/**
 * Config Vault - cfgvault
 *
 * This file is licensed under the Affero General Public License version 3 or
 * later. See the COPYING file.
 *
 * @author Paolo Lulli <kevwe.com>
 * @copyright Paolo Lulli 2026
 */

use rustls::server::WebPkiClientVerifier;
use rustls::{RootCertStore, ServerConfig};
use std::fs::File;
use std::io::BufReader;

pub fn get_tls_config(cert_path: &str, key_path: &str) -> ServerConfig {
    let mut certs_file = BufReader::new(File::open(cert_path).unwrap());
    let mut key_file = BufReader::new(File::open(key_path).unwrap());

    let tls_certs = rustls_pemfile::certs(&mut certs_file)
        .collect::<Result<Vec<_>, _>>()
        .unwrap();

    let tls_key = rustls_pemfile::pkcs8_private_keys(&mut key_file)
        .next()
        .unwrap()
        .unwrap();

    let tls_config = rustls::ServerConfig::builder()
        .with_no_client_auth()
        .with_single_cert(tls_certs, rustls::pki_types::PrivateKeyDer::Pkcs8(tls_key))
        .unwrap();
    tls_config
}

pub fn get_mutual_tls_config(cert_path: &str, key_path: &str, ca_path: &str) -> ServerConfig {
    let mut ca_file = BufReader::new(File::open(ca_path).unwrap());
    let mut certs_file = BufReader::new(File::open(cert_path).unwrap());
    let mut key_file = BufReader::new(File::open(key_path).unwrap());

    let ca_certs = rustls_pemfile::certs(&mut ca_file)
        .collect::<Result<Vec<_>, _>>()
        .unwrap();

    let tls_certs = rustls_pemfile::certs(&mut certs_file)
        .collect::<Result<Vec<_>, _>>()
        .unwrap();

    let tls_key = rustls_pemfile::pkcs8_private_keys(&mut key_file)
        .next()
        .unwrap()
        .unwrap();

    let mut roots = RootCertStore::empty();
    roots.add_parsable_certificates(ca_certs);

    let client_verifier = WebPkiClientVerifier::builder(roots.into()).build().unwrap();

    let tls_config = ServerConfig::builder()
        .with_client_cert_verifier(client_verifier)
        .with_single_cert(tls_certs, rustls::pki_types::PrivateKeyDer::Pkcs8(tls_key))
        .unwrap();
    tls_config
}