#!/usr/bin/env bash
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
REPO_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"

usage() {
  cat <<'EOF'
Usage: Scripts/seal-release-secrets.sh [--source-dir <dir>] [--only <secret>]

Encrypt Burrow release inputs into the agenix secrets consumed by CI.

Expected files in --source-dir (default: intake/release):
  appstore-key-id.txt
  appstore-key-issuer-id.txt
  appstore-key.p8
  distribution-cert.p12
  distribution-cert-password.txt
  sparkle-eddsa.key

Pre-composed appstore-connect.env, distribution-signing.env, and sparkle.env
files are also accepted.

Provisioning profiles are synced from App Store Connect credentials in CI.
The temporary keychain password is always the distribution certificate password.

Secrets:
  all
  appstore-connect
  distribution-signing
  sparkle
EOF
}

SOURCE_DIR="${BURROW_RELEASE_SECRET_SOURCE_DIR:-${REPO_ROOT}/intake/release}"
ONLY="all"

while [[ $# -gt 0 ]]; do
  case "$1" in
    --source-dir)
      SOURCE_DIR="${2:?missing value for --source-dir}"
      shift 2
      ;;
    --only)
      ONLY="${2:?missing value for --only}"
      shift 2
      ;;
    -h|--help)
      usage
      exit 0
      ;;
    *)
      echo "unknown option: $1" >&2
      usage >&2
      exit 64
      ;;
  esac
done

case "$ONLY" in
  all|appstore-connect|app-store|appstore|distribution-signing|apple-signing|sparkle) ;;
  *)
    echo "unknown release secret selector: $ONLY" >&2
    usage >&2
    exit 64
    ;;
esac

require_cmd() {
  if ! command -v "$1" >/dev/null 2>&1; then
    echo "missing required command: $1" >&2
    exit 1
  fi
}

require_cmd age
require_cmd nix
require_cmd python3

if [[ ! -d "$SOURCE_DIR" ]]; then
  echo "release secret source directory does not exist: $SOURCE_DIR" >&2
  exit 1
fi

tmpdir="$(mktemp -d)"
cleanup() {
  rm -rf "$tmpdir"
}
trap cleanup EXIT

seal_secret() {
  local target="$1"
  local source_path="$2"
  local required="${3:-required}"
  local recipients_file="${tmpdir}/$(basename "${target}").recipients"

  if [[ ! -s "$source_path" ]]; then
    if [[ "$required" == "optional" ]]; then
      return 0
    fi
    echo "required release secret source missing or empty: $source_path" >&2
    exit 1
  fi

  mkdir -p "${REPO_ROOT}/$(dirname "$target")"
  nix eval --impure --json --expr "let s = import ${REPO_ROOT}/secrets.nix; in s.\"${target}\".publicKeys" \
    | python3 -c 'import json, sys; [print(item) for item in json.load(sys.stdin)]' \
    > "$recipients_file"

  age -R "$recipients_file" -o "${REPO_ROOT}/${target}" "$source_path"
  chmod 600 "${REPO_ROOT}/${target}"
  echo "Sealed ${target}"
}

base64_file() {
  python3 -c 'import base64, pathlib, sys; print(base64.b64encode(pathlib.Path(sys.argv[1]).read_bytes()).decode())' "$1"
}

read_secret_text() {
  python3 -c 'import pathlib, sys; sys.stdout.write(pathlib.Path(sys.argv[1]).read_text().strip())' "$1"
}

base64_text() {
  python3 -c 'import base64, sys; print(base64.b64encode(sys.stdin.buffer.read()).decode())'
}

reject_placeholder() {
  local path="$1"
  if grep -Eq '^(TODO|PASTE_|REPLACE_|#)' "$path"; then
    echo "intake file still contains placeholder text: $path" >&2
    exit 1
  fi
}

reject_placeholder_text() {
  local path="$1"
  if grep -Iq . "$path"; then
    reject_placeholder "$path"
  fi
}

first_existing() {
  local path
  for path in "$@"; do
    if [[ -s "$path" ]]; then
      printf '%s\n' "$path"
      return 0
    fi
  done
  return 1
}

compose_appstore_connect_env() {
  local direct="${SOURCE_DIR}/appstore-connect.env"
  if [[ -s "$direct" ]]; then
    printf '%s\n' "$direct"
    return 0
  fi

