#!/bin/bash
# Build, sign, and notarize both Homebrew and Standalone versions of Meshy for macOS
#
# Prerequisites:
# 1. Developer ID Application certificate installed in Keychain
# 2. Notarization credentials stored with: xcrun notarytool store-credentials
#
# Usage: Run from project root directory:
#   ./build-aux/macos/build-and-notarize-all.sh

set -e

# Change to project root directory
cd "$(dirname "$0")/../.."

# Configuration - UPDATE THESE VALUES
SIGNING_IDENTITY="Developer ID Application: Jaroslav Reznik (LG87HQ83LT)"
KEYCHAIN_PROFILE="meshy-notary"  # Name you used in 'notarytool store-credentials'

# Get version from build
VERSION=$(date +%y.%m.%d)

echo "======================================================================"
echo "Building, signing, and notarizing Meshy v${VERSION}"
echo "======================================================================"
echo ""

# ============================================================
# HOMEBREW-OPTIMIZED BUNDLE
# ============================================================

echo "===> HOMEBREW-OPTIMIZED BUNDLE"
echo "===> Step 1/4: Building signed Homebrew bundle and DMG..."
./build-aux/macos/build-homebrew-bundle.sh \
  --sign "${SIGNING_IDENTITY}" \
  --dmg

HOMEBREW_DMG="dist-homebrew/Meshy-${VERSION}.dmg"

if [ ! -f "${HOMEBREW_DMG}" ]; then
    echo "Error: Homebrew DMG not found at ${HOMEBREW_DMG}"
    exit 1
fi

echo "✓ Built and signed: ${HOMEBREW_DMG}"
echo ""

echo "===> Step 2/4: Verifying Homebrew bundle signature..."
codesign --verify --verbose dist-homebrew/Meshy.app
echo "✓ Code signature verified (not yet notarized - will verify after notarization)"
echo ""

echo "===> Step 3/4: Submitting Homebrew DMG for notarization..."
xcrun notarytool submit "${HOMEBREW_DMG}" \
  --keychain-profile "${KEYCHAIN_PROFILE}" \
  --wait

echo "✓ Notarization complete"
echo ""

echo "===> Step 4/4: Stapling Homebrew DMG notarization ticket..."
xcrun stapler staple "${HOMEBREW_DMG}"
echo "✓ Notarization ticket stapled"
echo ""

echo "===> Verifying Homebrew DMG..."
spctl --assess --type open --context context:primary-signature --verbose "${HOMEBREW_DMG}"
echo ""

echo "✅ Homebrew bundle complete: ${HOMEBREW_DMG}"
echo ""
echo ""

# ============================================================
# STANDALONE BUNDLE (Notarization disabled)
# ============================================================

echo "===> STANDALONE BUNDLE"
echo "===> Step 1/2: Building signed standalone bundle and DMG..."
./build-aux/macos/create-standalone-bundle.sh \
  --sign "${SIGNING_IDENTITY}" \
  --dmg

STANDALONE_DMG="dist/Meshy-${VERSION}.dmg"

if [ ! -f "${STANDALONE_DMG}" ]; then
    echo "Error: Standalone DMG not found at ${STANDALONE_DMG}"
    exit 1
fi

echo "✓ Built and signed: ${STANDALONE_DMG}"
echo ""

echo "===> Step 2/2: Verifying standalone bundle signature..."
codesign --verify --verbose dist/Meshy.app
echo "✓ Code signature verified"
echo ""

echo "⚠️  Standalone notarization SKIPPED (Python.framework signing issues)"
echo "✅ Standalone bundle built (signed but not notarized): ${STANDALONE_DMG}"
echo ""
echo ""

# ============================================================
# SUMMARY
# ============================================================

echo "======================================================================"
echo "✅ SUCCESS! Build complete"
echo "======================================================================"
echo ""
echo "Homebrew-optimized (NOTARIZED ✅):"
echo "  📦 ${HOMEBREW_DMG}"
echo "  📊 Size: $(du -h "${HOMEBREW_DMG}" | cut -f1)"
echo "  ✓ Ready for public distribution (no Gatekeeper warnings)"
echo ""
echo "Standalone (signed but NOT notarized ⚠️):"
echo "  📦 ${STANDALONE_DMG}"
echo "  📊 Size: $(du -h "${STANDALONE_DMG}" | cut -f1)"
echo "  ⚠️  Will show Gatekeeper warnings - for testing only"
echo ""
echo "Recommended for distribution: Use Homebrew bundle (notarized)"
echo ""
