# sign.ps1 - Windows EV 署名 (Azure Key Vault 経由)
$ErrorActionPreference = "Stop"
 
$ExePath  = "src-tauri\target\release\bundle\nsis\MyApp_1.0.0_x64-setup.exe"
$VaultUri = $env:AZURE_KEY_VAULT_URI
$CertName = $env:AZURE_KEY_VAULT_CERT_NAME
 
# AzureSignTool がインストールされていない場合は自動インストール
if (-not (Get-Command AzureSignTool -ErrorAction SilentlyContinue)) {
    dotnet tool install --global AzureSignTool
}
 
try {
    AzureSignTool sign `
      -kvu $VaultUri `
      -kvi $env:AZURE_CLIENT_ID `
      -kvs $env:AZURE_CLIENT_SECRET `
      -kvt $env:AZURE_TENANT_ID `
      -kvc $CertName `
      -tr "http://timestamp.digicert.com" `
      -td sha256 `
      -fd sha256 `
      $ExePath
 
    # 署名検証
    $sig = Get-AuthenticodeSignature $ExePath
    if ($sig.Status -ne "Valid") {
        throw "署名が無効です: $($sig.Status) — $($sig.StatusMessage)"
    }
    Write-Host "✅ 署名成功: $($sig.SignerCertificate.Subject)"
}
catch {
    Write-Error "❌ 署名失敗: $_"
    exit 1
}

// src/index.ts - Tauri 2 自動アップデートマニフェスト配信
interface Env {
  UPDATES_KV: KVNamespace;
  UPDATES_R2: R2Bucket;
  UPDATE_SIGNATURE_PUBLIC_KEY: string;
}
 
interface UpdateMeta {
  version: string;
  notes: string;
  pub_date: string;
  rollout: number; // 0-100
  platforms: Record<string, { url: string; signature: string }>;
}
 
export default {
  async fetch(req: Request, env: Env): Promise<Response> {
    const url = new URL(req.url);
    // /api/update/{platform}/{currentVersion} に対する応答
    const match = url.pathname.match(/^\/api\/update\/([^/]+)\/([^/]+)$/);
    if (!match) return new Response("Not Found", { status: 404 });
 
    const [, platform, currentVersion] = match;
    const userBucket = hashToBucket(req.headers.get("x-client-id") ?? crypto.randomUUID());
 
    try {
      const metaJson = await env.UPDATES_KV.get("latest_meta", "json") as UpdateMeta | null;
      if (!metaJson) return new Response("No update available", { status: 204 });
 
      // 段階的ロールアウト判定
      if (userBucket > metaJson.rollout) {
        return new Response("Not eligible for rollout", { status: 204 });
      }
 
      // 同バージョン以下のみ更新を返す
      if (compareSemver(currentVersion, metaJson.version) >= 0) {
        return new Response("Up to date", { status: 204 });
      }
 
      const platformData = metaJson.platforms[platform];
      if (!platformData) {
        return new Response(`Unsupported platform: ${platform}`, { status: 400 });
      }
 
      // Tauri Updater が期待する形式で返す
      return Response.json({
        version: metaJson.version,
        notes: metaJson.notes,
        pub_date: metaJson.pub_date,
        platforms: { [platform]: platformData },
      });
    } catch (err) {
      console.error("Update endpoint error:", err);
      // エラー時は 204 を返してアプリ側のクラッシュを防ぐ
      return new Response("Internal error (silenced)", { status: 204 });
    }
  },
};
 
function hashToBucket(id: string): number {
  let hash = 0;
  for (let i = 0; i < id.length; i++) {
    hash = ((hash << 5) - hash + id.charCodeAt(i)) | 0;
  }
  return Math.abs(hash) % 100;
}
 
function compareSemver(a: string, b: string): number {
  const parse = (v: string) => v.replace(/^v/, "").split(".").map(Number);
  const [a1, a2, a3] = parse(a);
  const [b1, b2, b3] = parse(b);
  return a1 - b1 || a2 - b2 || a3 - b3;
}

// src-tauri/src/license.rs - Ed25519 オフラインライセンス検証
use base64::{engine::general_purpose::STANDARD as B64, Engine as _};
use ed25519_dalek::{Signature, Verifier, VerifyingKey};
use serde::{Deserialize, Serialize};
use std::time::{SystemTime, UNIX_EPOCH};
 
const LICENSE_PUBLIC_KEY: &[u8] = include_bytes!("../keys/license_pub.bin");
 
#[derive(Debug, Serialize, Deserialize)]
pub struct LicensePayload {
    pub user_id: String,
    pub email: String,
    pub expires_at: u64,           // Unix epoch
    pub device_fingerprint: String,
    pub plan: String,              // "lifetime" | "annual"
}
 
#[derive(Debug)]
pub enum LicenseError {
    Malformed,
    InvalidSignature,
    Expired,
    DeviceMismatch,
}
 
pub fn verify_license(
    license_str: &str,
    current_fingerprint: &str,
) -> Result<LicensePayload, LicenseError> {
    // ライセンスキーは `<base64(payload)>.<base64(signature)>` の形式
    let (payload_b64, sig_b64) = license_str
        .split_once('.')
        .ok_or(LicenseError::Malformed)?;
 
    let payload_bytes = B64.decode(payload_b64).map_err(|_| LicenseError::Malformed)?;
    let sig_bytes = B64.decode(sig_b64).map_err(|_| LicenseError::Malformed)?;
 
    let payload: LicensePayload =
        serde_json::from_slice(&payload_bytes).map_err(|_| LicenseError::Malformed)?;
 
    // 署名検証
    let key_array: [u8; 32] = LICENSE_PUBLIC_KEY
        .try_into()
        .map_err(|_| LicenseError::InvalidSignature)?;
    let verifying_key =
        VerifyingKey::from_bytes(&key_array).map_err(|_| LicenseError::InvalidSignature)?;
    let signature = Signature::from_slice(&sig_bytes)
        .map_err(|_| LicenseError::InvalidSignature)?;
    verifying_key
        .verify(&payload_bytes, &signature)
        .map_err(|_| LicenseError::InvalidSignature)?;
 
    // 有効期限チェック（lifetime プランは expires_at = 0 で扱う）
    if payload.plan != "lifetime" {
        let now = SystemTime::now()
            .duration_since(UNIX_EPOCH)
            .map(|d| d.as_secs())
            .unwrap_or(0);
        if now > payload.expires_at {
            return Err(LicenseError::Expired);
        }
    }
 
    // デバイス指紋チェック（同一マシンでのみ有効）
    if payload.device_fingerprint != current_fingerprint {
        return Err(LicenseError::DeviceMismatch);
    }
 
    Ok(payload)
}
 
#[tauri::command]
pub fn check_license(license: String, fingerprint: String) -> Result<LicensePayload, String> {
    verify_license(&license, &fingerprint).map_err(|e| format!("{:?}", e))
}