use crate::cert::{check_cert_included, sign};
use crate::info;
use rustls_pemfile::{certs, private_key};
use std::io::BufReader;
use std::sync::Arc;

pub fn build_tls_acceptor(target_hosts: Vec<String>) -> Arc<rustls::ServerConfig> {
    let is_included_built_in = check_cert_included(target_hosts.iter().map(|s| s.as_str()));
    let (cert_chain, key) = if is_included_built_in {
        let fullchain = include_bytes!(concat!(env!("OUT_DIR"), "/fullchain.pem"));
        let leaf_key = include_bytes!(concat!(env!("OUT_DIR"), "/leaf.key"));
        let cert_chain = certs(&mut BufReader::new(&fullchain[..]))
            .collect::<Result<Vec<_>, _>>()
            .unwrap();
        let key = private_key(&mut BufReader::new(&leaf_key[..]))
            .unwrap()
            .unwrap();
        (cert_chain, key)
    } else {
        info!("Target hosts not match built-in cert, generating new cert");
        let target = target_hosts.iter().map(|s| s.as_str()).collect::<Vec<_>>();
        let (fullchain, leaf_key) = sign(target.iter());
        let cert_chain = certs(&mut BufReader::new(fullchain.as_bytes()))
            .collect::<Result<Vec<_>, _>>()
            .unwrap();
        let key = private_key(&mut BufReader::new(leaf_key.as_bytes()))
            .unwrap()
            .unwrap();
        (cert_chain, key)
    };

    let mut config = rustls::ServerConfig::builder()
        .with_no_client_auth()
        .with_single_cert(cert_chain, key)
        .unwrap();

    config.alpn_protocols = vec![b"http/1.1".to_vec()];

    Arc::new(config)
}