use rustls::{
    crypto::{tls12, tls13, KeyExchangeAlgorithm, SupportedKxGroup, WebPkiSupportedAlgorithms},
    CipherSuite, CipherSuiteCommon, SignatureScheme, SupportedCipherSuite, Tls12CipherSuite,
    Tls13CipherSuite,
};

use crate::{cipher, hash, hmac, kx, verify};

pub(super) static CIPHER_SUITES: &[SupportedCipherSuite] = &[
    // TLSv1.3 suites
    TLS13_CHACHA20POLY1305_SHA256,
    TLS13_AES256GCM_SHA384,
    TLS13_AES128GCM_SHA256,
    // TLSv1.2 suites
    TLS_ECDHE_RSA_WITH_CHACHA20POLY1305_SHA256,
    TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
    TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
];
pub(super) static KX_GROUPS: &[&dyn SupportedKxGroup] = &[&kx::X25519];
pub(super) static SIGNATURE_VERIFICATION_ALGORITHMS: WebPkiSupportedAlgorithms =
    WebPkiSupportedAlgorithms {
        all: &[
            verify::RSA_PSS_SHA256,
            verify::RSA_PKCS1_SHA256,
            verify::ECDSA_NISTP256_SHA256,
            verify::ECDSA_NISTP384_SHA384,
        ],
        mapping: &[
            (SignatureScheme::RSA_PSS_SHA256, &[verify::RSA_PSS_SHA256]),
            (
                SignatureScheme::RSA_PKCS1_SHA256,
                &[verify::RSA_PKCS1_SHA256],
            ),
            (
                SignatureScheme::ECDSA_NISTP256_SHA256,
                &[verify::ECDSA_NISTP256_SHA256],
            ),
            (
                SignatureScheme::ECDSA_NISTP384_SHA384,
                &[verify::ECDSA_NISTP384_SHA384],
            ),
        ],
    };
pub(super) static SUPPORTED_SIGNATURE_SCHEMES: &[SignatureScheme] = &[
    SignatureScheme::RSA_PSS_SHA256,
    SignatureScheme::RSA_PKCS1_SHA256,
    SignatureScheme::ECDSA_NISTP256_SHA256,
    SignatureScheme::ECDSA_NISTP384_SHA384,
];

// TLSv1.3
pub static TLS13_CHACHA20POLY1305_SHA256: SupportedCipherSuite =
    SupportedCipherSuite::Tls13(&Tls13CipherSuite {
        common: CipherSuiteCommon {
            suite: CipherSuite::TLS13_CHACHA20_POLY1305_SHA256,
            hash_provider: &hash::SHA256,
            confidentiality_limit: u64::MAX,
        },
        hkdf_provider: &tls13::HkdfUsingHmac(&hmac::HMAC_SHA256),
        aead_alg: &cipher::TLS_CHACHA20POLY1305,
        quic: None,
    });
pub static TLS13_AES128GCM_SHA256: SupportedCipherSuite =
    SupportedCipherSuite::Tls13(&Tls13CipherSuite {
        common: CipherSuiteCommon {
            suite: CipherSuite::TLS13_AES_128_GCM_SHA256,
            hash_provider: &hash::SHA256,
            confidentiality_limit: 1 << 24,
        },
        hkdf_provider: &tls13::HkdfUsingHmac(&hmac::HMAC_SHA256),
        aead_alg: &cipher::TLS_AES128GCM,
        quic: None,
    });
pub static TLS13_AES256GCM_SHA384: SupportedCipherSuite =
    SupportedCipherSuite::Tls13(&Tls13CipherSuite {
        common: CipherSuiteCommon {
            suite: CipherSuite::TLS13_AES_256_GCM_SHA384,
            hash_provider: &hash::SHA384,
            confidentiality_limit: 1 << 24,
        },
        hkdf_provider: &tls13::HkdfUsingHmac(&hmac::HMAC_SHA384),
        aead_alg: &cipher::TLS_AES256GCM,
        quic: None,
    });
// TLSv1.2
pub static TLS_ECDHE_RSA_WITH_CHACHA20POLY1305_SHA256: SupportedCipherSuite =
    SupportedCipherSuite::Tls12(&Tls12CipherSuite {
        common: CipherSuiteCommon {
            suite: CipherSuite::TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
            hash_provider: &hash::SHA256,
            confidentiality_limit: u64::MAX,
        },
        prf_provider: &tls12::PrfUsingHmac(&hmac::HMAC_SHA256),
        kx: KeyExchangeAlgorithm::ECDHE,
        sign: SUPPORTED_SIGNATURE_SCHEMES,
        aead_alg: &cipher::TLS_CHACHA20POLY1305,
    });
pub static TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256: SupportedCipherSuite =
    SupportedCipherSuite::Tls12(&Tls12CipherSuite {
        common: CipherSuiteCommon {
            suite: CipherSuite::TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
            hash_provider: &hash::SHA256,
            confidentiality_limit: 1 << 24,
        },
        prf_provider: &tls12::PrfUsingHmac(&hmac::HMAC_SHA256),
        kx: KeyExchangeAlgorithm::ECDHE,
        sign: SUPPORTED_SIGNATURE_SCHEMES,
        aead_alg: &cipher::TLS_AES128GCM,
    });
pub static TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384: SupportedCipherSuite =
    SupportedCipherSuite::Tls12(&Tls12CipherSuite {
        common: CipherSuiteCommon {
            suite: CipherSuite::TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
            hash_provider: &hash::SHA384,
            confidentiality_limit: 1 << 24,
        },
        prf_provider: &tls12::PrfUsingHmac(&hmac::HMAC_SHA384),
        kx: KeyExchangeAlgorithm::ECDHE,
        sign: SUPPORTED_SIGNATURE_SCHEMES,
        aead_alg: &cipher::TLS_AES256GCM,
    });
