#!/usr/bin/env bash
set -euo pipefail

PROJECT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
TOPIC_DIR="$(cd "$PROJECT_DIR/../../.." && pwd)"
APK_PATH="${1:-$TOPIC_DIR/downloads/electronic-menu-tv-rdfz-v1.3.10-release-signed.apk}"
API_BASE_URL='https://rdfz.yyangpt.cn'
EXPECTED_PACKAGE='com.cpt.electronicmenu.tv'
EXPECTED_VERSION='1.3.10'
EXPECTED_SHA256='49d212657446e3fbf4171d546edd97709e713eccca5972e3ea39ba1a6a5b019a'
EXPECTED_CERT_SHA256='bdbcbb852b3fde2ffc91a4a4229955ca7265d2f51f74b778a4a9d12ac3915674'
MIN_CERT_DAYS="${MIN_CERT_DAYS:-30}"
SDK_ROOT="${ANDROID_SDK_ROOT:-$HOME/Library/Android/sdk}"
JAVA_HOME_VALUE="${JAVA_HOME:-/Applications/Android Studio.app/Contents/jre/Contents/Home}"
AAPT_BIN="${AAPT_BIN:-$(find "$SDK_ROOT/build-tools" -type f -name aapt | sort -V | tail -1)}"
APKSIGNER_BIN="${APKSIGNER_BIN:-$(find "$SDK_ROOT/build-tools" -type f -name apksigner | sort -V | tail -1)}"

fail() {
  echo "上线门禁失败：$*" >&2
  exit 1
}

for executable in curl openssl shasum unzip strings; do
  command -v "$executable" >/dev/null 2>&1 || fail "缺少命令：$executable"
done
[[ -f "$APK_PATH" ]] || fail "APK 不存在：$APK_PATH"
[[ -x "$AAPT_BIN" ]] || fail "aapt 不可用：$AAPT_BIN"
[[ -x "$APKSIGNER_BIN" ]] || fail "apksigner 不可用：$APKSIGNER_BIN"
[[ -x "$JAVA_HOME_VALUE/bin/java" ]] || fail "Java 运行时不可用：$JAVA_HOME_VALUE"
[[ "$MIN_CERT_DAYS" =~ ^[0-9]+$ ]] || fail "MIN_CERT_DAYS 必须是非负整数"

export JAVA_HOME="$JAVA_HOME_VALUE"
export PATH="$JAVA_HOME/bin:$PATH"

actual_sha256="$(shasum -a 256 "$APK_PATH" | awk '{print $1}')"
[[ "$actual_sha256" == "$EXPECTED_SHA256" ]] \
  || fail "APK SHA-256 不匹配，期望 $EXPECTED_SHA256，实际 $actual_sha256"

badging="$($AAPT_BIN dump badging "$APK_PATH")"
package_name="$(printf '%s\n' "$badging" | sed -n "s/^package: name='\([^']*\)'.*/\1/p")"
version_name="$(printf '%s\n' "$badging" | sed -n "s/^package: .*versionName='\([^']*\)'.*/\1/p")"
[[ "$package_name" == "$EXPECTED_PACKAGE" ]] || fail "包名错误：$package_name"
[[ "$version_name" == "$EXPECTED_VERSION" ]] || fail "版本错误：$version_name"
printf '%s\n' "$badging" | grep -q "testOnly='" && fail "正式包包含 testOnly" || true

signature_report="$($APKSIGNER_BIN verify --verbose --print-certs "$APK_PATH")"
printf '%s\n' "$signature_report" | grep -q 'Verified using v1 scheme (JAR signing): true' \
  || fail "APK 未通过 v1 签名验证"
printf '%s\n' "$signature_report" | grep -q 'Verified using v2 scheme (APK Signature Scheme v2): true' \
  || fail "APK 未通过 v2 签名验证"
cert_sha256="$(printf '%s\n' "$signature_report" | sed -n 's/^Signer #1 certificate SHA-256 digest: //p' | head -1)"
[[ "$cert_sha256" == "$EXPECTED_CERT_SHA256" ]] \
  || fail "签名证书不匹配，期望 ${EXPECTED_CERT_SHA256}，实际 ${cert_sha256:-未读取到}"

dex_strings="$(mktemp /tmp/rdfz-apk-dex-strings.XXXXXX)"
headers_file="$(mktemp /tmp/rdfz-root-headers.XXXXXX)"
certificate_file="$(mktemp /tmp/rdfz-tls-certificate.XXXXXX)"
trap 'rm -f "$dex_strings" "$headers_file" "$certificate_file"' EXIT

while IFS= read -r dex_file; do
  unzip -p "$APK_PATH" "$dex_file" | strings -a
done < <(unzip -Z1 "$APK_PATH" | grep -E '^classes[0-9]*\.dex$') > "$dex_strings"
grep -Fq "$API_BASE_URL" "$dex_strings" || fail "APK 未包含 RDFZ 生产域名"
if grep -Eq 'zhctdev\.yyangpt\.cn|127\.0\.0\.1|192\.168\.' "$dex_strings"; then
  fail "APK 包含开发域名或固定局域网地址"
fi

curl --silent --show-error --max-redirs 0 --dump-header "$headers_file" \
  --output /dev/null "$API_BASE_URL/" || true
root_location="$(sed -n 's/^[Ll]ocation:[[:space:]]*//p' "$headers_file" | tr -d '\r' | head -1)"
[[ -n "$root_location" ]] || fail "生产根路径未返回跳转地址"
case "$root_location" in
  /dist/|"$API_BASE_URL/dist/") ;;
  http://*) fail "生产根路径发生 HTTP 降级：$root_location" ;;
  *) fail "生产根路径跳转目标异常：$root_location" ;;
esac

effective_url="$(curl --fail --silent --show-error --location --max-redirs 5 \
  --output /dev/null --write-out '%{url_effective}' "$API_BASE_URL/")"
[[ "$effective_url" == "$API_BASE_URL/dist/" ]] \
  || fail "生产根路径最终地址异常：$effective_url"
curl --fail --silent --show-error --output /dev/null "$API_BASE_URL/dist/"
curl --fail --silent --show-error --output /dev/null "$API_BASE_URL/Console/"

openssl s_client -connect 'rdfz.yyangpt.cn:443' -servername 'rdfz.yyangpt.cn' \
  </dev/null 2>/dev/null | openssl x509 -outform PEM > "$certificate_file"
[[ -s "$certificate_file" ]] || fail "无法读取生产 TLS 证书"
minimum_seconds="$((MIN_CERT_DAYS * 86400))"
openssl x509 -in "$certificate_file" -noout -checkend "$minimum_seconds" \
  || fail "生产 TLS 证书剩余有效期不足 ${MIN_CERT_DAYS} 天"
certificate_end="$(openssl x509 -in "$certificate_file" -noout -enddate | sed 's/^notAfter=//')"

echo "RDFZ 上线门禁通过"
echo "APK：$APK_PATH"
echo "包名/版本：$package_name / $version_name"
echo "APK SHA-256：$actual_sha256"
echo "签名证书 SHA-256：$cert_sha256"
echo "根路径：$API_BASE_URL/ -> $root_location -> $effective_url"
echo "TLS 证书到期：${certificate_end}（至少剩余 ${MIN_CERT_DAYS} 天）"