#!/usr/bin/env bash

# Install iOS CI signing assets on a GitHub-hosted macOS runner.
#
# Usage in GitHub Actions:
#   - name: Install Apple signing assets
#     run: scripts/ios-ci-install-signing-assets.sh
#     env:
#       BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
#       P12_PASSWORD: ${{ secrets.P12_PASSWORD }}
#       BUILD_PROVISION_PROFILE_BASE64: ${{ secrets.BUILD_PROVISION_PROFILE_BASE64 }}
#       KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
#       IOS_BUNDLE_ID_PREFIX: ${{ vars.IOS_BUNDLE_ID_PREFIX }}
#
# The script imports the CI certificate into a temporary keychain, installs the
# provisioning profile, and writes platform/darwin/bazel/config.bzl so Bazel and
# rules_xcodeproj use the same team/profile/bundle prefix on ephemeral runners.

set -euo pipefail

script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
repo_root="$(cd "$script_dir/../../.." && pwd)"

require_env() {
  local name="$1"
  if [[ -z "${!name:-}" ]]; then
    echo "::error::$name is required"
    exit 1
  fi
}

decode_base64_to_file() {
  local value="$1"
  local path="$2"

  if ! printf '%s' "$value" | base64 --decode >"$path" 2>/dev/null; then
    printf '%s' "$value" | base64 -D >"$path"
  fi
}

require_env BUILD_CERTIFICATE_BASE64
require_env P12_PASSWORD
require_env BUILD_PROVISION_PROFILE_BASE64
require_env KEYCHAIN_PASSWORD

ios_bundle_id_prefix="${IOS_BUNDLE_ID_PREFIX:-org.maplibre}"
runner_temp="${RUNNER_TEMP:-$(mktemp -d)}"

certificate_path="$runner_temp/ios-ci-certificate.p12"
profile_path="$runner_temp/ios-ci-profile.mobileprovision"
profile_plist_path="$runner_temp/ios-ci-profile.plist"
keychain_path="$runner_temp/ios-ci-signing.keychain-db"
profiles_dir="$HOME/Library/MobileDevice/Provisioning Profiles"

decode_base64_to_file "$BUILD_CERTIFICATE_BASE64" "$certificate_path"
decode_base64_to_file "$BUILD_PROVISION_PROFILE_BASE64" "$profile_path"

security create-keychain -p "$KEYCHAIN_PASSWORD" "$keychain_path"
security set-keychain-settings -lut 21600 "$keychain_path"
security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$keychain_path"
security import "$certificate_path" -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k "$keychain_path"
security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" "$keychain_path"
security list-keychain -d user -s "$keychain_path"

mkdir -p "$profiles_dir"
security cms -D -i "$profile_path" >"$profile_plist_path"

profile_uuid="$(/usr/libexec/PlistBuddy -c 'Print UUID' "$profile_plist_path")"
profile_name="$(/usr/libexec/PlistBuddy -c 'Print Name' "$profile_plist_path")"
team_id="$(/usr/libexec/PlistBuddy -c 'Print TeamIdentifier:0' "$profile_plist_path")"

cp "$profile_path" "$profiles_dir/$profile_uuid.mobileprovision"

cat >"$repo_root/platform/darwin/bazel/config.bzl" <<CONFIG
# Generated by platform/ios/scripts/ios-ci-install-signing-assets.sh.
APPLE_MOBILE_PROVISIONING_PROFILE_TEAM_ID = "$team_id"
APPLE_MOBILE_PROVISIONING_PROFILE_NAME = "$profile_name"
BUNDLE_ID_PREFIX = "$ios_bundle_id_prefix"
API_KEY = "0000000000"
CONFIG

echo "Installed provisioning profile '$profile_name' for team '$team_id'."
echo "Generated platform/darwin/bazel/config.bzl with bundle ID prefix '$ios_bundle_id_prefix'."