#!/usr/bin/env bash
set -euo pipefail

repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
credentials_file="${HT_ANDROID_SIGNING_PROPERTIES:-${HOME}/.config/hivetechnology/o20010.06/android-upload.env}"
submodule="$repo_root/third_party/n3n"
patch="$repo_root/patches/n3n/embedded-mobile-integration.patch"

if [[ ! -r "$credentials_file" ]]; then
	echo >&2 "Android signing credentials not found: $credentials_file"
	exit 1
fi

set -a
# The credentials file is private, generated locally, and contains only
# HT_ANDROID_* assignments.
# shellcheck source=/dev/null
source "$credentials_file"
set +a

required=(
	HT_ANDROID_KEYSTORE_FILE
	HT_ANDROID_KEYSTORE_PASSWORD
	HT_ANDROID_KEY_ALIAS
	HT_ANDROID_KEY_PASSWORD
)
for name in "${required[@]}"; do
	if [[ -z "${!name:-}" ]]; then
		echo >&2 "Missing $name in $credentials_file"
		exit 1
	fi
done

cd "$repo_root"
patch_was_present=false
if git -C "$submodule" apply --check --reverse "$patch" >/dev/null 2>&1; then
	patch_was_present=true
fi

cleanup() {
	if [[ "$patch_was_present" == false ]] &&
		git -C "$submodule" apply --check --reverse "$patch" >/dev/null 2>&1; then
		git -C "$submodule" apply --reverse "$patch"
	fi
}
trap cleanup EXIT

scripts/apply-n3n-patches.sh
./gradlew --no-daemon bundleRelease assembleRelease

bundle="$repo_root/android/app/build/outputs/bundle/release/app-release.aab"
apk="$repo_root/android/app/build/outputs/apk/release/app-release.apk"
scripts/check-android-16k.sh "$bundle"
required_legal_assets=(
	base/assets/legal/GPL-3.0-only.txt
	base/assets/legal/LGPL-2.1-only.txt
	base/assets/legal/THIRD_PARTY_NOTICES.md
)
for asset in "${required_legal_assets[@]}"; do
	if ! jar tf "$bundle" | grep -Fqx "$asset"; then
		echo >&2 "Android bundle is missing required legal asset: $asset"
		exit 1
	fi
done

android_sdk_root="${ANDROID_SDK_ROOT:-${ANDROID_HOME:-}}"
if [[ -z "$android_sdk_root" && -f "$repo_root/local.properties" ]]; then
	android_sdk_root=$(sed -n 's/^sdk\.dir=//p' "$repo_root/local.properties" | head -1)
fi
apksigner=""
if [[ -n "$android_sdk_root" && -d "$android_sdk_root/build-tools" ]]; then
	apksigner=$(find "$android_sdk_root/build-tools" -type f -name apksigner -perm -u+x | sort -V | tail -1)
fi
if [[ -z "$apksigner" ]]; then
	echo >&2 "Unable to find apksigner under ANDROID_SDK_ROOT or ANDROID_HOME"
	exit 1
fi
"$apksigner" verify --verbose --print-certs "$apk"

version_name="$(sed -n 's/^[[:space:]]*versionName = "\([^"]*\)"/\1/p' android/app/build.gradle.kts | head -1)"
if [[ -z "$version_name" ]]; then
	echo >&2 "Unable to read Android versionName"
	exit 1
fi

release_bundle="$repo_root/dist/HT-Portal-VPN-$version_name.aab"
release_apk="$repo_root/dist/HT-Portal-VPN-$version_name.apk"
mkdir -p "$repo_root/dist"
cp "$bundle" "$release_bundle"
cp "$apk" "$release_apk"
(
	cd "$(dirname "$release_bundle")"
	sha256sum "$(basename "$release_bundle")" >"$(basename "$release_bundle").sha256"
	sha256sum "$(basename "$release_apk")" >"$(basename "$release_apk").sha256"
)
echo "Android release bundle: $release_bundle"
echo "Android release APK: $release_apk"
