#!/bin/sh
set -eu

ROOT=$(CDPATH='' cd -- "$(dirname -- "$0")/.." && pwd)
ENV_FILE=${WNH_ENV_FILE:-"$ROOT/.env"}
config_home=${XDG_CONFIG_HOME:-"$HOME/.config"}
SIGNING_DIR=${WNH_ANDROID_SIGNING_DIR:-"$config_home/who_need_help/android-release"}
KEYSTORE="$SIGNING_DIR/who-need-help-upload.p12"
PASSWORD_FILE="$SIGNING_DIR/who-need-help-upload.password"
OUTPUT_DIR=${WNH_ANDROID_RELEASE_OUTPUT_DIR:-"$ROOT/android/dist-release"}

case "$ENV_FILE" in
  /*) ;;
  *) ENV_FILE="$ROOT/$ENV_FILE" ;;
esac

if [ ! -f "$ENV_FILE" ]; then
  echo "Missing Android release environment file: $ENV_FILE" >&2
  exit 1
fi

set -a
# shellcheck source=/dev/null
. "$ENV_FILE"
set +a

"$ROOT/scripts/validate-android-environment.sh" "$ENV_FILE" production
"$ROOT/scripts/android-play-policy-check.sh"

: "${WNH_BASE_URL:?Set WNH_BASE_URL in the selected environment file}"
: "${WNH_TRACKING_MIN_TIME_MS:?Set WNH_TRACKING_MIN_TIME_MS in the selected environment file}"
: "${WNH_TRACKING_HTTP_TIMEOUT_MS:?Set WNH_TRACKING_HTTP_TIMEOUT_MS in the selected environment file}"
: "${WNH_ANDROID_VERSION_CODE:?Set WNH_ANDROID_VERSION_CODE in the selected environment file}"
: "${WNH_ANDROID_VERSION_NAME:?Set WNH_ANDROID_VERSION_NAME in the selected environment file}"
: "${WNH_ANDROID_SIGNING_KEY_ALIAS:?Set WNH_ANDROID_SIGNING_KEY_ALIAS in the selected environment file}"

for secret_file in "$KEYSTORE" "$PASSWORD_FILE"; do
  if [ ! -f "$secret_file" ]; then
    echo "Missing Android release signing file: $secret_file" >&2
    echo "Run scripts/init-android-release-signing.sh once." >&2
    exit 1
  fi

  mode=$(stat -c '%a' "$secret_file")
  case "$mode" in
    400|600) ;;
    *)
      echo "Android release signing file must have mode 0400 or 0600: $secret_file" >&2
      exit 1
      ;;
  esac
done

SIGNING_CERT_SHA256=$(
  keytool -list -v \
    -storetype PKCS12 \
    -keystore "$KEYSTORE" \
    -storepass:file "$PASSWORD_FILE" \
    -alias "$WNH_ANDROID_SIGNING_KEY_ALIAS" |
    awk -F': ' '
      /SHA256:/ {
        print $2
        found = 1
        exit
      }
      END { if (!found) exit 1 }
    '
)

case "$OUTPUT_DIR" in
  /*) ;;
  *) OUTPUT_DIR="$ROOT/$OUTPUT_DIR" ;;
esac

docker build \
  --secret "id=android_upload_keystore,src=$KEYSTORE" \
  --secret "id=android_upload_password,src=$PASSWORD_FILE" \
  --secret "id=android_upload_alias,env=WNH_ANDROID_SIGNING_KEY_ALIAS" \
  --build-arg "WNH_SIGNING_CERT_SHA256=$SIGNING_CERT_SHA256" \
  --build-arg "WNH_BASE_URL=$WNH_BASE_URL" \
  --build-arg "WNH_TRACKING_MIN_TIME_MS=$WNH_TRACKING_MIN_TIME_MS" \
  --build-arg "WNH_TRACKING_HTTP_TIMEOUT_MS=$WNH_TRACKING_HTTP_TIMEOUT_MS" \
  --build-arg "WNH_ANDROID_VERSION_CODE=$WNH_ANDROID_VERSION_CODE" \
  --build-arg "WNH_ANDROID_VERSION_NAME=$WNH_ANDROID_VERSION_NAME" \
  --build-arg "WNH_FIREBASE_APPLICATION_ID=${WNH_FIREBASE_APPLICATION_ID:-}" \
  --build-arg "WNH_FIREBASE_CLIENT_VALUE=${WNH_FIREBASE_API_KEY:-}" \
  --build-arg "WNH_FIREBASE_PROJECT_ID=${WNH_FIREBASE_PROJECT_ID:-}" \
  --build-arg "WNH_FIREBASE_GCM_SENDER_ID=${WNH_FIREBASE_GCM_SENDER_ID:-}" \
  --target release-artifact \
  --output "type=local,dest=$OUTPUT_DIR" \
  "$ROOT/android"

"$ROOT/scripts/android-source-fingerprint.sh" \
  >"$OUTPUT_DIR/source-fingerprint.sha256"

for artifact in \
  "$OUTPUT_DIR/who-need-help-release.apk" \
  "$OUTPUT_DIR/who-need-help-release.aab" \
  "$OUTPUT_DIR/who-need-help-release-universal.apks" \
  "$OUTPUT_DIR/who-need-help-release-universal.apk" \
  "$OUTPUT_DIR/signing-certificate.txt" \
  "$OUTPUT_DIR/universal-signing-certificate.txt" \
  "$OUTPUT_DIR/package-name.txt" \
  "$OUTPUT_DIR/universal-package-name.txt" \
  "$OUTPUT_DIR/bundle-signing-verification.txt" \
  "$OUTPUT_DIR/bundletool-validation.txt" \
  "$OUTPUT_DIR/source-fingerprint.sha256" \
  "$OUTPUT_DIR/lint-results-release.html"; do
  if [ ! -s "$artifact" ]; then
    echo "Android release build did not export the expected artifact: $artifact" >&2
    exit 1
  fi
done

"$ROOT/scripts/android-app-links-verify.sh" "$ENV_FILE" "$OUTPUT_DIR"

sha256sum \
  "$OUTPUT_DIR/who-need-help-release.apk" \
  "$OUTPUT_DIR/who-need-help-release.aab" \
  "$OUTPUT_DIR/who-need-help-release-universal.apks" \
  "$OUTPUT_DIR/who-need-help-release-universal.apk"
echo "Signed Android APK, Play AAB, universal APK set, reports, and lint report: $OUTPUT_DIR"