export function sign(path: string, name: string, keychain: string): Promise<any> {
  const args = ["--deep", "--force", "--sign", name, path]
  if (keychain != null) {
    args.push("--keychain", keychain)
  }
  return exec("codesign", args)
}

async function importCerts(keychainName: string, paths: Array<string>, keyPasswords: Array<string>): Promise<CodeSigningInfo> {
  for (let i = 0; i < paths.length; i++) {
    const password = keyPasswords[i]
    await exec("security", ["import", paths[i], "-k", keychainName, "-T", "/usr/bin/codesign", "-T", "/usr/bin/productbuild", "-P", password])

    // https://stackoverflow.com/questions/39868578/security-codesign-in-sierra-keychain-ignores-access-control-settings-and-ui-p
    // https://github.com/electron-userland/electron-packager/issues/701#issuecomment-322315996
    if (await isMacOsSierra()) {
      await exec("security", ["set-key-partition-list", "-S", "apple-tool:,apple:", "-s", "-k", password, keychainName])
    }
  }

  return {
    keychainName,
  }
}

async function removeKeychain(keychainFile: string) {
  try {
    await exec("security", ["delete-keychain", keychainFile])
  }
  catch (e) {
    console.warn(`Cannot delete keychain ${keychainFile}: ${e.stack || e}`)
    await unlinkIfExists(keychainFile)
  }
}

function listUserKeychains(): Promise<Array<string>> {
  return exec("security", ["list-keychains", "-d", "user"])
    .then(it => it
      .split("\n")
      .map(it => {
        const r = it.trim()
        return r.substring(1, r.length - 1)
      })
      .filter(it => it.length > 0))
}

async function getValidIdentities(keychain?: string | null): Promise<Array<string>> {
  function addKeychain(args: Array<string>) {
    if (keychain != null) {
      args.push(keychain)
    }
    return args
  }

  let result = findIdentityRawResult
  if (result == null || keychain != null) {
    // https://github.com/electron-userland/electron-builder/issues/481
    // https://github.com/electron-userland/electron-builder/issues/535
    result = Promise.all<Array<string>>([
      exec("security", addKeychain(["find-identity", "-v"]))
        .then(it => it.trim().split("\n").filter(it => {
          for (const prefix of appleCertificatePrefixes) {
            if (it.includes(prefix)) {
              return true
            }
          }
          return false
        })),
      exec("security", addKeychain(["find-identity", "-v", "-p", "codesigning"]))
        .then(it => it.trim().split(("\n"))),
    ])
      .then(it => {
        const array = it[0].concat(it[1])
          .filter(it => !it.includes("(Missing required extension)") && !it.includes("valid identities found") && !it.includes("iPhone ") && !it.includes("com.apple.idms.appleid.prd."))
          // remove 1)
          .map(it => it.substring(it.indexOf(")") + 1).trim())
        return Array.from(new Set(array))
      })

    if (keychain == null) {
      findIdentityRawResult = result
    }
  }
  return result
}

const bundledCertKeychainAdded = new Lazy<void>(async () => {
  // copy to temp and then atomic rename to final path
  const cacheDir = getCacheDirectory()
  const tmpKeychainPath = path.join(cacheDir, getTempName("electron-builder-root-certs"))
  const keychainPath = path.join(cacheDir, "electron-builder-root-certs.keychain")
  const results = await Promise.all<any>([
    listUserKeychains(),
    copyFile(path.join(__dirname, "..", "..", "certs", "root_certs.keychain"), tmpKeychainPath)
      .then(() => rename(tmpKeychainPath, keychainPath)),
  ])
  const list = results[0]
  if (!list.includes(keychainPath)) {
    await exec("security", ["list-keychains", "-d", "user", "-s", keychainPath].concat(list))
  }
})

export async function reportError(isMas: boolean, certificateType: CertType, qualifier: string | null | undefined, keychainName: string | null | undefined, isForceCodeSigning: boolean) {
  const logFields: Fields = {}
  if (qualifier == null) {
    logFields.reason = ""
    if (isAutoDiscoveryCodeSignIdentity()) {
      logFields.reason += `cannot find valid "${certificateType}" identity${(isMas ? "" : ` or custom non-Apple code signing certificate`)}`
    }
    logFields.reason += ", see https://electron.build/code-signing"
    if (!isAutoDiscoveryCodeSignIdentity()) {
      logFields.CSC_IDENTITY_AUTO_DISCOVERY = false
    }
  }
  else {
    logFields.reason = "Identity name is specified, but no valid identity with this name in the keychain"
    logFields.identity = qualifier
  }

  const args = ["find-identity"]
  if (keychainName != null) {
    args.push(keychainName)
  }

  if (qualifier != null || isAutoDiscoveryCodeSignIdentity()) {
    logFields.allIdentities = (await exec("security", args))
      .trim()
      .split("\n")
      .filter(it => !(it.includes("Policy: X.509 Basic") || it.includes("Matching identities")))
      .join("\n")
  }

  if (isMas || isForceCodeSigning) {
    throw new Error(Logger.createMessage("skipped macOS application code signing", logFields, "error", it => it))
  }
  else {
    log.warn(logFields, "skipped macOS application code signing")
  }
}

 BluebirdPromise.mapSeries(securityCommands, it => exec("security", it))