/**
 * Config Vault - cfgvault
 *
 * This file is licensed under the Affero General Public License version 3 or
 * later. See the COPYING file.
 *
 * @author Paolo Lulli <kevwe.com>
 * @copyright Paolo Lulli 2026
 */
use crate::config::AppConfig;
use crate::{handlers, tls};
use actix_allow_deny_middleware::AllowList;
use actix_web::dev::Server;
use actix_web::{web, App, HttpServer};
use std::net::TcpListener;

pub fn run(config: AppConfig, listener: TcpListener) -> Result<Server, std::io::Error> {
    let allowlist = config.allowlist.unwrap().clone();

    let runtime = HttpServer::new(move || {
        let allowed_ips: Vec<&str> = allowlist.iter().map(std::ops::Deref::deref).collect();
        let app = App::new()
            .wrap(AllowList::with_allowed_ips(allowed_ips))
            .route("/secret/{key}", web::get().to(handlers::vault_handler));
        app
    });

    let server: Server;
    if !(config.server_tls_certificate.is_none() && config.server_tls_key.is_none()) {
        if !config.validate_client_cert.is_none() && config.validate_client_cert.unwrap() == true {
            if config.server_ca.is_none() {
                panic!("Mutual TLS is enabled but no CA certificate is provided");
            }
            server = runtime
                .listen_rustls_0_23(
                    listener,
                    tls::get_mutual_tls_config(
                        &config.server_tls_certificate.unwrap(),
                        &config.server_tls_key.unwrap(),
                        &config.server_ca.unwrap(),
                    ),
                )?
                .run();
        } else {
            server = runtime
                .listen_rustls_0_23(
                    listener,
                    tls::get_tls_config(
                        &config.server_tls_certificate.unwrap(),
                        &config.server_tls_key.unwrap(),
                    ),
                )?
                .run();
        }
    } else {
        server = runtime.listen(listener)?.run();
    }
    Ok(server)
}