# sign.ps1 - Windows EV 署名 (Azure Key Vault 経由)
$ErrorActionPreference = "Stop"
 
$ExePath  = "src-tauri\target\release\bundle\nsis\MyApp_1.0.0_x64-setup.exe"
$VaultUri = $env:AZURE_KEY_VAULT_URI
$CertName = $env:AZURE_KEY_VAULT_CERT_NAME
 
# AzureSignTool がインストールされていない場合は自動インストール
if (-not (Get-Command AzureSignTool -ErrorAction SilentlyContinue)) {
    dotnet tool install --global AzureSignTool
}
 
try {
    AzureSignTool sign `
      -kvu $VaultUri `
      -kvi $env:AZURE_CLIENT_ID `
      -kvs $env:AZURE_CLIENT_SECRET `
      -kvt $env:AZURE_TENANT_ID `
      -kvc $CertName `
      -tr "http://timestamp.digicert.com" `
      -td sha256 `
      -fd sha256 `
      $ExePath
 
    # 署名検証
    $sig = Get-AuthenticodeSignature $ExePath
    if ($sig.Status -ne "Valid") {
        throw "署名が無効です: $($sig.Status) — $($sig.StatusMessage)"
    }
    Write-Host "✅ 署名成功: $($sig.SignerCertificate.Subject)"
}
catch {
    Write-Error "❌ 署名失敗: $_"
    exit 1
}

// src/index.ts - Tauri 2 自動アップデートマニフェスト配信
interface Env {
  UPDATES_KV: KVNamespace;
  UPDATES_R2: R2Bucket;
  UPDATE_SIGNATURE_PUBLIC_KEY: string;
}
 
interface UpdateMeta {
  version: string;
  notes: string;
  pub_date: string;
  rollout: number; // 0-100
  platforms: Record<string, { url: string; signature: string }>;
}
 
export default {
  async fetch(req: Request, env: Env): Promise<Response> {
    const url = new URL(req.url);
    // /api/update/{platform}/{currentVersion} に対する応答
    const match = url.pathname.match(/^\/api\/update\/([^/]+)\/([^/]+)$/);
    if (!match) return new Response("Not Found", { status: 404 });
 
    const [, platform, currentVersion] = match;
    // 端末ごとに固定された ID を必須にする。ここで randomUUID にフォールバックすると
    // 起動のたびにバケットが変わり、段階配信が「毎回くじを引き直す」挙動になる
    const clientId = req.headers.get("x-client-id");
    if (!clientId) return new Response("Missing client id", { status: 400 });
    const userBucket = hashToBucket(clientId);
 
    try {
      const metaJson = await env.UPDATES_KV.get("latest_meta", "json") as UpdateMeta | null;
      if (!metaJson) return new Response("No update available", { status: 204 });
 
      // 段階的ロールアウト判定（バケットは 0..99。> だと rollout=0 でも 0 番が通ってしまう）
      if (userBucket >= metaJson.rollout) {
        return new Response("Not eligible for rollout", { status: 204 });
      }
 
      // 手元のほうが新しい、または同じなら更新しない
      if (compareSemver(currentVersion, metaJson.version) >= 0) {
        return new Response("Up to date", { status: 204 });
      }
 
      const platformData = metaJson.platforms[platform];
      if (!platformData) {
        return new Response(`Unsupported platform: ${platform}`, { status: 400 });
      }
 
      // Tauri Updater が期待する形式で返す
      return Response.json({
        version: metaJson.version,
        notes: metaJson.notes,
        pub_date: metaJson.pub_date,
        platforms: { [platform]: platformData },
      });
    } catch (err) {
      console.error("Update endpoint error:", err);
      // エラー時は 204 を返してアプリ側のクラッシュを防ぐ
      return new Response("Internal error (silenced)", { status: 204 });
    }
  },
};
 
// FNV-1a。分布が素直で、同じ ID なら常に同じバケットに落ちる
function hashToBucket(id: string): number {
  let h = 2166136261;
  for (let i = 0; i < id.length; i++) {
    h ^= id.charCodeAt(i);
    h = Math.imul(h, 16777619);
  }
  return (h >>> 0) % 100;
}
 
function compareSemver(a: string, b: string): number {
  // "1.2" や "1.2.0-beta.1" を渡されても NaN を伝播させない
  const parse = (v: string) =>
    v.replace(/^v/, "").split("-")[0].split(".").map((n) => Number.parseInt(n, 10) || 0);
  const [a1 = 0, a2 = 0, a3 = 0] = parse(a);
  const [b1 = 0, b2 = 0, b3 = 0] = parse(b);
  return a1 - b1 || a2 - b2 || a3 - b3;
}

