#!/usr/bin/env bash
# compile-android.sh <tag>  —  build signed Flutter Android APK, package into dist/
set -euo pipefail

# shellcheck source=scripts/ci/_env.sh
. "$(dirname "$0")/_env.sh"

TAG="$1"
VER="${TAG#client-v}"

# versionCode 必须单调递增，否则 Android 无法覆盖升级安装。
# 由版本号推导：major*10000 + minor*100 + patch（如 1.0.17 -> 10017）。
MAJOR="$(echo "$VER" | cut -d. -f1)"
MINOR="$(echo "$VER" | cut -d. -f2)"
PATCH="$(echo "$VER" | cut -d. -f3)"
BUILD=$(( MAJOR * 10000 + MINOR * 100 + PATCH ))

echo "==> compile-android: version=${VER} build=${BUILD}"

# Sync Flutter pubspec version (BSD sed on macOS)
sed -i '' "s/^version:.*/version: ${VER}+${BUILD}/" client/pubspec.yaml

# --- release 签名（强制）：从 CI secrets 还原 keystore 与 key.properties ---
# 必须 release 签名。缺任一签名 secret 直接失败，绝不回退 debug：
# debug 包用公开调试密钥签名，不能正式分发，也无法与正式版互相覆盖升级。
: "${ANDROID_KEYSTORE_BASE64:?缺少 ANDROID_KEYSTORE_BASE64：未配置 Android release 签名，构建中止（不回退 debug）}"
: "${ANDROID_KEYSTORE_PASSWORD:?缺少 ANDROID_KEYSTORE_PASSWORD：未配置 Android release 签名，构建中止}"
: "${ANDROID_KEY_ALIAS:?缺少 ANDROID_KEY_ALIAS：未配置 Android release 签名，构建中止}"
: "${ANDROID_KEY_PASSWORD:?缺少 ANDROID_KEY_PASSWORD：未配置 Android release 签名，构建中止}"

echo "==> compile-android: configuring release signing"
KEYSTORE_PATH="$(pwd)/client/android/jiu-release.jks"
echo "${ANDROID_KEYSTORE_BASE64}" | base64 --decode > "${KEYSTORE_PATH}"
cat > client/android/key.properties <<EOF
storeFile=${KEYSTORE_PATH}
storePassword=${ANDROID_KEYSTORE_PASSWORD}
keyAlias=${ANDROID_KEY_ALIAS}
keyPassword=${ANDROID_KEY_PASSWORD}
EOF

# Build APK (universal, all ABIs — simplest for sideload download)
cd client
flutter build apk --release \
  "--dart-define=BASE_URL=https://jiu.51yanmei.com" \
  "--dart-define=PUBLIC_URL=https://jiu.51yanmei.com" \
  "--dart-define=APP_VERSION=v${VER}"
cd ..

# Locate the built APK (path differs across Flutter versions) and copy to dist/
mkdir -p dist
APK=""
for cand in \
  client/build/app/outputs/flutter-apk/app-release.apk \
  client/build/app/outputs/apk/release/app-release.apk; do
  if [ -f "$cand" ]; then APK="$cand"; break; fi
done
if [ -z "$APK" ]; then
  echo "ERROR: built APK not found" >&2
  exit 1
fi
cp "$APK" dist/jiu-android.apk

# Clean up signing material so it never lingers on the runner workspace
rm -f client/android/key.properties client/android/jiu-release.jks 2>/dev/null || true

echo "==> compile-android: done — dist/ contents:"
ls -lh dist/