#!/usr/bin/env bash
# Optional release signing / notarization for macOS Navis.app / DMG.
# Requires Apple Developer ID + notarytool credentials in the environment.
#
# Usage:
#   export NAVIS_CODESIGN_IDENTITY="Developer ID Application: Example Ltd (TEAMID)"
#   export NAVIS_NOTARY_PROFILE="navis-notary"   # xcrun notarytool store-credentials
#   ./scripts/sign-macos.sh dist/navis-release/darwin-arm64/Navis.dmg
#   # or a staged .app:
#   ./scripts/sign-macos.sh /path/to/Navis.app
set -euo pipefail

TARGET="${1:-}"
if [[ -z "$TARGET" || ! -e "$TARGET" ]]; then
  echo "usage: $0 <Navis.app|Navis.dmg>" >&2
  exit 2
fi

IDENTITY="${NAVIS_CODESIGN_IDENTITY:-}"
if [[ -z "$IDENTITY" ]]; then
  echo "NAVIS_CODESIGN_IDENTITY is required (Developer ID Application: …)" >&2
  exit 1
fi

sign_app() {
  local app="$1"
  echo "codesign $app as $IDENTITY"
  codesign -s "$IDENTITY" --force --deep --options runtime --timestamp "$app"
  codesign --verify --deep --strict "$app"
}

if [[ "$TARGET" == *.app || -d "$TARGET" ]]; then
  sign_app "$TARGET"
  echo "Signed app. Notarize the DMG that contains it via notarytool."
  exit 0
fi

if [[ "$TARGET" == *.dmg ]]; then
  # Sign nested .app if present after attach is awkward; prefer signing .app before packmac.
  # Here we submit the DMG for notarization when credentials exist.
  if [[ -n "${NAVIS_NOTARY_PROFILE:-}" ]]; then
    echo "notarytool submit $TARGET (profile=$NAVIS_NOTARY_PROFILE)"
    xcrun notarytool submit "$TARGET" --keychain-profile "$NAVIS_NOTARY_PROFILE" --wait
    xcrun stapler staple "$TARGET"
    echo "Notarized + stapled: $TARGET"
  else
    echo "DMG ready. Set NAVIS_NOTARY_PROFILE and re-run to notarize."
    echo "Tip: packmac with NAVIS_CODESIGN_IDENTITY set signs the .app before zip/dmg."
  fi
  exit 0
fi

echo "unsupported target: $TARGET" >&2
exit 2