// src-tauri/src/license.rs - Ed25519 オフラインライセンス検証
// URL セーフ・パディング無しにしておくと、メール本文で折り返されても
// URL に貼り付けられても壊れず、サポート対応が減る
use base64::{engine::general_purpose::URL_SAFE_NO_PAD as B64, Engine as _};
use ed25519_dalek::{Signature, Verifier, VerifyingKey};
use serde::{Deserialize, Serialize};
use std::time::{SystemTime, UNIX_EPOCH};
 
const LICENSE_PUBLIC_KEY: &[u8] = include_bytes!("../keys/license_pub.bin");
 
#[derive(Debug, Serialize, Deserialize)]
pub struct LicensePayload {
    pub user_id: String,
    pub email: String,
    pub expires_at: u64,           // Unix epoch
    pub device_fingerprint: String,
    pub plan: String,              // "lifetime" | "annual"
}
 
#[derive(Debug)]
pub enum LicenseError {
    Malformed,
    InvalidSignature,
    Expired,
    DeviceMismatch,
}
 
pub fn verify_license(
    license_str: &str,
    current_fingerprint: &str,
) -> Result<LicensePayload, LicenseError> {
    // ライセンスキーは `<base64(payload)>.<base64(signature)>` の形式
    let (payload_b64, sig_b64) = license_str
        .split_once('.')
        .ok_or(LicenseError::Malformed)?;
 
    let payload_bytes = B64.decode(payload_b64).map_err(|_| LicenseError::Malformed)?;
    let sig_bytes = B64.decode(sig_b64).map_err(|_| LicenseError::Malformed)?;
 
    let payload: LicensePayload =
        serde_json::from_slice(&payload_bytes).map_err(|_| LicenseError::Malformed)?;
 
    // 署名検証
    let key_array: [u8; 32] = LICENSE_PUBLIC_KEY
        .try_into()
        .map_err(|_| LicenseError::InvalidSignature)?;
    let verifying_key =
        VerifyingKey::from_bytes(&key_array).map_err(|_| LicenseError::InvalidSignature)?;
    let signature = Signature::from_slice(&sig_bytes)
        .map_err(|_| LicenseError::InvalidSignature)?;
    verifying_key
        .verify(&payload_bytes, &signature)
        .map_err(|_| LicenseError::InvalidSignature)?;
 
    // 有効期限チェック（lifetime プランは expires_at = 0 で扱う）
    if payload.plan != "lifetime" {
        let now = SystemTime::now()
            .duration_since(UNIX_EPOCH)
            .map(|d| d.as_secs())
            .unwrap_or(0);
        if now > payload.expires_at {
            return Err(LicenseError::Expired);
        }
    }
 
    // デバイス指紋チェック（同一マシンでのみ有効）
    if payload.device_fingerprint != current_fingerprint {
        return Err(LicenseError::DeviceMismatch);
    }
 
    Ok(payload)
}
 
#[tauri::command]
pub fn check_license(license: String, fingerprint: String) -> Result<LicensePayload, String> {
    verify_license(&license, &fingerprint).map_err(|e| format!("{:?}", e))
}

// worker/webhook.ts - Stripe Webhook を受けて Ed25519 ライセンスを発行する
interface Env {
  LICENSES_KV: KVNamespace;
  STRIPE_WEBHOOK_SECRET: string;
  LICENSE_SIGNING_KEY: string; // PKCS#8 の Ed25519 秘密鍵（base64）
}
 
interface Claims {
  user_id: string;
  email: string;
  plan: "lifetime" | "annual";
  device_fingerprint: string;
}
 
export default {
  async fetch(req: Request, env: Env): Promise<Response> {
    const raw = await req.text(); // 署名検証は生ボディに対して行う。JSON にしてからでは通らない
    const ok = await verifyStripeSignature(raw, req.headers.get("stripe-signature") ?? "", env.STRIPE_WEBHOOK_SECRET);
    if (!ok) return new Response("Invalid signature", { status: 400 });
 
    const event = JSON.parse(raw);
    if (event.type !== "checkout.session.completed") {
      return new Response("Ignored", { status: 200 });
    }
 
