3], 'signingStyle':'automatic',
                  'destination':'export', 'stripSwiftSymbols':True, 'thinning':'<none>',
                  'manageAppVersionAndBuildNumber':False}, f)
PY
xcodebuild -project "$ROOT/Tarnax.xcodeproj" -scheme Tarnax \
    -configuration Release -destination 'generic/platform=iOS' \
    -derivedDataPath "$DERIVED_DATA" -archivePath "$ARCHIVE" \
    DEVELOPMENT_TEAM="$TEAM" CODE_SIGN_STYLE=Automatic \
    ${PROVISIONING[@]+"${PROVISIONING[@]}"} archive 2>&1 | tee "$OUTPUT/archive.log"
xcodebuild -exportArchive -archivePath "$ARCHIVE" -exportPath "$EXPORT" \
    -exportOptionsPlist "$OUTPUT/ExportOptions.plist" \
    ${PROVISIONING[@]+"${PROVISIONING[@]}"} 2>&1 | tee "$OUTPUT/export.log"
IPA="$EXPORT/Tarnax.ipa"
[[ -f "$IPA" ]] || { echo 'Export finished without Tarnax.ipa' >&2; exit 1; }
VERIFY="$(mktemp -d "$TARNAX_SCRATCH_ROOT/verify.XXXXXX")"
trap 'rm -rf "$VERIFY"' EXIT
unzip -q "$IPA" -d "$VERIFY"
APP="$VERIFY/Payload/Tarnax.app"
codesign --verify --deep --strict "$APP"
[[ -f "$APP/embedded.mobileprovision" ]] || { echo 'No embedded provisioning profile' >&2; exit 1; }
security cms -D -i "$APP/embedded.mobileprovision" > "$VERIFY/profile.plist"
PROFILE_FLAGS=()
if [[ "$METHOD" == release-testing ]]; then PROFILE_FLAGS=(--distribution); fi
python3 "$ROOT/scripts/verify_profile.py" "$APP/Info.plist" "$VERIFY/profile.plist" ${PROFILE_FLAGS[@]+"${PROFILE_FLAGS[@]}"}

(cd "$EXPORT" && shasum -a 256 Tarnax.ipa > Tarnax.ipa.sha256)
echo "Verified IPA: $IPA"
echo "SHA-256: $EXPORT/Tarnax.ipa.sha256"