#!/bin/bash
# Only for trusted WiseCut packages obtained from the official download site.
set -uo pipefail

if [[ "$(/usr/bin/uname -s)" != Darwin ]]; then
  echo '此脚本仅适用于 macOS。'
  exit 1
fi

repair_app() {
  local app="$1" attrs
  echo "正在处理：$app"
  # Do not clear unrelated attributes or change global Gatekeeper settings.
  attrs=$(/usr/bin/xattr -lr "$app") || return 1
  if [[ "$attrs" == *com.apple.quarantine* ]]; then
    sudo /usr/bin/xattr -rd com.apple.quarantine "$app" || return 1
  fi
  if ! /usr/bin/codesign --verify --deep --strict "$app" >/dev/null 2>&1; then
    sudo /usr/bin/codesign --force --deep --sign - \
      --preserve-metadata=entitlements "$app" || return 1
    /usr/bin/codesign --verify --deep --strict "$app" || return 1
  fi
  /usr/bin/open "$app" || return 1
  printf '修复完成，已发送启动请求：%s（不代表应用已成功运行）\n' "$app"
}

apps=()
shopt -s nullglob
for candidate in "$HOME"/Applications/*.app /Applications/*.app; do
  [[ ! -L "$candidate" && -f "$candidate/Contents/Info.plist" ]] || continue
  id=$(/usr/libexec/PlistBuddy -c 'Print :CFBundleIdentifier' \
    "$candidate/Contents/Info.plist" 2>/dev/null) || continue
  case "$id" in
    com.huashiruida.wisecut|com.huashiruida.wisecut.test|com.huashiruida.wisecut.lab)
      apps+=("$candidate") ;;
  esac
done

if [[ ${#apps[@]} -eq 0 ]]; then
  echo '未找到生产版、测试版或实验版。请将 App 放入 ~/Applications 或 /Applications，勿放入子文件夹或直接从 DMG 启动。'
  exit 1
fi
printf '将原位处理以下应用：\n'
printf '  %s\n' "${apps[@]}"
echo '请先退出以上应用。此操作会移除下载隔离标记，并在签名无效时重新进行本机临时签名。'
echo '只适用于已确认来自官方的安装包；应用 ID 不是来源真实性证明。若提示病毒、恶意软件或“将损坏电脑”，请停止。'
sudo -v || exit 1
failed=0
for app in "${apps[@]}"; do
  if ! repair_app "$app"; then
    failed=$((failed + 1))
    printf '处理失败：%s。请保留上方错误信息。\n' "$app"
  fi
done
echo "处理结束：共 ${#apps[@]} 个应用，失败 $failed 个。"
echo '如果仍打不开，请把终端输出和系统提示截图发给客服；脚本无法修复缺失文件、损坏的安装包或不兼容的系统/芯片。'
[[ "$failed" -eq 0 ]]