  local key_id_file="${SOURCE_DIR}/appstore-key-id.txt"
  local issuer_id_file="${SOURCE_DIR}/appstore-key-issuer-id.txt"
  local key_file="${SOURCE_DIR}/appstore-key.p8"
  if [[ ! -s "$key_file" ]]; then
    echo "required App Store Connect source missing or empty: appstore-key.p8" >&2
    exit 1
  fi
  for path in "$key_id_file" "$issuer_id_file" "$key_file"; do
    if [[ ! -s "$path" ]]; then
      echo "required App Store Connect source missing or empty: $path" >&2
      exit 1
    fi
    reject_placeholder_text "$path"
  done

  local out="${tmpdir}/appstore-connect.env"
  {
    printf 'ASC_API_KEY_ID=%s\n' "$(read_secret_text "$key_id_file")"
    printf 'ASC_API_ISSUER_ID=%s\n' "$(read_secret_text "$issuer_id_file")"
    printf 'ASC_API_KEY_BASE64=%s\n' "$(base64_file "$key_file")"
  } > "$out"
  printf '%s\n' "$out"
}

compose_distribution_signing_env() {
  local direct="${SOURCE_DIR}/distribution-signing.env"
  if [[ -s "$direct" ]]; then
    printf '%s\n' "$direct"
    return 0
  fi

  local cert_file
  cert_file="${SOURCE_DIR}/distribution-cert.p12"
  local password_file="${SOURCE_DIR}/distribution-cert-password.txt"
  if [[ ! -s "$cert_file" ]]; then
    echo "required distribution signing source missing or empty: distribution-cert.p12" >&2
    exit 1
  fi
  for path in "$password_file"; do
    if [[ ! -s "$path" ]]; then
      echo "required distribution signing source missing or empty: $path" >&2
      exit 1
    fi
    reject_placeholder_text "$path"
  done

  local out="${tmpdir}/distribution-signing.env"
  {
    printf 'APPLE_SIGNING_CERTIFICATE_BASE64=%s\n' "$(base64_file "$cert_file")"
    printf 'APPLE_SIGNING_CERTIFICATE_PASSWORD_BASE64=%s\n' "$(read_secret_text "$password_file" | base64_text)"
  } > "$out"
  printf '%s\n' "$out"
}

compose_sparkle_env() {
  local direct="${SOURCE_DIR}/sparkle.env"
  if [[ -s "$direct" ]]; then
    printf '%s\n' "$direct"
    return 0
  fi

  local key_file
  key_file="${SOURCE_DIR}/sparkle-eddsa.key"
  if [[ ! -s "$key_file" ]]; then
    return 1
  fi
  reject_placeholder_text "$key_file"

  local out="${tmpdir}/sparkle.env"
  printf 'SPARKLE_EDDSA_KEY_BASE64=%s\n' "$(base64_file "$key_file")" > "$out"
  printf '%s\n' "$out"
}

case "$ONLY" in
  all)
    appstore_env="$(compose_appstore_connect_env)"
    seal_secret "secrets/apple/appstore-connect.env.age" "$appstore_env"
    distribution_env="$(compose_distribution_signing_env)"
    seal_secret "secrets/apple/distribution-signing.env.age" "$distribution_env"
    if sparkle_env="$(compose_sparkle_env)"; then
      seal_secret "secrets/apple/sparkle.env.age" "$sparkle_env"
    fi
    ;;
  appstore-connect|app-store|appstore)
    appstore_env="$(compose_appstore_connect_env)"
    seal_secret "secrets/apple/appstore-connect.env.age" "$appstore_env"
    ;;
  distribution-signing|apple-signing)
    distribution_env="$(compose_distribution_signing_env)"
    seal_secret "secrets/apple/distribution-signing.env.age" "$distribution_env"
    ;;
  sparkle)
    if sparkle_env="$(compose_sparkle_env)"; then
      seal_secret "secrets/apple/sparkle.env.age" "$sparkle_env"
    else
      echo "required Sparkle source missing or empty: sparkle-eddsa.key" >&2
      exit 1
    fi
    ;;
esac

echo "Release secrets are sealed. Commit the .age files and deploy/use CI with an authorized age identity."