#!/bin/sh
# Build the signed release APK for Kepr Builds.
#
# Signing comes from local.properties (koh-ignored); without it the release APK
# is unsigned and Android refuses to install it, so fail loudly here rather than
# publish something nobody can install. After the build we additionally verify
# the produced artifact (audit M-10): a configured keystore does not by itself
# prove the APK is signed, that its applicationId and versionCode match the
# release policy, or that the v2/v3 signing chain is intact.
set -eu

JAVA_HOME="${JAVA_HOME:-/Applications/Android Studio.app/Contents/jbr/Contents/Home}"
export JAVA_HOME

# Canonical values live in app/build.gradle (defaultConfig.applicationId,
# defaultConfig.versionCode). Update these constants only when that file
# changes — they are the post-build cross-check the audit calls for.
EXPECTED_APPLICATION_ID="com.peachpasswords"
EXPECTED_VERSION_CODE="240145"

./gradlew --no-configuration-cache :app:assembleRelease

APK=app/build/outputs/apk/release/app-release.apk
if [ ! -f "$APK" ]; then
    echo "refusing to publish: $APK not produced" >&2
    exit 1
fi

APKSIGNER=""
if [ -n "${ANDROID_HOME:-}" ] && [ -x "${ANDROID_HOME}/build-tools/latest/apksigner" ]; then
    APKSIGNER="${ANDROID_HOME}/build-tools/latest/apksigner"
elif command -v apksigner >/dev/null 2>&1; then
    APKSIGNER=$(command -v apksigner)
else
    echo "refusing to publish: apksigner not found (set ANDROID_HOME or add to PATH)" >&2
    exit 1
fi

if ! "$APKSIGNER" verify --print-certs "$APK"; then
    echo "refusing to publish: $APK failed apksigner verify (unsigned or v1-only)" >&2
    exit 1
fi

AAPT2=""
if [ -n "${ANDROID_HOME:-}" ] && [ -x "${ANDROID_HOME}/build-tools/latest/aapt2" ]; then
    AAPT2="${ANDROID_HOME}/build-tools/latest/aapt2"
elif command -v aapt2 >/dev/null 2>&1; then
    AAPT2=$(command -v aapt2)
else
    echo "refusing to publish: aapt2 not found (set ANDROID_HOME or add to PATH)" >&2
    exit 1
fi

BADGING=$("$AAPT2" dump badging "$APK")
ACTUAL_APPID=$(echo "$BADGING" | sed -n "s/^package: name='\([^']*\)'.*/\1/p")
ACTUAL_VCODE=$(echo "$BADGING" | sed -n "s/^package:.*versionCode='\([^']*\)'.*/\1/p")
if [ "$ACTUAL_APPID" != "$EXPECTED_APPLICATION_ID" ]; then
    echo "refusing to publish: applicationId '$ACTUAL_APPID' != expected '$EXPECTED_APPLICATION_ID'" >&2
    exit 1
fi
if [ "$ACTUAL_VCODE" != "$EXPECTED_VERSION_CODE" ]; then
    echo "refusing to publish: versionCode '$ACTUAL_VCODE' != expected '$EXPECTED_VERSION_CODE'" >&2
    exit 1
fi

mkdir -p build/kepr
cp "$APK" build/kepr/peach-android.apk

if ! grep -q '^peachStoreFile=' local.properties 2>/dev/null; then
    echo "refusing to publish: no signing key configured in local.properties" >&2
    exit 1
fi