#!/bin/bash
# Script to sign and notarize goca Darwin binaries

set -e

# Make sure we are in the script's directory
cd "$(dirname "$0")"

# Validate required variables
if [ -z "$APPLE_ID" ] || [ -z "$APPLE_PASSWORD" ] || [ -z "$TEAM_ID" ]; then
    echo "❌ Error: Please set the required environment variables: APPLE_ID, APPLE_PASSWORD, and TEAM_ID."
    echo ""
    echo "Example usage:"
    echo "  export APPLE_ID='mw@pstbx.org'"
    echo "  export APPLE_PASSWORD='your-app-specific-password'"
    echo "  export TEAM_ID='26TUG6V94S'"
    echo "  ./notarize.sh"
    exit 1
fi

SIGNING_IDENTITY="Developer ID Application: Mike Wesemann ($TEAM_ID)"

# Verify binaries exist
if [ ! -f "dist/goca-darwin-amd64" ] || [ ! -f "dist/goca-darwin-arm64" ]; then
    echo "❌ Error: Darwin binaries not found in 'dist/'. Run ./build_releases.sh first."
    exit 1
fi

echo "🔐 Step 1: Codesigning Darwin binaries..."
codesign --force --options runtime --timestamp --sign "$SIGNING_IDENTITY" dist/goca-darwin-amd64
codesign --force --options runtime --timestamp --sign "$SIGNING_IDENTITY" dist/goca-darwin-arm64

echo "📦 Step 2: Packaging binaries into ZIP archives..."
mkdir -p dist/notarize
rm -f dist/notarize/*.zip
ditto -c -k --keepParent dist/goca-darwin-amd64 dist/notarize/goca-darwin-amd64.zip
ditto -c -k --keepParent dist/goca-darwin-arm64 dist/notarize/goca-darwin-arm64.zip

echo "🚀 Step 3: Submitting macOS Intel binary (amd64) to Apple Notarization..."
xcrun notarytool submit dist/notarize/goca-darwin-amd64.zip \
  --apple-id "$APPLE_ID" \
  --password "$APPLE_PASSWORD" \
  --team-id "$TEAM_ID" \
  --wait

echo "🚀 Step 4: Submitting macOS Apple Silicon binary (arm64) to Apple Notarization..."
xcrun notarytool submit dist/notarize/goca-darwin-arm64.zip \
  --apple-id "$APPLE_ID" \
  --password "$APPLE_PASSWORD" \
  --team-id "$TEAM_ID" \
  --wait

echo "🎉 Notarization successfully completed for both macOS binaries!"