export async function createKeychain({tmpDir, cscLink, cscKeyPassword, cscILink, cscIKeyPassword, currentDir}: CreateKeychainOptions): Promise<CodeSigningInfo> {
  // travis has correct AppleWWDRCA cert
  if (process.env.TRAVIS !== "true") {
    await bundledCertKeychainAdded.value
  }

  const keychainFile = await tmpDir.getTempFile({suffix: ".keychain", disposer: removeKeychain})

  const certLinks = [cscLink]
  if (cscILink != null) {
    certLinks.push(cscILink)
  }

  const certPaths = new Array(certLinks.length)
  const keychainPassword = randomBytes(8).toString("base64")
  const securityCommands = [
    ["create-keychain", "-p", keychainPassword, keychainFile],
    ["unlock-keychain", "-p", keychainPassword, keychainFile],
    ["set-keychain-settings", keychainFile]
  ]

  // https://stackoverflow.com/questions/42484678/codesign-keychain-gets-ignored
  // https://github.com/electron-userland/electron-builder/issues/1457
  const list = await listUserKeychains()
  if (!list.includes(keychainFile)) {
    securityCommands.push(["list-keychains", "-d", "user", "-s", keychainFile].concat(list))
  }

  await BluebirdPromise.all([
    // we do not clear downloaded files - will be removed on tmpDir cleanup automatically. not a security issue since in any case data is available as env variables and protected by password.
    BluebirdPromise.map(certLinks, (link, i) => downloadCertificate(link, tmpDir, currentDir).then(it => certPaths[i] = it)),
    BluebirdPromise.mapSeries(securityCommands, it => exec("security", it))
  ])
  return await importCerts(keychainFile, certPaths, [cscKeyPassword, cscIKeyPassword].filter(it => it != null) as Array<string>)
}

export async function computeNodeModuleFileSets(platformPackager: PlatformPackager<any>, mainMatcher: FileMatcher): Promise<Array<ResolvedFileSet>> {
  const args = ["node-dep-tree", "--dir", platformPackager.info.appDir]
  if (platformPackager.info.framework.getExcludedDependencies != null) {
    const excludedDependencies = platformPackager.info.framework.getExcludedDependencies(platformPackager.platform)
    if (excludedDependencies != null) {
      for (const name of excludedDependencies) {
        args.push("--exclude-dep", name)
      }
    }
  }

  const deps = await executeAppBuilderAsJson<Array<any>>(args)
  const nodeModuleExcludedExts = getNodeModuleExcludedExts(platformPackager)
  // mapSeries instead of map because copyNodeModules is concurrent and so, no need to increase queue/pressure
  return await BluebirdPromise.mapSeries(deps, async info => {
    const source = info.dir
    let destination: string
    if (source.length > mainMatcher.from.length && source.startsWith(mainMatcher.from) && source[mainMatcher.from.length] === path.sep) {
      destination = getDestinationPath(source, {src: mainMatcher.from, destination: mainMatcher.to, files: [], metadata: null as any})
    }
    else {
      destination = mainMatcher.to + path.sep + "node_modules"
    }

    // use main matcher patterns, so, user can exclude some files in such hoisted node modules
    // source here includes node_modules, but pattern base should be without because users expect that pattern "!node_modules/loot-core/src{,/**/*}" will work
    const matcher = new FileMatcher(path.dirname(source), destination, mainMatcher.macroExpander, mainMatcher.patterns)
    const copier = new NodeModuleCopyHelper(matcher, platformPackager.info)
    const names = info.deps
    const files = await copier.collectNodeModules(source, names, nodeModuleExcludedExts)
    return validateFileSet({src: source, destination, files, metadata: copier.metadata})
  })
}

export async function createKeychain({tmpDir, cscLink, cscKeyPassword, cscILink, cscIKeyPassword, currentDir}: CreateKeychainOptions): Promise<CodeSigningInfo> {
  // travis has correct AppleWWDRCA cert
  if (process.env.TRAVIS !== "true") {
    await bundledCertKeychainAdded.value
  }

  const keychainFile = await tmpDir.getTempFile(".keychain")

  const certLinks = [cscLink]
  if (cscILink != null) {
    certLinks.push(cscILink)
  }

  const certPaths = new Array(certLinks.length)
  const keychainPassword = randomBytes(8).toString("base64")
  await BluebirdPromise.all([
    // we do not clear downloaded files - will be removed on tmpDir cleanup automatically. not a security issue since in any case data is available as env variables and protected by password.
    BluebirdPromise.map(certLinks, (link, i) => downloadCertificate(link, tmpDir, currentDir).then(it => certPaths[i] = it)),
    BluebirdPromise.mapSeries([
      ["create-keychain", "-p", keychainPassword, keychainFile],
      ["unlock-keychain", "-p", keychainPassword, keychainFile],
      ["set-keychain-settings", keychainFile]
    ], it => exec("security", it))
  ])

  // https://stackoverflow.com/questions/42484678/codesign-keychain-gets-ignored
  // https://github.com/electron-userland/electron-builder/issues/1457
  const list = await listUserKeychains()
  if (!list.includes(keychainFile)) {
    await exec("security", ["list-keychains", "-d", "user", "-s", keychainFile].concat(list))
    // no need to clean on CI server
    if (!isCi) {
      // yes, we don't clear on explicit exit or or uncaught exceptions - it is ok (exit or uncaughtException doesn't allow async operations)
      process.once("beforeExit", async () => {
        try {
          const list = (await listUserKeychains()).filter(it => it !== keychainFile)
          exec("security", ["list-keychains", "-d", "user", "-s"].concat(list))
        }
        catch (e) {
          warn(`Cannot restore keychain search list: ${e}`)
        }
      })
    }
  }
  return await importCerts(keychainFile, certPaths, [cscKeyPassword, cscIKeyPassword].filter(it => it != null) as Array<string>)
}

async function copyHoistedNodeModules(packager: Packager, mainMatcher: FileMatcher): Promise<Array<ResolvedFileSet>> {
  const productionDeps = await packager.productionDeps.value
  const rootPathToCopier = new Map<string, Array<Dependency>>()
  for (const dep of productionDeps) {
    const root = dep.path.substring(0, dep.path.indexOf(NODE_MODULES_PATTERN))
    let list = rootPathToCopier.get(root)
    if (list == null) {
      list = []
      rootPathToCopier.set(root, list)
    }
    list.push(dep)
  }

  // mapSeries instead of map because copyNodeModules is concurrent and so, no need to increase queue/pressure
  return await BluebirdPromise.mapSeries(rootPathToCopier.keys(), async source => {
    // use main matcher patterns, so, user can exclude some files in such hoisted node modules
    const matcher = new FileMatcher(source, mainMatcher.to, mainMatcher.macroExpander, mainMatcher.patterns)
    const copier = new NodeModuleCopyHelper(matcher, packager)
    const files = await copier.collectNodeModules(rootPathToCopier.get(source)!!)
    return {src: matcher.from, destination: matcher.to, files, metadata: copier.metadata}
  })
}