// Copyright 2024 The NativeLink Authors. All rights reserved.

//

// Licensed under the Functional Source License, Version 1.1, Apache 2.0 Future License (the "License");

// you may not use this file except in compliance with the License.

// You may obtain a copy of the License at

//

//    See LICENSE file for details

//

// Unless required by applicable law or agreed to in writing, software

// distributed under the License is distributed on an "AS IS" BASIS,

// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

// See the License for the specific language governing permissions and

// limitations under the License.

use nativelink_config::stores::{ClientTlsConfig, GrpcEndpoint};

use nativelink_error::{Code, Error, make_err, make_input_err};

use tonic::transport::Uri;

use tracing::warn;

pub fn load_client_config(

    config: &Option<ClientTlsConfig>,

) -> Result<Option<tonic::transport::ClientTlsConfig>, Error> {

    let Some(
config9
) = config else {

  Branch (23:9): [True: 9, False: 1]

  Branch (23:9): [Folded - Ignored]

        return Ok(None);

    };

    if config.use_native_roots == Some(true) {

  Branch (27:8): [True: 5, False: 4]

  Branch (27:8): [Folded - Ignored]

        if config.ca_file.is_some() {

  Branch (28:12): [True: 0, False: 5]

  Branch (28:12): [Folded - Ignored]

            warn!("Native root certificates are being used, all certificate files will be ignored");

        }

        return Ok(Some(

            tonic::transport::ClientTlsConfig::new().with_native_roots(),

        ));

    }

    let Some(
ca_file3
) = &config.ca_file else {

  Branch (36:9): [True: 3, False: 1]

  Branch (36:9): [Folded - Ignored]

        return Err(make_err!(

            Code::Internal,

            "CA certificate must be provided if not using native root certificates"

        ));

    };

    let read_config = tonic::transport::ClientTlsConfig::new().ca_certificate(

        tonic::transport::Certificate::from_pem(std::fs::read_to_string(ca_file)
?0
),

    );

    let 
config1
 = if let Some(
client_certificate2
) = &config.cert_file {

  Branch (46:25): [True: 2, False: 1]

  Branch (46:25): [Folded - Ignored]

        let Some(
client_key1
) = &config.key_file else {

  Branch (47:13): [True: 1, False: 1]

  Branch (47:13): [Folded - Ignored]

            return Err(make_err!(

                Code::Internal,

                "Client certificate specified, but no key"

            ));

        };

        read_config.identity(tonic::transport::Identity::from_pem(

            std::fs::read_to_string(client_certificate)
?0
,

            std::fs::read_to_string(client_key)
?0
,

        ))

    } else {

        if config.key_file.is_some() {

  Branch (58:12): [True: 1, False: 0]

  Branch (58:12): [Folded - Ignored]

            return Err(make_err!(

                Code::Internal,

                "Client key specified, but no certificate"

            ));

        }

        read_config

    };

    Ok(Some(config))

}

pub fn endpoint_from(

    endpoint: &str,

    tls_config: Option<tonic::transport::ClientTlsConfig>,

) -> Result<tonic::transport::Endpoint, Error> {

    let 
endpoint6
 = Uri::try_from(endpoint)

        .map_err(|e| make_err!(
Code::Internal1
, "Unable to parse endpoint {endpoint}: {e:?}"))
?1
;

    // Tonic uses the TLS configuration if the scheme is "https", so replace

    // grpcs with https.

    let endpoint = if endpoint.scheme_str() == Some("grpcs") {

  Branch (79:23): [True: 1, False: 5]

  Branch (79:23): [Folded - Ignored]

        let mut parts = endpoint.into_parts();

        parts.scheme = Some("https".parse().map_err(|e| 
{0

            make_err!(

                Code::Internal,

                "https is an invalid scheme apparently? {e:?}"

            )

        })?);

        parts.try_into().map_err(|e| 
{0

            make_err!(

                Code::Internal,

                "Error changing Uri from grpcs to https: {e:?}"

            )

        })?

    } else {

        endpoint

    };

    let 
endpoint_transport3
 = if let Some(
tls_config4
) = tls_config {

  Branch (97:37): [True: 4, False: 2]

  Branch (97:37): [Folded - Ignored]

        let Some(
authority3
) = endpoint.authority() else {

  Branch (98:13): [True: 3, False: 1]

  Branch (98:13): [Folded - Ignored]

            return Err(make_input_err!(

                "Unable to determine authority of endpoint: {endpoint}"

            ));

        };

        if endpoint.scheme_str() != Some("https") {

  Branch (103:12): [True: 1, False: 2]

  Branch (103:12): [Folded - Ignored]

            return Err(make_input_err!(

                "You have set TLS configuration on {endpoint}, but the scheme is not https or grpcs"

            ));

        }

        let tls_config = tls_config.domain_name(authority.host());

        tonic::transport::Endpoint::from(endpoint)

            .tls_config(tls_config)

            .map_err(|e| make_input_err!("Setting mTLS configuration: {e:?}"))
?0

    } else {

        if endpoint.scheme_str() == Some("https") {

  Branch (113:12): [True: 1, False: 1]

  Branch (113:12): [Folded - Ignored]

            return Err(make_input_err!(

                "The scheme of {endpoint} is https or grpcs, but no TLS configuration was provided"

            ));

        }

        tonic::transport::Endpoint::from(endpoint)

    };

    Ok(endpoint_transport)

}

pub fn endpoint(endpoint_config: &GrpcEndpoint) -> Result<tonic::transport::Endpoint, Error> {

    let endpoint = endpoint_from(

        &endpoint_config.address,

        load_client_config(&endpoint_config.tls_config)?,

    )?;

    if let Some(concurrency_limit) = endpoint_config.concurrency_limit {

  Branch (129:12): [True: 0, False: 0]

  Branch (129:12): [Folded - Ignored]

        Ok(endpoint.concurrency_limit(concurrency_limit))

    } else {

        Ok(endpoint)

    }

}