#!/usr/bin/env bash
#
# تثبيت مقام على macOS — installs an unsigned build, and says plainly what that costs.
#
# ## Why this script exists at all
#
# مقام is not signed with an Apple Developer certificate. Without one, macOS
# refuses to open the app and — since Sequoia removed the old right-click→Open
# escape — the only route left in the interface is buried in System Settings,
# after a dialog that says the word «malware». Most people stop there, which is
# what the dialog is for.
#
# This script does the three things that route would have done, in the open:
#
#   1. Checks the download against a SHA-256 you can read on maqademy.com.
#   2. Copies the app into /Applications.
#   3. Removes the quarantine flag, and re-applies an ad-hoc signature.
#
# ## What step 3 actually means — read this
#
# Removing quarantine tells macOS «I vouch for this file», and after that macOS
# stops checking. That is a real thing to hand over, so it is worth being exact
# about what replaces it: nothing, except step 1. The signature applied here is
# *ad-hoc* — it makes the binary runnable on Apple Silicon, where unsigned code
# is killed outright, but it certifies no one. It is not evidence the app came
# from us.
#
# The checksum is the evidence. If you skip it, you are installing a file you
# cannot identify. The script will say so rather than quietly proceeding.

set -euo pipefail

APP_NAME="Maqam.app"
DEST="/Applications"
MOUNT=""
EXPECTED=""
DMG=""

# Clean up the mount even if something below fails — leaving a stray volume
# attached is a confusing state to hand back to someone who was just told their
# install did not work.
cleanup() {
  if [[ -n "$MOUNT" && -d "$MOUNT" ]]; then
    hdiutil detach "$MOUNT" -quiet 2>/dev/null || true
  fi
}
trap cleanup EXIT

say() { printf '%s\n' "$*"; }
die() { printf '\n✗ %s\n' "$*" >&2; exit 1; }

usage() {
  cat <<'EOF'
الاستعمال:
  ./install-macos.sh [مسار الملف.dmg] [--sha256 <البصمة>]

أمثلة:
  ./install-macos.sh ~/Downloads/Maqam_0.1.0_aarch64.dmg --sha256 a1b2c3...
  ./install-macos.sh          # يبحث تلقائياً في مجلد التنزيلات

البصمة منشورة على https://maqademy.com/download
EOF
}

while [[ $# -gt 0 ]]; do
  case "$1" in
    --sha256) EXPECTED="${2:-}"; shift 2 ;;
    -h|--help) usage; exit 0 ;;
    *) DMG="$1"; shift ;;
  esac
done

# ── 1. Find the download ─────────────────────────────────────────────────────
if [[ -z "$DMG" ]]; then
  # Newest match wins: someone who downloaded twice because the first attempt
  # looked like it failed should get the one they just fetched, not the stale one.
  DMG="$(/bin/ls -t "$HOME/Downloads"/Maqam*.dmg 2>/dev/null | head -1 || true)"
fi
[[ -n "$DMG" && -f "$DMG" ]] || die "لم أجد ملف التثبيت. مرّر مساره: ./install-macos.sh ~/Downloads/Maqam....dmg"

say "الملف: $DMG"

# ── 2. Verify, or refuse to pretend we did ───────────────────────────────────
ACTUAL="$(shasum -a 256 "$DMG" | awk '{print $1}')"
if [[ -z "$EXPECTED" ]]; then
  # A checksum nobody compared is decoration. Print it, name what is missing,
  # and make continuing a deliberate act rather than the default.
  say ""
  say "⚠ لم تُمرَّر بصمة للتحقق."
  say "  بصمة هذا الملف: $ACTUAL"
  say "  قارنها بالمنشورة على https://maqademy.com/download"
  say ""
  say "  بدون هذه المقارنة لا شيء يثبت أن هذا الملف هو ما نشرناه،"
  say "  والتثبيت سيُلغي فحص macOS الذي كان سيحميك."
  say ""
  printf "  أكملُ رغم ذلك؟ [y/N] "
  read -r ans </dev/tty || ans=""
  [[ "$ans" == "y" || "$ans" == "Y" ]] || die "أُلغي التثبيت."
else
  # Case-insensitive: people paste checksums out of web pages in either case,
  # and failing them for it would teach them to skip the check.
  if [[ "$(echo "$ACTUAL" | tr 'A-F' 'a-f')" != "$(echo "$EXPECTED" | tr 'A-F' 'a-f')" ]]; then
    say ""
    say "  المتوقَّع: $EXPECTED"
    say "  الفعلي  : $ACTUAL"
    die "البصمة لا تطابق. لا تُثبّت هذا الملف — أعد تنزيله من maqademy.com."
  fi
  say "✓ البصمة مطابقة."
fi

# ── 3. Mount and copy ────────────────────────────────────────────────────────
say "أفتح الحزمة…"
MOUNT="$(mktemp -d /tmp/maqam-install.XXXXXX)"
hdiutil attach "$DMG" -nobrowse -quiet -mountpoint "$MOUNT" \
  || die "تعذّر فتح ملف dmg — قد يكون التنزيل ناقصاً."

SRC="$MOUNT/$APP_NAME"
[[ -d "$SRC" ]] || die "لم أجد $APP_NAME داخل الحزمة."

# Replacing rather than merging: ditto onto an existing bundle can leave files
# from the previous version behind, and a half-old app bundle fails in ways
# that are very hard to read from a crash log.
if [[ -d "$DEST/$APP_NAME" ]]; then
  say "أزيل النسخة السابقة…"
  rm -rf "$DEST/$APP_NAME" || die "تعذّر حذف النسخة السابقة. أغلق التطبيق ثم أعد المحاولة."
fi

say "أنسخ إلى $DEST…"
# ditto rather than cp -R: it preserves resource forks and extended attributes,
# which is what keeps a .app bundle a working .app bundle.
ditto "$SRC" "$DEST/$APP_NAME" || die "تعذّر النسخ إلى $DEST."

hdiutil detach "$MOUNT" -quiet 2>/dev/null || true
MOUNT=""

# ── 4. Quarantine, then signature ────────────────────────────────────────────
say "أرفع علامة الحجر…"
xattr -dr com.apple.quarantine "$DEST/$APP_NAME" 2>/dev/null || true

# Order matters. Stripping attributes after signing invalidates the signature;
# signing after stripping is what leaves a bundle that both opens and runs.
#
# `--deep` is deprecated by Apple for distribution signing, and is still the
# right tool here: this is a local ad-hoc re-sign of a bundle with nested
# frameworks, not a submission to anyone.
say "أوقّع محلياً (توقيع ذاتي، لا يشهد بمصدر)…"
codesign --force --deep --sign - "$DEST/$APP_NAME" 2>/dev/null \
  || say "⚠ تعذّر التوقيع المحلي. إن رفض التطبيق العمل، شغّل:
     codesign --force --deep --sign - $DEST/$APP_NAME"

say ""
say "✓ تمّ التثبيت: $DEST/$APP_NAME"
say "  افتحه من Launchpad أو من مجلد التطبيقات."
say ""
say "  ملاحظة: هذه نسخة غير موقّعة رسمياً. لا يستطيع macOS أن يخبرك"
say "  أنها منّا — البصمة أعلاه هي ما يخبرك بذلك."