#!/usr/bin/env bash
# Publish the current release APK to Zapstore.
# Requires: zsp in PATH, the release APK built, zapstore.env with SIGN_WITH,
#           and the debug signing keystore at android/app/debug.keystore.
#
# Usage:
#   ./scripts/release-zapstore.sh

set -euo pipefail

cd "$(dirname "$0")/.."

ENV_FILE="zapstore.env"
if [[ ! -f "$ENV_FILE" ]]; then
  echo "Missing $ENV_FILE — create it with:"
  echo '  echo SIGN_WITH=<your-nsec> > zapstore.env'
  echo '  (file is gitignored)'
  exit 1
fi

# shellcheck disable=SC1090
source "$ENV_FILE"

if [[ -z "${SIGN_WITH:-}" ]]; then
  echo "SIGN_WITH is empty in $ENV_FILE"
  exit 1
fi

export SIGN_WITH

APK="android/app/build/outputs/apk/release/app-release.apk"
if [[ ! -f "$APK" ]]; then
  echo "Release APK not found at $APK"
  echo "Build it first: ./gradlew assembleRelease"
  exit 1
fi

KEYSTORE="android/app/debug.keystore"
P12="android/app/debug.p12"
KEYSTORE_PASS="android"

if [[ ! -f "$KEYSTORE" ]]; then
  echo "Keystore not found at $KEYSTORE"
  exit 1
fi

# ── Convert JKS → PKCS12 (zsp requires PKCS12) ─────────────────────────
if [[ ! -f "$P12" ]]; then
  echo "→ Converting keystore to PKCS12..."
  keytool -importkeystore \
    -srckeystore "$KEYSTORE" \
    -destkeystore "$P12" \
    -srcstoretype JKS -deststoretype PKCS12 \
    -srcstorepass "$KEYSTORE_PASS" -deststorepass "$KEYSTORE_PASS" \
    -srcalias androiddebugkey -destalias androiddebugkey \
    -noprompt 2>/dev/null
fi

export KEYSTORE_PASSWORD="$KEYSTORE_PASS"

# ── Run a zsp command that needs TTY via script+expect. ─────────────────
# Writes a one-shot expect script to a temp file, invokes expect with it.
zsp_auto() {
  local title="$1"
  local zsp_cmd="$2"
  echo "→ $title..."
  local tmp
  tmp=$(mktemp)
  cat > "$tmp" << EOF
set timeout 300
spawn /bin/bash -c {script -q -c '@ZSP_CMD@' /dev/null}
expect {Choose an option:}
send "\r"
expect {
  {Published successfully} {}
  {already exists on} {
    puts stderr "Already published."
    exit 0
  }
  eof {}
}
expect eof
EOF
  sed -i "s#@ZSP_CMD@#$zsp_cmd#g" "$tmp"
  expect -f "$tmp" 2>/dev/null
  rm -f "$tmp"
}

# ── Link APK signing cert → Nostr identity ─────────────────────────────
zsp_auto "Linking signing certificate to Nostr identity" \
  "zsp identity --link-key $P12"

# ── Publish release ──────────────────────────────────────────────────
echo
echo "   APK:   $(du -h "$APK" | cut -f1)"
echo "   SHA256: $(sha256sum "$APK" | awk '{print $1}')"
echo

zsp_auto "Publishing Warden to Zapstore" \
  "zsp publish --skip-preview --skip-metadata --overwrite-release --skip-certificate-linking zapstore.yaml"

rm -f "$P12"

echo
echo "Done. Check https://zapstore.dev"