package secretsclient

import (
	"crypto/tls"
	"crypto/x509"
	"errors"
	"fmt"
	"net/http"
	"os"
	"time"
)

func newMTLSClient(ca, cert, key string) (*http.Client, error) {
	caPEMBytes, err := os.ReadFile(ca)
	if err != nil {
		return nil, err
	}
	caPool := x509.NewCertPool()
	if !caPool.AppendCertsFromPEM(caPEMBytes) {
		return nil, errors.New("could create a ca pool from file")
	}

	cliCert, err := tls.LoadX509KeyPair(cert, key)
	if err != nil {
		return nil, fmt.Errorf("could not load client cert/key: %w", err)
	}

	return &http.Client{
		// TODO: Tune other params.
		Timeout: 10 * time.Second,
		Transport: &http.Transport{
			TLSClientConfig: &tls.Config{
				RootCAs:      caPool,
				Certificates: []tls.Certificate{cliCert},
			},
		},
	}, nil
}