#!/bin/sh
set -eu

repo_root=$(CDPATH= cd -- "$(dirname -- "$0")/../.." && pwd)
app_root="$repo_root/client/flutter_android"
artifacts_root="$repo_root/artifacts"
apk_source="$app_root/build/app/outputs/flutter-apk/app-release.apk"
keystore_path=

cleanup() {
    if [ -n "$keystore_path" ] && [ -f "$keystore_path" ]; then
        rm -f -- "$keystore_path"
    fi
    unset REMOTEDESK_ANDROID_KEYSTORE_PATH
    unset REMOTEDESK_ANDROID_KEYSTORE_PASSWORD
    unset REMOTEDESK_ANDROID_KEY_ALIAS
    unset REMOTEDESK_ANDROID_KEY_PASSWORD
}
trap cleanup EXIT HUP INT TERM

has_signing=0
if [ -n "${ANDROID_KEYSTORE_BASE64:-}" ] ||
    [ -n "${ANDROID_KEYSTORE_PASSWORD:-}" ] ||
    [ -n "${ANDROID_KEY_ALIAS:-}" ] ||
    [ -n "${ANDROID_KEY_PASSWORD:-}" ]; then
    has_signing=1
fi

if [ "$has_signing" -eq 1 ] && {
    [ -z "${ANDROID_KEYSTORE_BASE64:-}" ] ||
    [ -z "${ANDROID_KEYSTORE_PASSWORD:-}" ] ||
    [ -z "${ANDROID_KEY_ALIAS:-}" ] ||
    [ -z "${ANDROID_KEY_PASSWORD:-}" ];
}; then
    echo "Android release signing secrets are incomplete" >&2
    exit 1
fi

require_signing=${REQUIRE_RELEASE_SIGNING:-0}
if [ "${DRONE_BUILD_EVENT:-}" = "tag" ]; then
    require_signing=1
fi
if [ "$require_signing" -eq 1 ] && [ "$has_signing" -ne 1 ]; then
    echo "A tag build requires all Android release signing secrets" >&2
    exit 1
fi

if [ "$has_signing" -eq 1 ]; then
    keystore_path=$(mktemp "${TMPDIR:-/tmp}/remotedesk-android-keystore.XXXXXX")
    chmod 600 "$keystore_path"
    printf '%s' "$ANDROID_KEYSTORE_BASE64" | base64 -d > "$keystore_path"
    if [ ! -s "$keystore_path" ]; then
        echo "Decoded Android keystore is empty" >&2
        exit 1
    fi
    export REMOTEDESK_ANDROID_KEYSTORE_PATH="$keystore_path"
    export REMOTEDESK_ANDROID_KEYSTORE_PASSWORD="$ANDROID_KEYSTORE_PASSWORD"
    export REMOTEDESK_ANDROID_KEY_ALIAS="$ANDROID_KEY_ALIAS"
    export REMOTEDESK_ANDROID_KEY_PASSWORD="$ANDROID_KEY_PASSWORD"
fi

cd "$app_root"
flutter build apk --release
if [ ! -s "$apk_source" ]; then
    echo "Android release APK was not generated" >&2
    exit 1
fi

android_sdk=${ANDROID_SDK_ROOT:-${ANDROID_HOME:-}}
if [ -z "$android_sdk" ] || [ ! -d "$android_sdk/build-tools" ]; then
    echo "Android SDK build-tools are unavailable" >&2
    exit 1
fi
apksigner=$(find "$android_sdk/build-tools" -type f -name apksigner -print | sort -V | tail -n 1)
if [ -z "$apksigner" ]; then
    echo "apksigner is unavailable" >&2
    exit 1
fi
signature_report=$($apksigner verify --verbose --print-certs "$apk_source")
printf '%s\n' "$signature_report"
if [ "$has_signing" -eq 1 ] && printf '%s\n' "$signature_report" | grep -Fq 'CN=Android Debug'; then
    echo "Production signing was requested but the APK uses the Android debug certificate" >&2
    exit 1
fi

version=$(sed -n 's/^version:[[:space:]]*//p' "$app_root/pubspec.yaml" | head -n 1 | tr -d '\r')
case "$version" in
    *+*) ;;
    *) echo "Android pubspec version must contain a build number" >&2; exit 1 ;;
esac
version_name=${version%+*}
version_code=${version#*+}
case "$version_name" in
    ''|*[!0-9A-Za-z._-]*) echo "Android version name is unsafe" >&2; exit 1 ;;
esac
case "$version_code" in
    ''|*[!0-9]*) echo "Android build number is invalid" >&2; exit 1 ;;
esac

mkdir -p "$artifacts_root"
apk_name="RemoteDesk-Android-${version_name}-build${version_code}.apk"
apk_output="$artifacts_root/$apk_name"
install -m 0644 "$apk_source" "$apk_output"
apk_hash=$(sha256sum "$apk_output" | cut -d ' ' -f 1)
printf '%s  %s\n' "$apk_hash" "$apk_name" > "$apk_output.sha256"
printf 'Package: %s\n' "$apk_output"
printf 'SHA256: %s\n' "$apk_hash"