#!/bin/bash
# Builds build/public/stemify-<version>.ipa on a Mac: ad-hoc signed, for releases and re-signing with Sideloadly/AltStore.
# With prov/Stemify.mobileprovision, prov/key.p12 and P12_PASS set, it also writes a signed
# build/prov/stemify-<version>-signed.ipa (keeps CarPlay/Siri) for the owner's own device.
# Finished IPAs are kept per version; build/work is scratch and is wiped each run.
# "build-ipa.sh dev" builds only build/dev/stemify-<version>-dev.ipa: bundle id org.cdnutter.stemify-dev,
# named "Stemify Dev", ad-hoc signed, so it installs next to the release app. For internal tests, never released.
# ios/scripts/build-remote.sh runs this on White-M1 and copies build/public and build/prov back to DevOps.
set -euo pipefail
cd "$(dirname "$0")/.."
export PATH=/opt/homebrew/bin:$PATH
B=build; OUT=$B/work; APP=$OUT/Payload/Stemify.app; EXT=$APP/PlugIns/StemifyWidgets.appex
MODE=${1:-release}
if [ "$MODE" = dev ]; then APP_ID=org.cdnutter.stemify-dev; APP_NAME="Stemify Dev"; APP_ICON=AppIconDev; DD=$B/dd-dev
else APP_ID=org.cdnutter.stemify; APP_NAME=Stemify; APP_ICON=AppIcon; DD=$B/dd; fi
rm -rf $OUT && mkdir -p $OUT/Payload $B/public $B/prov $B/dev
# "1.0 RC 1" -> 1.0-rc1, used in file names and release tags.
VERSION=$(sed -nE 's/^ *VERSION_LABEL: "(.*)"/\1/p' project.yml | tr 'A-Z' 'a-z' | sed -E 's/ rc /-rc/; s/ /-/g')

# xcodebuild compiles the app, the widget extension, the asset catalog and the App Intents metadata.
xcodegen generate -q
xcodebuild -project Stemify.xcodeproj -scheme Stemify -configuration Release -sdk iphoneos \
  -destination generic/platform=iOS -derivedDataPath $DD APP_ID=$APP_ID APP_NAME="$APP_NAME" APP_ICON=$APP_ICON CODE_SIGNING_ALLOWED=NO -quiet build
cp -R $DD/Build/Products/Release-iphoneos/Stemify.app $APP
[ -d $EXT ] || { echo "widget extension missing" >&2; exit 1; }

# Ad-hoc signature carrying only the App Group, so Sideloadly/AltStore keep the widgets' shared data when re-signing.
cat > $OUT/group.plist <<PL
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0"><dict><key>com.apple.security.application-groups</key><array><string>group.$APP_ID</string></array></dict></plist>
PL
codesign -f -s - --entitlements $OUT/group.plist $EXT
codesign -f -s - --entitlements $OUT/group.plist $APP

if [ "$MODE" = dev ]; then
  rm -f $B/dev/stemify-$VERSION-dev.ipa
  (cd $OUT && zip -qry ../dev/stemify-$VERSION-dev.ipa Payload)
  echo "$B/dev/stemify-$VERSION-dev.ipa"
  exit 0
fi

# Public build, for the releases and AltStore/Sideloadly.
rm -f $B/public/stemify-$VERSION.ipa
(cd $OUT && zip -qry ../public/stemify-$VERSION.ipa Payload)
echo "$B/public/stemify-$VERSION.ipa"

if [ -f prov/Stemify.mobileprovision ] && [ -f prov/key.p12 ] && [ -n "${P12_PASS:-}" ]; then
  KC=$PWD/$OUT/sign.keychain-db; KP=$(uuidgen)
  security create-keychain -p "$KP" $KC
  security set-keychain-settings -lut 3600 $KC
  security unlock-keychain -p "$KP" $KC
  security import prov/key.p12 -P "$P12_PASS" -A -t agg -f pkcs12 -k $KC >/dev/null
  # The dev cert chains to Apple's WWDR G3 intermediate, which a fresh keychain doesn't have.
  [ -f prov/wwdr.cer ] || curl -fsSL -o prov/wwdr.cer https://www.apple.com/certificateauthority/AppleWWDRCAG3.cer
  security import prov/wwdr.cer -A -k $KC >/dev/null 2>&1 || true
  security set-key-partition-list -S apple-tool:,apple: -s -k "$KP" $KC >/dev/null
  security list-keychains -d user -s $KC $(security list-keychains -d user | tr -d '"')
  ID=$(security find-identity -v -p codesigning $KC | sed -nE 's/.*"(Apple Development:.*)"/\1/p' | head -1)
  security cms -D -i prov/Stemify.mobileprovision > $OUT/prov.plist
  /usr/libexec/PlistBuddy -x -c 'Print :Entitlements' $OUT/prov.plist > $OUT/ent.plist
  # The widgets need their own profile (org.cdnutter.stemify.widgets with the App Group). Without one they're left out.
  if [ -f prov/StemifyWidgets.mobileprovision ]; then
    security cms -D -i prov/StemifyWidgets.mobileprovision > $OUT/wprov.plist
    /usr/libexec/PlistBuddy -x -c 'Print :Entitlements' $OUT/wprov.plist > $OUT/went.plist
    cp prov/StemifyWidgets.mobileprovision $EXT/embedded.mobileprovision
    codesign -f -s "$ID" --entitlements $OUT/went.plist --timestamp=none $EXT
  else
    rm -rf $APP/PlugIns
  fi
  cp prov/Stemify.mobileprovision $APP/embedded.mobileprovision
  codesign -f -s "$ID" --entitlements $OUT/ent.plist --timestamp=none $APP
  security list-keychains -d user -s $(security list-keychains -d user | tr -d "\"" | grep -v sign.keychain)
  security delete-keychain $KC
  # Personal build for this device only: stays in build/prov (gitignored), never released.
  rm -f $B/prov/stemify-$VERSION-signed.ipa
  (cd $OUT && zip -qry ../prov/stemify-$VERSION-signed.ipa Payload)
  echo "$B/prov/stemify-$VERSION-signed.ipa (signed as $ID)"
fi