#!/bin/bash
#
# repair_and_sign.sh — PUBLIC‑SAFE VERSION
#
# Purpose:
#   Repairs framework structure (if needed) and signs all internal components.
#
# Notes for public sharing:
#   - Replace certificate placeholder with your own Developer ID name when using privately.
#   - Framework names here are generic; adjust to your environment.
#

set -euo pipefail
source "$(dirname "$0")/build_config.sh"

cd "$APP_ROOT"

FWKS=(
  "FMWrapper.framework"
  "FMEngine.framework"
  "DBEngine.framework"
  "Support.framework"
)

echo "=== Repairing frameworks (only if needed) ==="

for FWK in "${FWKS[@]}"; do
  FWK_PATH="$APP/Contents/Frameworks/$FWK"
  NAME="$(basename "$FWK" .framework)"

  EXEC_A="$FWK_PATH/Versions/A/$NAME"
  PLIST_A="$FWK_PATH/Versions/A/Resources/Info.plist"

  EXEC_TOP="$FWK_PATH/$NAME"
  PLIST_TOP="$FWK_PATH/Info.plist"

  echo ""
  echo "→ Checking $FWK"

  if [[ -f "$EXEC_A" && -f "$PLIST_A" ]]; then
      echo "   Detected original structure — repairing…"

      rm -f "$EXEC_TOP" "$PLIST_TOP"
      cp "$EXEC_A" "$EXEC_TOP"
      cp "$PLIST_A" "$PLIST_TOP"

      mkdir -p "$FWK_PATH/_CodeSignature"

      codesign --force --deep --options runtime \
        --sign "Developer ID Application: YOUR NAME (TEAMID)" \
        "$FWK_PATH"

      echo "   Repaired and signed."
  else
      echo "   Already repaired — skipping."
  fi
done

echo ""
echo "=== Signing internal binaries ==="

sign_if_exists() {
  local path="$1"
  if [[ -f "$path" ]]; then
    echo "   Signing $path"
    codesign --force --options runtime \
      --sign "Developer ID Application: YOUR NAME (TEAMID)" \
      "$path"
  else
    echo "   Skipping $path (not found)"
  fi
}

sign_if_exists "$APP/Contents/Frameworks/FMWrapper.framework/Versions/A/FMWrapper"
sign_if_exists "$APP/Contents/Frameworks/FMEngine.framework/Versions/A/FMEngine"
sign_if_exists "$APP/Contents/Frameworks/DBEngine.framework/Versions/A/DBEngine"
sign_if_exists "$APP/Contents/Frameworks/Support.framework/Versions/A/Support"

echo ""
echo "=== Signing XPC service ==="
sign_if_exists "$APP/Contents/XPCServices/PSConversionHelper.xpc"

echo ""
echo "=== Signing top-level app ==="
codesign --force --deep --options runtime \
  --sign "Developer ID Application: YOUR NAME (TEAMID)" \
  "$APP"

echo ""
echo "=== Verifying signature ==="
codesign --verify --deep --strict --verbose=4 "$APP"

echo ""
echo "=== repair_and_sign.sh complete ==="