#!/usr/bin/env bash
set -euo pipefail

PROJECT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
TOPIC_DIR="$(cd "$PROJECT_DIR/../.." && pwd)"
OUTPUT_APK="${OUTPUT_APK:-$TOPIC_DIR/downloads/electronic-menu-tv-rdfz-v1.3.11-xiaomi-3s-first-screen-release-signed.apk}"
API_BASE_URL='https://rdfz.yyangpt.cn'
SDK_ROOT="${ANDROID_SDK_ROOT:-$HOME/Library/Android/sdk}"
JAVA_HOME_VALUE="${JAVA_HOME:-/Applications/Android Studio.app/Contents/jre/Contents/Home}"
AAPT_BIN="${AAPT_BIN:-$(find "$SDK_ROOT/build-tools" -type f -name aapt | sort -V | tail -1)}"
APKSIGNER_BIN="${APKSIGNER_BIN:-$(find "$SDK_ROOT/build-tools" -type f -name apksigner | sort -V | tail -1)}"
ZIPALIGN_BIN="${ZIPALIGN_BIN:-$(find "$SDK_ROOT/build-tools" -type f -name zipalign | sort -V | tail -1)}"

required_variables=(
  ANDROID_RELEASE_STORE_FILE
  ANDROID_RELEASE_STORE_PASSWORD
  ANDROID_RELEASE_KEY_ALIAS
  ANDROID_RELEASE_KEY_PASSWORD
)
for variable_name in "${required_variables[@]}"; do
  if [[ -z "${!variable_name:-}" ]]; then
    echo "缺少正式签名变量：$variable_name" >&2
    exit 2
  fi
done
if [[ ! -f "$ANDROID_RELEASE_STORE_FILE" ]]; then
  echo "正式签名文件不存在：$ANDROID_RELEASE_STORE_FILE" >&2
  exit 2
fi
for executable in "$AAPT_BIN" "$APKSIGNER_BIN" "$ZIPALIGN_BIN"; do
  if [[ ! -x "$executable" ]]; then
    echo "Android 构建工具不可用：$executable" >&2
    exit 2
  fi
done
if [[ ! -x "$JAVA_HOME_VALUE/bin/java" ]]; then
  echo "Java 运行时不可用：$JAVA_HOME_VALUE" >&2
  exit 2
fi

export JAVA_HOME="$JAVA_HOME_VALUE"
export ANDROID_SDK_ROOT="$SDK_ROOT"
export PATH="$JAVA_HOME/bin:$PATH"

cd "$PROJECT_DIR"
./gradlew --no-daemon clean assembleRelease lintDebug \
  -PAPI_BASE_URL="$API_BASE_URL" \
  -PMENU_URL='' \
  -PMAINTENANCE_PIN=''

SIGNED_APK='app/build/outputs/apk/release/app-release.apk'
if [[ ! -f "$SIGNED_APK" ]]; then
  echo "正式签名构建未生成预期文件：$SIGNED_APK" >&2
  exit 3
fi

PACKAGE_NAME="$($AAPT_BIN dump badging "$SIGNED_APK" | sed -n "s/^package: name='\([^']*\)'.*/\1/p")"
VERSION_NAME="$($AAPT_BIN dump badging "$SIGNED_APK" | sed -n "s/^package: .*versionName='\([^']*\)'.*/\1/p")"
if [[ "$PACKAGE_NAME" != 'com.cpt.electronicmenu.tv' ]]; then
  echo "正式包名错误：$PACKAGE_NAME" >&2
  exit 3
fi
if [[ "$VERSION_NAME" != '1.3.11' ]]; then
  echo "正式版本错误：$VERSION_NAME" >&2
  exit 3
fi
if "$AAPT_BIN" dump badging "$SIGNED_APK" | grep -q "testOnly='"; then
  echo "正式包不得包含 testOnly。" >&2
  exit 3
fi

MANIFEST_DUMP="$($AAPT_BIN dump xmltree "$SIGNED_APK" AndroidManifest.xml)"
if ! printf '%s\n' "$MANIFEST_DUMP" | grep -q 'android.intent.category.HOME'; then
  echo "正式包缺少 Home 候选。" >&2
  exit 3
fi
if printf '%s\n' "$MANIFEST_DUMP" | grep -Eq \
  'android\.permission\.(WAKE_LOCK|USE_FULL_SCREEN_INTENT)|android:(turnScreenOn|showWhenLocked).*0xffffffff|SCREEN_ON'; then
  echo "正式包 Manifest 含主动唤醒或待机风险标记。" >&2
  exit 3
fi
if "$AAPT_BIN" dump --values resources "$SIGNED_APK" | grep -q 'home_setup_'; then
  echo "正式包仍包含已失效的默认桌面引导弹窗资源。" >&2
  exit 3
fi

DEX_STRINGS="$(mktemp /tmp/electronic-menu-release-dex.XXXXXX)"
trap 'rm -f "$DEX_STRINGS"' EXIT
for dex in $(unzip -Z1 "$SIGNED_APK" | grep -E '^classes[0-9]*\.dex$'); do
  unzip -p "$SIGNED_APK" "$dex" | strings -a
done > "$DEX_STRINGS"
if ! grep -Fq "$API_BASE_URL" "$DEX_STRINGS"; then
  echo "正式包未检出 RDFZ 生产域名。" >&2
  exit 3
fi
if grep -Eq 'zhctdev\.yyangpt\.cn|127\.0\.0\.1|192\.168\.|862186|setFullScreenIntent|FLAG_KEEP_SCREEN_ON|android\.intent\.action\.SCREEN_ON' "$DEX_STRINGS"; then
  echo "正式包包含开发地址、测试 PIN 或已废弃电源能力。" >&2
  exit 3
fi

$ZIPALIGN_BIN -c 4 "$SIGNED_APK"
$APKSIGNER_BIN verify --verbose --print-certs "$SIGNED_APK" >/tmp/electronic-menu-release-signature.txt
if ! grep -q 'Verified using v1 scheme (JAR signing): true' /tmp/electronic-menu-release-signature.txt \
    || ! grep -q 'Verified using v2 scheme (APK Signature Scheme v2): true' /tmp/electronic-menu-release-signature.txt; then
  echo "正式 APK 未同时通过 v1/v2 签名验证。" >&2
  exit 3
fi

cp "$SIGNED_APK" "$OUTPUT_APK"
SHA256="$(shasum -a 256 "$OUTPUT_APK" | awk '{print $1}')"
CERT_SHA256="$(sed -n 's/^Signer #1 certificate SHA-256 digest: //p; s/^V2 Signer: certificate SHA-256 digest: //p' /tmp/electronic-menu-release-signature.txt | head -1)"

echo "正式 APK：$OUTPUT_APK"
echo "包名：$PACKAGE_NAME"
echo "版本：$VERSION_NAME"
echo "SHA-256：$SHA256"
echo "签名证书 SHA-256：${CERT_SHA256:-请使用 apksigner --print-certs 回读}"
echo "RDFZ 正式 Release 构建与静态门禁通过；仍需真实红米电视完成安装和开机自启验收。"