/**
 * CQL Minus - cqlminus
 *
 * This file is licensed under the Affero General Public License version 3 or
 * later. See the COPYING file.
 *
 * @author Paolo Lulli <kevwe.com>
 * @copyright Paolo Lulli 2026
 */

package db

import (
    "cqlminus/internal/config"
    "crypto/tls"

    "github.com/gocql/gocql"
)

func buildSslOptions(cfg *config.Config) *gocql.SslOptions {
    opts := &gocql.SslOptions{
        CaPath:                 cfg.TlsCA,
        CertPath:               cfg.TlsCertificate,
        KeyPath:                cfg.TlsKeyFile,
        EnableHostVerification: cfg.TlsVerifyServer == "true",
    }

    if cfg.Endpoint != "" {
        opts.Config = &tls.Config{
            ServerName:         cfg.Endpoint,
            InsecureSkipVerify: cfg.TlsVerifyServer == "false",
        }
    }

    return opts
}