#!/usr/bin/env bash

set -xeu
set -o pipefail

export LANG=en_US.UTF-8
LANG=en_US.UTF-8

IDENTITY="Apple Distribution: ITVIO, OOO (VL68C36HYS)"
P12_PATH="${P12_PATH:-certs/distribution.p12}"
P12_PASSWORD="${P12_PASSWORD:-password}"

function finish() {
  if [[ -d "${RESULT_BUNDLE_PATH}" ]]; then
    ditto -c -k --sequesterRsrc --keepParent "${RESULT_BUNDLE_PATH}" "${RESULT_BUNDLE_PATH}.zip"
    rm -rf "${RESULT_BUNDLE_PATH}"
  fi
}

trap finish EXIT

SDK="${SDK:-iphoneos}"
WORKSPACE="${WORKSPACE:-ios/Runner.xcworkspace}"
SCHEME="${SCHEME:-Runner}"
CONFIGURATION="${CONFIGURATION:-Release}"

BUILD_DIR="${BUILD_DIR:-build}"
ARTIFACT_PATH="${RESULT_PATH:-${BUILD_DIR}/Artifacts}"
RESULT_BUNDLE_PATH="${ARTIFACT_PATH}/${SCHEME}.xcresult"
ARCHIVE_PATH="${ARCHIVE_PATH:-${BUILD_DIR}/Archives/${SCHEME}.xcarchive}"
DERIVED_DATA_PATH="${DERIVED_DATA_PATH:-${BUILD_DIR}/DerivedData}"
CURRENT_PROJECT_VERSION="${BUILD_NUMBER:-0}"
EXPORT_OPTIONS_FILE="Support/ExportOptions.plist"

# 🛡️ Ensure signing identity is available
if ! security find-identity -v -p codesigning | grep -q "${IDENTITY}"; then
  echo "🔑 Importing .p12 certificate..."
  security import "${P12_PATH}" -k login.keychain -P "${P12_PASSWORD}" -T /usr/bin/codesign || {
    echo "❌ Failed to import .p12"
    exit 1
  }
  security set-key-partition-list -S apple-tool:,apple: -s -k "${P12_PASSWORD}" login.keychain
fi

# Clean and prepare the build
flutter clean
flutter pub get
dart run build_runner build --delete-conflicting-outputs

cd ios
rm -rf Pods Podfile.lock
pod install --repo-update
pod update || { echo "Pod update failed"; exit 1; }
cd ..

rm -rf "${RESULT_BUNDLE_PATH}" "${DERIVED_DATA_PATH}"
mkdir -p "${ARTIFACT_PATH}"

function resign_frameworks() {
  # ⬇️ Раскодировать p12 из base64 и сохранить во временный файл
  P12_TMP_PATH="certs/distribution.p12"
  echo "$CERTIFICATES_FILE_BASE64" | base64 --decode -o "$P12_TMP_PATH"

  # 🛡️ Импортировать сертификат
  security import "$P12_TMP_PATH" -k login.keychain -P "$CERTIFICATES_PASSWORD" -T /usr/bin/codesign
  security set-key-partition-list -S apple-tool:,apple: -s -k "$CERTIFICATES_PASSWORD" login.keychain


  IDENTITY="Apple Distribution: ITVIO, OOO (VL68C36HYS)"
  P12_TMP_PATH="certs/distribution.p12"

  # 🛡️ Ensure signing identity is available
  if ! security find-identity -v -p codesigning | grep -q "${IDENTITY}"; then
    echo "📦 Extracting certificate from GitHub Secrets..."
    mkdir -p certs
    echo "$CERTIFICATES_FILE_BASE64" | base64 --decode -o "$P12_TMP_PATH"

    echo "🔑 Importing .p12 certificate..."
    security import "$P12_TMP_PATH" -k login.keychain -P "$CERTIFICATES_PASSWORD" -T /usr/bin/codesign || {
      echo "❌ Failed to import .p12"
      exit 1
    }

    security set-key-partition-list -S apple-tool:,apple: -s -k "$CERTIFICATES_PASSWORD" login.keychain
  fi

  local app_path="${ARCHIVE_PATH}/Products/Applications/Runner.app"
  local frameworks_path="${app_path}/Frameworks"

  echo "🔐 Removing old signatures..."
  codesign --remove-signature "${frameworks_path}/App.framework/App"
  codesign --remove-signature "${frameworks_path}/Flutter.framework/Flutter"

  echo "🔐 Resigning App.framework..."
  codesign -f --deep --no-strict -s "${IDENTITY}" \
    --preserve-metadata=entitlements,identifier,flags \
    "${frameworks_path}/App.framework/App"

  echo "🔐 Resigning Flutter.framework..."
  codesign -f --deep --no-strict -s "${IDENTITY}" \
    --preserve-metadata=entitlements,identifier,flags \
    "${frameworks_path}/Flutter.framework/Flutter"

  echo "🔐 Resigning Runner.app..."
  codesign -f --deep --no-strict -s "${IDENTITY}" \
    --preserve-metadata=entitlements,identifier,flags \
    "${app_path}"

  echo "✅ Resigning completed"
}

# Archive the build
xcrun xcodebuild \
  -workspace "${WORKSPACE}" \
  -scheme "${SCHEME}" \
  -configuration "${CONFIGURATION}" \
  -sdk "${SDK}" \
  -parallelizeTargets \
  -showBuildTimingSummary \
  -derivedDataPath "${DERIVED_DATA_PATH}" \
  -archivePath "${ARCHIVE_PATH}" \
  -resultBundlePath "${RESULT_BUNDLE_PATH}" \
  -allowProvisioningUpdates \
  CURRENT_PROJECT_VERSION="${CURRENT_PROJECT_VERSION}" \
  CODE_SIGNING_ALLOWED=NO \
  DEVELOPMENT_TEAM=VL68C36HYS \
  archive || { echo "Xcode archive failed"; exit 1; }

resign_frameworks

# Export the build to .ipa
xcrun xcodebuild \
  -exportArchive \
  -exportOptionsPlist "${EXPORT_OPTIONS_FILE}" \
  -archivePath "${ARCHIVE_PATH}" \
  -exportPath "${ARTIFACT_PATH}/${SCHEME}.ipa" || { echo "Export to IPA failed"; exit 1; }

# Zip the archive
if [[ -d "${ARCHIVE_PATH}" ]]; then
  ditto -c -k --sequesterRsrc --keepParent "${ARCHIVE_PATH}" "${ARTIFACT_PATH}/${SCHEME}.xcarchive.zip"
else
  echo "Archive directory not found, skipping zip."
fi