#!/usr/bin/env bash
set -euo pipefail

APK_PATH="${1:-build/apk/vpn-app-arm64.apk}"
EXPECTED_VERSION_CODE="${2:-2}"
EXPECTED_VERSION_NAME="${3:-0.1.1}"
EXPECTED_CERT_SHA256="${VPN_ANDROID_CERT_SHA256:-21d36442ec814833725cee45306daec63960fc988cd1c8705665ecf7d3b7f63d}"
ANDROID_SDK_PATH="${ANDROID_SDK_ROOT:-${ANDROID_HOME:-/home/snw/Android/sdk}}"

if [[ ! -f "$APK_PATH" ]]; then
  echo "APK not found: $APK_PATH" >&2
  exit 2
fi

BUILD_TOOLS_DIR="$(find "$ANDROID_SDK_PATH/build-tools" -mindepth 1 -maxdepth 1 -type d -print | sort -V | tail -n 1)"
AAPT="$BUILD_TOOLS_DIR/aapt"
APKSIGNER="$BUILD_TOOLS_DIR/apksigner"
ZIPALIGN="$BUILD_TOOLS_DIR/zipalign"

for tool in "$AAPT" "$APKSIGNER" "$ZIPALIGN"; do
  if [[ ! -x "$tool" ]]; then
    echo "Required Android build tool not found: $tool" >&2
    exit 2
  fi
done

unzip -tqq "$APK_PATH"

BADGING="$($AAPT dump badging "$APK_PATH")"
EXPECTED_PACKAGE="package: name='su.snw.vpn_app' versionCode='$EXPECTED_VERSION_CODE' versionName='$EXPECTED_VERSION_NAME'"
if [[ "$BADGING" != *"$EXPECTED_PACKAGE"* ]]; then
  echo "Unexpected package or version metadata" >&2
  echo "Expected: $EXPECTED_PACKAGE" >&2
  echo "$BADGING" | head -n 1 >&2
  exit 3
fi

NATIVE_CODE="$(printf '%s\n' "$BADGING" | sed -n "s/^native-code: //p")"
if [[ "$NATIVE_CODE" != "'arm64-v8a'" ]]; then
  echo "Unexpected native ABI set: ${NATIVE_CODE:-none}" >&2
  exit 3
fi

SIGNATURE_REPORT="$($APKSIGNER verify --verbose --print-certs "$APK_PATH")"
CERT_SHA256="$(printf '%s\n' "$SIGNATURE_REPORT" | sed -n 's/^Signer #1 certificate SHA-256 digest: //p' | tr -d ':[:space:]' | tr '[:upper:]' '[:lower:]')"
if [[ "$CERT_SHA256" != "$EXPECTED_CERT_SHA256" ]]; then
  echo "Unexpected signing certificate SHA-256: $CERT_SHA256" >&2
  exit 3
fi

$ZIPALIGN -c -P 16 -v 4 "$APK_PATH" >/dev/null

APK_SIZE="$(stat -c '%s' "$APK_PATH")"
APK_SHA256="$(sha256sum "$APK_PATH" | cut -d ' ' -f 1)"
echo "APK verification passed"
echo "  file: $APK_PATH"
echo "  package: su.snw.vpn_app"
echo "  version: $EXPECTED_VERSION_NAME ($EXPECTED_VERSION_CODE)"
echo "  ABI: arm64-v8a"
echo "  size: $APK_SIZE bytes"
echo "  SHA-256: $APK_SHA256"