export async function getCertificateFromStoreInfo(options: WindowsConfiguration, vm: VmManager): Promise<CertificateFromStoreInfo> {
  const certificateSubjectName = options.certificateSubjectName
  const certificateSha1 = options.certificateSha1
  // ExcludeProperty doesn't work, so, we cannot exclude RawData, it is ok
  // powershell can return object if the only item
  const rawResult = await vm.exec("powershell.exe", ["Get-ChildItem -Recurse Cert: -CodeSigningCert | Select-Object -Property Subject,PSParentPath,Thumbprint | ConvertTo-Json -Compress"])
  const certList = rawResult.length === 0 ? [] : asArray<CertInfo>(JSON.parse(rawResult))
  for (const certInfo of certList) {
    if (certificateSubjectName != null) {
      if (!certInfo.Subject.includes(certificateSubjectName)) {
        continue
      }
    }
    else if (certInfo.Thumbprint !== certificateSha1) {
      continue
    }

    const parentPath = certInfo.PSParentPath
    const store = parentPath.substring(parentPath.lastIndexOf("\\") + 1)
    log.debug({store, PSParentPath: parentPath}, "auto-detect certificate store")
    // https://github.com/electron-userland/electron-builder/issues/1717
    const isLocalMachineStore = (parentPath.includes("Certificate::LocalMachine"))
    log.debug(null, "auto-detect using of LocalMachine store")
    return {
      thumbprint: certInfo.Thumbprint,
      subject: certInfo.Subject,
      store,
      isLocalMachineStore
    }
  }

  throw new Error(`Cannot find certificate ${certificateSubjectName || certificateSha1}, all certs: ${rawResult}`)
}

export function isSignAllowed(isPrintWarn = true): boolean {
  if (process.platform !== "darwin") {
    if (isPrintWarn) {
      log.warn({reason: "supported only on macOS"}, "skipped macOS application code signing")
    }
    return false
  }

  const buildForPrWarning = "There are serious security concerns with CSC_FOR_PULL_REQUEST=true (see the  CircleCI documentation (https://circleci.com/docs/1.0/fork-pr-builds/) for details)" +
    "\nIf you have SSH keys, sensitive env vars or AWS credentials stored in your project settings and untrusted forks can make pull requests against your repo, then this option isn't for you."

  if (isPullRequest()) {
    if (isEnvTrue(process.env.CSC_FOR_PULL_REQUEST)) {
      if (isPrintWarn) {
        log.warn(buildForPrWarning)
      }
    }
    else {
      if (isPrintWarn) {
        // https://github.com/electron-userland/electron-builder/issues/1524
        log.warn("Current build is a part of pull request, code signing will be skipped." +
          "\nSet env CSC_FOR_PULL_REQUEST to true to force code signing." +
          `\n${buildForPrWarning}`)
      }
      return false
    }
  }
  return true
}

async function doSign(configuration: CustomWindowsSignTaskConfiguration, packager: WinPackager) {
  // https://github.com/electron-userland/electron-builder/pull/1944
  const timeout = parseInt(process.env.SIGNTOOL_TIMEOUT as any, 10) || 10 * 60 * 1000

  let tool: string
  let args: Array<string>
  let env = process.env
  let vm: VmManager
  if (configuration.path.endsWith(".appx") || !("file" in configuration.cscInfo!!) /* certificateSubjectName and other such options */) {
    vm = await packager.vm.value
    tool = getWinSignTool(await getSignVendorPath())
    args = computeSignToolArgs(configuration, true, vm)
  }
  else {
    vm = new VmManager()
    const toolInfo = await getToolPath()
    tool = toolInfo.path
    args = configuration.computeSignToolArgs(process.platform === "win32")
    if (toolInfo.env != null) {
      env = toolInfo.env
    }
  }

  try {
    await vm.exec(tool, args, {timeout, env})
  }
  catch (e) {
    if (e.message.includes("The file is being used by another process") || e.message.includes("The specified timestamp server either could not be reached")) {
      log.warn(`First attempt to code sign failed, another attempt will be made in 2 seconds: ${e.message}`)
      await new Promise((resolve, reject) => {
        setTimeout(() => {
          vm.exec(tool, args, {timeout, env})
            .then(resolve)
            .catch(reject)
        }, 2000)
      })
    }
    throw e
  }
}

export async function reportError(isMas: boolean, certificateType: CertType, qualifier: string | null | undefined, keychainName: string | null | undefined, isForceCodeSigning: boolean) {
  const logFields: Fields = {}
  if (qualifier == null) {
    logFields.reason = ""
    if (isAutoDiscoveryCodeSignIdentity()) {
      logFields.reason += `cannot find valid "${certificateType}" identity${(isMas ? "" : ` or custom non-Apple code signing certificate`)}`
    }
    logFields.reason += ", see https://electron.build/code-signing"
    if (!isAutoDiscoveryCodeSignIdentity()) {
      logFields.CSC_IDENTITY_AUTO_DISCOVERY = false
    }
  }
  else {
    logFields.reason = "Identity name is specified, but no valid identity with this name in the keychain"
    logFields.identity = qualifier
  }

  const args = ["find-identity"]
  if (keychainName != null) {
    args.push(keychainName)
  }

  if (qualifier != null || isAutoDiscoveryCodeSignIdentity()) {
    logFields.allIdentities = (await exec("security", args))
      .trim()
      .split("\n")
      .filter(it => !(it.includes("Policy: X.509 Basic") || it.includes("Matching identities")))
      .join("\n")
  }

  if (isMas || isForceCodeSigning) {
    throw new Error(Logger.createMessage("skipped macOS application code signing", logFields, "error", it => it))
  }
  else {
    log.warn(logFields, "skipped macOS application code signing")
  }
}