[match] Add include_all_certificates & force_for_new_certificates to …

…match

match/lib/match/generator.rb

@@ -88,7 +88,8 @@ def self.generate_provisioning_profile(params: nil, prov_type: nil, certificate_
         team_id: params[:team_id],
         team_name: params[:team_name],
         template_name: params[:template_name],
-        fail_on_name_taken: params[:fail_on_name_taken]
+        fail_on_name_taken: params[:fail_on_name_taken],
+        include_all_certificates: params[:include_all_certificates],
       }
 
       values[:platform] = params[:platform]

match/lib/match/options.rb

@@ -242,6 +242,16 @@ def self.available_options
                                      description: "Renew the provisioning profiles if the device count on the developer portal has changed. Ignored for profile types 'appstore' and 'developer_id'",
                                      type: Boolean,
                                      default_value: false),
+        FastlaneCore::ConfigItem.new(key: :include_all_certificates,
+                                     env_name: "MATCH_INCLUDE_ALL_CERTIFICATES",
+                                     description: "Include all matching certificates in the provisioning profile. Works only for the 'development' provisioning profile type",
+                                     type: Boolean,
+                                     default_value: false),
+        FastlaneCore::ConfigItem.new(key: :force_for_new_certificates,
+                                     env_name:  "MATCH_FORCE_FOR_NEW_CERTIFICATES",
+                                     description: "Renew the provisioning profiles if the device count on the developer portal has changed. Works only for the 'development' provisioning profile type. Requires 'include_all_certificates' option to be 'true'",
+                                     type: Boolean,
+                                     default_value: false),
         FastlaneCore::ConfigItem.new(key: :skip_confirmation,
                                      env_name: "MATCH_SKIP_CONFIRMATION",
                                      description: "Disables confirmation prompts during nuke, answering them with yes",

match/lib/match/runner.rb

@@ -254,6 +254,24 @@ def fetch_provisioning_profile(params: nil, certificate_id: nil, app_identifier:
         end
       end
 
+      if params[:include_all_certificates]
+        certificate_id = nil
+
+        if params[:force_for_new_certificates] && !params[:readonly]
+          if prov_type == :development && !params[:force]
+            force = certificate_count_different?(profile: profile, keychain_path: keychain_path, platform: params[:platform].to_sym)
+          else
+            # All other (not development) provisioning profiles don't contain
+            # multiple certificates, thus shouldn't be renewed
+            # if the certificates  count has changed.
+            UI.important("Warning: `force_for_new_certificates` is set but is ignored for non-'development' provisioning profiles.")
+            UI.important("You can safely stop specifying `force_for_new_certificates` when running Match for '#{prov_type}' provisioning profiles.")
+          end
+        end
+      else
+        UI.important("You specified 'force_for_new_certificates: true', but new certificates will not be added, cause 'include_all_certificates' is 'false'") if params[:force_for_new_certificates]
+      end
+
       if profile.nil? || force
         if params[:readonly]
           UI.error("No matching provisioning profiles found for '#{profile_file}'")
@@ -365,5 +383,46 @@ def device_count_different?(profile: nil, keychain_path: nil, platform: nil)
       end
       return false
     end
+
+    def certificate_count_different?(profile: nil, keychain_path: nil, platform: nil)
+      return false unless profile
+
+      parsed = FastlaneCore::ProvisioningProfile.parse(profile, keychain_path)
+      uuid = parsed["UUID"]
+
+      all_profiles = Spaceship::ConnectAPI::Profile.all(includes: "certificates")
+      portal_profile = all_profiles.detect { |i| i.uuid == uuid }
+
+      return false unless portal_profile
+
+      profile_certs_count = portal_profile.fetch_all_certificates.count
+
+      certificate_types =
+        case platform
+        when :ios, :tvos
+          [
+            Spaceship::ConnectAPI::Certificate::CertificateType::DEVELOPMENT,
+            Spaceship::ConnectAPI::Certificate::CertificateType::IOS_DEVELOPMENT
+          ]
+        when :macos, :catalyst
+          [
+            Spaceship::ConnectAPI::Certificate::CertificateType::DEVELOPMENT,
+            Spaceship::ConnectAPI::Certificate::CertificateType::MAC_APP_DEVELOPMENT
+          ]
+        else
+          []
+        end
+
+      certificates = Spaceship::ConnectAPI::Certificate.all
+      unless certificate_types.empty?
+        certificates = certificates.select do |certificate|
+          certificate_types.include?(certificate.certificateType) && certificate.valid?
+        end
+      end
+
+      portal_certs_count = certificates.size
+
+      return portal_certs_count != profile_certs_count
+    end
   end
 end

match/spec/generator_spec.rb

@@ -53,7 +53,8 @@
         team_id: 'team_id',
         platform: :ios,
         template_name: 'template_name',
-        fail_on_name_taken: false
+        fail_on_name_taken: false,
+        include_all_certificates: true,
       })
 
       # This is the important part. We need to see the right configuration come through
@@ -71,7 +72,8 @@
         username: 'username',
         team_id: 'team_id',
         platform: :ios,
-        template_name: 'template_name'
+        template_name: 'template_name',
+        include_all_certificates: true,
       }
       Match::Generator.generate_provisioning_profile(params: params, prov_type: :development, certificate_id: 'fake_cert_id', app_identifier: params[:app_identifier], force: false, working_directory: "workspace")
     end