package cert

import (
	"crypto/tls"
	"crypto/x509"
	"fmt"
	"os"
)

func LoadTLSCfg(caPath string, clientCertPath string, clientCertKeyPath string) (*tls.Config, error) {
	// 加载CA证书
	caCert, err := os.ReadFile(caPath) // "ca.crt"
	if err != nil {
		return nil, fmt.Errorf("load ca error: %s", err.Error())
	}
	caCertPool := x509.NewCertPool()
	caCertPool.AppendCertsFromPEM(caCert)

	// 加载客户端的私钥和证书
	// clientCertPath, clientCertKeyPath
	// "client.crt", "client.key"
	clientCert, err := tls.LoadX509KeyPair(clientCertPath, clientCertKeyPath)
	if err != nil {
		return nil, fmt.Errorf("load client cert error: %s", err.Error())
	}

	// 设置TLS配置
	tlsConfig := &tls.Config{
		Certificates: []tls.Certificate{clientCert},
		RootCAs:      caCertPool,
	}

	return tlsConfig, nil
}

func LoadTLSCfgFromBytes(caCert []byte, clientCertPem []byte, clientCertKey []byte) (*tls.Config, error) {
	caCertPool := x509.NewCertPool()
	caCertPool.AppendCertsFromPEM(caCert)

	clientCert, err := tls.X509KeyPair(clientCertPem, clientCertKey)
	if err != nil {
		return nil, fmt.Errorf("X509KeyPair error: %s", err.Error())
	}

	// 设置TLS配置
	tlsConfig := &tls.Config{
		Certificates: []tls.Certificate{clientCert},
		RootCAs:      caCertPool,
	}

	return tlsConfig, nil
}