use std::sync::Arc;

use ::rustls::{
    client::WantsClientCert, ClientConfig, ConfigBuilder, RootCertStore, WantsVersions,
};

use crate::rustls::InsecureServerCertificateVerifier;

pub mod cipher;
pub mod hash;
pub mod hmac;
pub mod kx;
pub mod rustls;
pub mod traits;
pub mod verify;

pub fn rustls_client() -> ConfigBuilder<ClientConfig, WantsVersions> {
    ClientConfig::builder_with_provider(rustls::provider().into())
}

pub fn rustls_default_client() -> ConfigBuilder<ClientConfig, WantsClientCert> {
    let root_store = RootCertStore::from_iter(webpki_roots::TLS_SERVER_ROOTS.iter().cloned());
    rustls_client()
        .with_safe_default_protocol_versions()
        .unwrap()
        .with_root_certificates(root_store)
}

pub fn rustls_insecure_client() -> ConfigBuilder<ClientConfig, WantsClientCert> {
    rustls_client()
        .with_safe_default_protocol_versions()
        .unwrap()
        .dangerous()
        .with_custom_certificate_verifier(Arc::new(InsecureServerCertificateVerifier))
}