    // 冪等化: 同じ event.id を二度処理しない
    const guard = `evt:${event.id}`;
    if (await env.LICENSES_KV.get(guard)) {
      return new Response("Duplicate", { status: 200 });
    }
    await env.LICENSES_KV.put(guard, "1", { expirationTtl: 60 * 60 * 24 * 30 });
 
    const session = event.data.object;
    const email = session.customer_details?.email ?? "";
    const license = await issueLicense(env, {
      user_id: session.client_reference_id ?? session.id,
      email,
      plan: session.metadata?.plan === "annual" ? "annual" : "lifetime",
      device_fingerprint: session.metadata?.device_fingerprint ?? "",
    });
 
    // 再送できるよう、発行済みライセンスは必ず保存しておく
    await env.LICENSES_KV.put(`license:${email}`, license);
    return new Response("OK", { status: 200 });
  },
};
 
async function issueLicense(env: Env, claims: Claims): Promise<string> {
  const expires_at =
    claims.plan === "annual" ? Math.floor(Date.now() / 1000) + 60 * 60 * 24 * 365 : 0;
  const payload = new TextEncoder().encode(JSON.stringify({ ...claims, expires_at }));
 
  const key = await crypto.subtle.importKey(
    "pkcs8",
    b64ToBytes(env.LICENSE_SIGNING_KEY),
    { name: "Ed25519" },
    false,
    ["sign"],
  );
  const sig = new Uint8Array(await crypto.subtle.sign("Ed25519", key, payload));
  return `${b64url(payload)}.${b64url(sig)}`;
}
 
async function verifyStripeSignature(raw: string, header: string, secret: string): Promise<boolean> {
  const parts = Object.fromEntries(
    header.split(",").map((p) => p.split("=") as [string, string]),
  );
  const t = parts.t;
  const v1 = parts.v1;
  if (!t || !v1) return false;
  // 5 分より古い署名は再送として捨てる
  if (Math.abs(Date.now() / 1000 - Number(t)) > 300) return false;
 
  const key = await crypto.subtle.importKey(
    "raw",
    new TextEncoder().encode(secret),
    { name: "HMAC", hash: "SHA-256" },
    false,
    ["sign"],
  );
  const mac = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(`${t}.${raw}`));
  const expected = [...new Uint8Array(mac)]
    .map((b) => b.toString(16).padStart(2, "0"))
    .join("");
 
  // 早期 return しない比較にする
  if (expected.length !== v1.length) return false;
  let diff = 0;
  for (let i = 0; i < expected.length; i++) diff |= expected.charCodeAt(i) ^ v1.charCodeAt(i);
  return diff === 0;
}
 
function b64url(bytes: Uint8Array): string {
  return btoa(String.fromCharCode(...bytes))
    .replace(/\+/g, "-")
    .replace(/\//g, "_")
    .replace(/=+$/, "");
}
 
function b64ToBytes(b64: string): Uint8Array {
  return Uint8Array.from(atob(b64), (c) => c.charCodeAt(0));
}

# .github/workflows/release.yml（順番が要点なので macOS ジョブのみ抜粋）
jobs:
  macos:
    runs-on: macos-14
    steps:
      - uses: actions/checkout@v4
 
      # 1. DMG は作らせない。署名前の .app が同梱された DMG を作らせないため
      - name: Build (.app only)
        run: |
          npm ci
          npm run tauri build -- --target universal-apple-darwin --bundles app
 
      # 2. 署名 → DMG 再作成 → 公証 → staple
      - name: Sign and notarize
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          APPLE_APP_PASSWORD: ${{ secrets.APPLE_APP_PASSWORD }}
          SIGNING_IDENTITY: ${{ secrets.SIGNING_IDENTITY }}
        run: ./scripts/notarize.sh
 
      # 3. 更新マニフェスト用の署名は、公証済みの成果物に対して行う
      - name: Sign update artifact
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_KEY_PASSWORD }}
        run: npx @tauri-apps/cli signer sign dist/MyApp_universal.dmg
 
      # 4. R2 へ置き、ロールアウトは 0% で登録する（開けるのは人間の判断）
      - name: Publish at 0%
        run: ./scripts/publish.sh --rollout 0