// Copyright 2024 The NativeLink Authors. All rights reserved.

//

// Licensed under the Apache License, Version 2.0 (the "License");

// you may not use this file except in compliance with the License.

// You may obtain a copy of the License at

//

//    http://www.apache.org/licenses/LICENSE-2.0

//

// Unless required by applicable law or agreed to in writing, software

// distributed under the License is distributed on an "AS IS" BASIS,

// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

// See the License for the specific language governing permissions and

// limitations under the License.

use nativelink_config::stores::{ClientTlsConfig, GrpcEndpoint};

use nativelink_error::{make_err, make_input_err, Code, Error};

use tonic::transport::Uri;

pub fn load_client_config(

    config: &Option<ClientTlsConfig>,

) -> Result<Option<tonic::transport::ClientTlsConfig>, Error> {

    let Some(config) = config else {

  Branch (22:9): [True: 0, False: 0]

  Branch (22:9): [Folded - Ignored]

        return Ok(None);

    };

    let read_config = tonic::transport::ClientTlsConfig::new().ca_certificate(

        tonic::transport::Certificate::from_pem(std::fs::read_to_string(&config.ca_file)?),

    );

    let config = if let Some(client_certificate) = &config.cert_file {

  Branch (29:25): [True: 0, False: 0]

  Branch (29:25): [Folded - Ignored]

        let Some(client_key) = &config.key_file else {

  Branch (30:13): [True: 0, False: 0]

  Branch (30:13): [Folded - Ignored]

            return Err(make_err!(

                Code::Internal,

                "Client certificate specified, but no key"

            ));

        };

        read_config.identity(tonic::transport::Identity::from_pem(

            std::fs::read_to_string(client_certificate)?,

            std::fs::read_to_string(client_key)?,

        ))

    } else {

        if config.key_file.is_some() {

  Branch (41:12): [True: 0, False: 0]

  Branch (41:12): [Folded - Ignored]

            return Err(make_err!(

                Code::Internal,

                "Client key specified, but no certificate"

            ));

        }

        read_config

    };

    Ok(Some(config))

}

pub fn endpoint_from(

    endpoint: &str,

    tls_config: Option<tonic::transport::ClientTlsConfig>,

) -> Result<tonic::transport::Endpoint, Error> {

    let endpoint = Uri::try_from(endpoint)

        .map_err(|e| make_err!(Code::Internal, "Unable to parse endpoint {endpoint}: {e:?}"))?;

    // Tonic uses the TLS configuration if the scheme is "https", so replace

    // grpcs with https.

    let endpoint = if endpoint.scheme_str() == Some("grpcs") {

  Branch (62:23): [True: 0, False: 0]

  Branch (62:23): [Folded - Ignored]

        let mut parts = endpoint.into_parts();

        parts.scheme = Some("https".parse().map_err(|e| {

            make_err!(

                Code::Internal,

                "https is an invalid scheme apparently? {e:?}"

            )

        })?);

        parts.try_into().map_err(|e| {

            make_err!(

                Code::Internal,

                "Error changing Uri from grpcs to https: {e:?}"

            )

        })?

    } else {

        endpoint

    };

    let endpoint_transport = if let Some(tls_config) = tls_config {

  Branch (80:37): [True: 0, False: 0]

  Branch (80:37): [Folded - Ignored]

        let Some(authority) = endpoint.authority() else {

  Branch (81:13): [True: 0, False: 0]

  Branch (81:13): [Folded - Ignored]

            return Err(make_input_err!(

                "Unable to determine authority of endpont: {endpoint}"

            ));

        };

        if endpoint.scheme_str() != Some("https") {

  Branch (86:12): [True: 0, False: 0]

  Branch (86:12): [Folded - Ignored]

            return Err(make_input_err!(

                "You have set TLS configuration on {endpoint}, but the scheme is not https or grpcs"

            ));

        }

        let tls_config = tls_config.domain_name(authority.host());

        tonic::transport::Endpoint::from(endpoint)

            .tls_config(tls_config)

            .map_err(|e| make_input_err!("Setting mTLS configuration: {e:?}"))?

    } else {

        tonic::transport::Endpoint::from(endpoint)

    };

    Ok(endpoint_transport)

}

pub fn endpoint(endpoint_config: &GrpcEndpoint) -> Result<tonic::transport::Endpoint, Error> {

    let endpoint = endpoint_from(

        &endpoint_config.address,

        load_client_config(&endpoint_config.tls_config)?,

    )?;

    if let Some(concurrency_limit) = endpoint_config.concurrency_limit {

  Branch (107:12): [True: 0, False: 0]

  Branch (107:12): [Folded - Ignored]

        Ok(endpoint.concurrency_limit(concurrency_limit))

    } else {

        Ok(endpoint)

    }

}