#!/usr/bin/env bash
set -euo pipefail

# macOS keys the Screen Recording permission to the bundle identifier plus the
# code signature. The identity below and --identifier ai.flowmaster.shotdeck must
# never change: altering either one makes the existing grant invalid and forces
# the user to approve Screen Recording again by hand.

ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "$ROOT"

IDENTITY="Apple Development: ben@flow-master.ai (QH2H9G2LK5)"
BUNDLE_ID="ai.flowmaster.shotdeck"
APP_BUNDLE="${ROOT}/.build/Shotdeck.app"

SKIP_SIGN=0
for arg in "$@"; do
    case "${arg}" in
        --skip-sign)
            SKIP_SIGN=1
            ;;
        *)
            echo "Unknown argument: ${arg}" >&2
            echo "Usage: $0 [--skip-sign]" >&2
            exit 1
            ;;
    esac
done

echo "==> Building Shotdeck (release)"
swift build -c release --product Shotdeck

BIN_PATH="$(swift build -c release --product Shotdeck --show-bin-path)/Shotdeck"
if [[ ! -x "${BIN_PATH}" ]]; then
    echo "Release binary not found at ${BIN_PATH}" >&2
    exit 1
fi

echo "==> Assembling ${APP_BUNDLE}"
rm -rf "${APP_BUNDLE}"
mkdir -p "${APP_BUNDLE}/Contents/MacOS"
mkdir -p "${APP_BUNDLE}/Contents/Resources"
cp "${BIN_PATH}" "${APP_BUNDLE}/Contents/MacOS/Shotdeck"
chmod +x "${APP_BUNDLE}/Contents/MacOS/Shotdeck"
cp "${ROOT}/Info.plist" "${APP_BUNDLE}/Contents/Info.plist"

if [[ "${SKIP_SIGN}" -eq 1 ]]; then
    echo
    echo "************************************************************************"
    echo "WARNING: --skip-sign was used. This app is UNSIGNED."
    echo "The resulting app will trigger a fresh Screen Recording prompt and must"
    echo "not be handed to the user."
    echo "************************************************************************"
    echo
else
    if ! security find-identity -v -p codesigning | grep -Fq "${IDENTITY}"; then
        echo "The codesigning identity '${IDENTITY}' is not in this shell's keychain search list." >&2
        echo "The login keychain is not reachable from this shell." >&2
        echo "Run this script from a normal login session so the app can be signed." >&2
        echo "Refusing to produce an unsigned app." >&2
        exit 1
    fi

    echo "==> Signing ${APP_BUNDLE}"
    codesign --force --options runtime \
        --sign "${IDENTITY}" \
        --identifier "${BUNDLE_ID}" \
        "${APP_BUNDLE}"
fi

echo
echo "App path: ${APP_BUNDLE}"
echo "Launch with: open ${APP_BUNDLE}"