#!/bin/sh
set -eu

ROOT=$(CDPATH='' cd -- "$(dirname -- "$0")/.." && pwd)
ENV_FILE="$ROOT/.env"
config_home=${XDG_CONFIG_HOME:-"$HOME/.config"}

"$ROOT/scripts/ensure-local-public-origin.sh"
"$ROOT/scripts/validate-android-environment.sh" "$ENV_FILE" development

set -a
# shellcheck source=/dev/null
. "$ENV_FILE"
set +a

SIGNING_DIR=${WNH_ANDROID_DEVELOPMENT_SIGNING_DIR:-"$config_home/who_need_help/android-development"}
KEYSTORE="$SIGNING_DIR/who-need-help-development.p12"
PASSWORD_FILE="$SIGNING_DIR/who-need-help-development.password"

: "${WNH_TRACKING_MIN_TIME_MS:?Set WNH_TRACKING_MIN_TIME_MS in .env}"
: "${WNH_TRACKING_HTTP_TIMEOUT_MS:?Set WNH_TRACKING_HTTP_TIMEOUT_MS in .env}"
: "${WNH_ANDROID_VERSION_CODE:?Set WNH_ANDROID_VERSION_CODE in .env}"
: "${WNH_ANDROID_VERSION_NAME:?Set WNH_ANDROID_VERSION_NAME in .env}"
: "${WNH_ANDROID_DEVELOPMENT_SIGNING_KEY_ALIAS:?Set WNH_ANDROID_DEVELOPMENT_SIGNING_KEY_ALIAS in .env}"

for secret_file in "$KEYSTORE" "$PASSWORD_FILE"; do
  if [ ! -f "$secret_file" ]; then
    echo "Missing Android development signing file: $secret_file" >&2
    echo "Run scripts/init-android-development-signing.sh once." >&2
    exit 1
  fi

  mode=$(stat -c '%a' "$secret_file")
  case "$mode" in
    400|600) ;;
    *)
      echo "Android development signing file must have mode 0400 or 0600: $secret_file" >&2
      exit 1
      ;;
  esac
done

SIGNING_CERT_SHA256=$(
  keytool -list -v \
    -storetype PKCS12 \
    -keystore "$KEYSTORE" \
    -storepass:file "$PASSWORD_FILE" \
    -alias "$WNH_ANDROID_DEVELOPMENT_SIGNING_KEY_ALIAS" |
    awk -F': ' '
      /SHA256:/ {
        print $2
        found = 1
        exit
      }
      END { if (!found) exit 1 }
    '
)

docker build \
  --secret "id=android_nonproduction_keystore,src=$KEYSTORE" \
  --secret "id=android_nonproduction_password,src=$PASSWORD_FILE" \
  --secret "id=android_nonproduction_alias,env=WNH_ANDROID_DEVELOPMENT_SIGNING_KEY_ALIAS" \
  --build-arg "WNH_SIGNING_CERT_SHA256=$SIGNING_CERT_SHA256" \
  --build-arg "WNH_BASE_URL=$WNH_BASE_URL" \
  --build-arg "WNH_TRACKING_MIN_TIME_MS=$WNH_TRACKING_MIN_TIME_MS" \
  --build-arg "WNH_TRACKING_HTTP_TIMEOUT_MS=$WNH_TRACKING_HTTP_TIMEOUT_MS" \
  --build-arg "WNH_ANDROID_VERSION_CODE=$WNH_ANDROID_VERSION_CODE" \
  --build-arg "WNH_ANDROID_VERSION_NAME=$WNH_ANDROID_VERSION_NAME" \
  --build-arg "WNH_FIREBASE_APPLICATION_ID=${WNH_FIREBASE_APPLICATION_ID:-}" \
  --build-arg "WNH_FIREBASE_CLIENT_VALUE=${WNH_FIREBASE_API_KEY:-}" \
  --build-arg "WNH_FIREBASE_PROJECT_ID=${WNH_FIREBASE_PROJECT_ID:-}" \
  --build-arg "WNH_FIREBASE_GCM_SENDER_ID=${WNH_FIREBASE_GCM_SENDER_ID:-}" \
  --build-arg "WNH_PUBLIC_BUILD_TYPE=development" \
  --build-arg "WNH_EXPECTED_APPLICATION_ID=org.whoneedhelp.mobile.development" \
  --target public-artifact \
  --output "type=local,dest=$ROOT/android/dist-development" \
  "$ROOT/android"

"$ROOT/scripts/android-source-fingerprint.sh" \
  >"$ROOT/android/dist-development/source-fingerprint.sha256"

"$ROOT/scripts/android-app-links-verify.sh" \
  "$ENV_FILE" \
  "$ROOT/android/dist-development" \
  --online