#!/usr/bin/env bash
# Создаёт release keystore для подписи APK, если его ещё нет.
set -euo pipefail

SECRETS_DIR="${ANDROID_SECRETS_DIR:-/workspace/tauri_app/.secrets}"
KEYSTORE_FILE="${ANDROID_KEYSTORE_FILE:-${SECRETS_DIR}/lendry-id-release.keystore}"
KEY_ALIAS="${ANDROID_KEY_ALIAS:-lendry-id}"
CREDENTIALS_FILE="${SECRETS_DIR}/signing-credentials.env"
KEYSTORE_PROPS_TEMPLATE="${SECRETS_DIR}/keystore.properties.template"

mkdir -p "${SECRETS_DIR}"
chmod 700 "${SECRETS_DIR}" || true

if [[ -f "${KEYSTORE_FILE}" ]]; then
  echo "==> Android keystore уже существует: ${KEYSTORE_FILE}"
  if [[ ! -f "${PROPS_TEMPLATE}" && -f "${CREDENTIALS_FILE}" ]]; then
    # shellcheck disable=SC1090
    source "${CREDENTIALS_FILE}"
    cat > "${PROPS_TEMPLATE}" <<EOF
storePassword=${ANDROID_KEYSTORE_PASSWORD}
keyPassword=${ANDROID_KEY_PASSWORD}
keyAlias=${ANDROID_KEY_ALIAS}
storeFile=../../../.secrets/lendry-id-release.keystore
EOF
    chmod 600 "${PROPS_TEMPLATE}" || true
    echo "==> Восстановлен keystore.properties.template из signing-credentials.env"
  fi
  exit 0
fi

if ! command -v keytool >/dev/null 2>&1; then
  echo "keytool не найден — нужен JDK для генерации keystore" >&2
  exit 1
fi

gen_secret() {
  if command -v openssl >/dev/null 2>&1; then
    openssl rand -base64 32 | tr -dc 'A-Za-z0-9' | head -c 24
  else
    date +%s%N | sha256sum | head -c 24
  fi
}

STORE_PASSWORD="$(gen_secret)"
KEY_PASSWORD="$(gen_secret)"

echo "==> Генерация release keystore для подписи APK..."
keytool -genkeypair -v \
  -storetype PKCS12 \
  -keystore "${KEYSTORE_FILE}" \
  -alias "${KEY_ALIAS}" \
  -keyalg RSA \
  -keysize 2048 \
  -validity 10000 \
  -storepass "${STORE_PASSWORD}" \
  -keypass "${KEY_PASSWORD}" \
  -dname "CN=Lendry ID, OU=Mobile, O=Lendry, C=RU"

chmod 600 "${KEYSTORE_FILE}" || true

cat > "${CREDENTIALS_FILE}" <<EOF
# Сгенерировано $(date -u +"%Y-%m-%dT%H:%M:%SZ") — храните в безопасном месте.
ANDROID_KEYSTORE_FILE=${KEYSTORE_FILE}
ANDROID_KEY_ALIAS=${KEY_ALIAS}
ANDROID_KEYSTORE_PASSWORD=${STORE_PASSWORD}
ANDROID_KEY_PASSWORD=${KEY_PASSWORD}
EOF
chmod 600 "${CREDENTIALS_FILE}" || true

cat > "${KEYSTORE_PROPS_TEMPLATE}" <<EOF
storePassword=${STORE_PASSWORD}
keyPassword=${KEY_PASSWORD}
keyAlias=${KEY_ALIAS}
storeFile=../../../.secrets/lendry-id-release.keystore
EOF
chmod 600 "${KEYSTORE_PROPS_TEMPLATE}" || true

echo "==> Keystore создан: ${KEYSTORE_FILE}"
echo "==> Пароли сохранены: ${CREDENTIALS_FILE}"