#!/bin/bash
# Script to sign and notarize goca Darwin binaries.
#
# Runs after ./build.sh and before the release is uploaded: it signs the files
# in ./bin in place, so what goes into the Gitea release — and thus what
# --update hands out — is the signed and notarized binary.

set -e

# Make sure we are in the script's directory
cd "$(dirname "$0")"

# Validate required variables
if [ -z "$APPLE_ID" ] || [ -z "$APPLE_PASSWORD" ] || [ -z "$TEAM_ID" ]; then
    echo "❌ Error: Please set the required environment variables: APPLE_ID, APPLE_PASSWORD, and TEAM_ID."
    echo ""
    echo "Example usage:"
    echo "  export APPLE_ID='mw@pstbx.org'"
    echo "  export APPLE_PASSWORD='your-app-specific-password'"
    echo "  export TEAM_ID='26TUG6V94S'"
    echo "  ./notarize.sh"
    exit 1
fi

SIGNING_IDENTITY="Developer ID Application: Mike Wesemann ($TEAM_ID)"

# Verify binaries exist
if [ ! -f "bin/goca-darwin-amd64" ] || [ ! -f "bin/goca-darwin-arm64" ]; then
    echo "❌ Error: Darwin binaries not found in 'bin/'. Run ./build.sh first."
    exit 1
fi

echo "🔐 Step 1: Codesigning Darwin binaries..."
codesign --force --options runtime --timestamp --sign "$SIGNING_IDENTITY" bin/goca-darwin-amd64
codesign --force --options runtime --timestamp --sign "$SIGNING_IDENTITY" bin/goca-darwin-arm64

echo "📦 Step 2: Packaging binaries into ZIP archives..."
mkdir -p bin/notarize
rm -f bin/notarize/*.zip
ditto -c -k --keepParent bin/goca-darwin-amd64 bin/notarize/goca-darwin-amd64.zip
ditto -c -k --keepParent bin/goca-darwin-arm64 bin/notarize/goca-darwin-arm64.zip

echo "🚀 Step 3: Submitting macOS Intel binary (amd64) to Apple Notarization..."
xcrun notarytool submit bin/notarize/goca-darwin-amd64.zip \
  --apple-id "$APPLE_ID" \
  --password "$APPLE_PASSWORD" \
  --team-id "$TEAM_ID" \
  --wait

echo "🚀 Step 4: Submitting macOS Apple Silicon binary (arm64) to Apple Notarization..."
xcrun notarytool submit bin/notarize/goca-darwin-arm64.zip \
  --apple-id "$APPLE_ID" \
  --password "$APPLE_PASSWORD" \
  --team-id "$TEAM_ID" \
  --wait

echo "🎉 Notarization successfully completed for both macOS binaries!"