package secretsserver

import (
	"crypto/tls"
	"crypto/x509"
	"errors"
	"os"
)

// mTLSConfigFromCA returns a tls config that enforces client auth with certs
// issued by the provided ca.
func mTLSConfigFromCA(ca string) (*tls.Config, error) {
	caPEMBytes, err := os.ReadFile(ca)
	if err != nil {
		return nil, err
	}
	caCertPool := x509.NewCertPool()
	if added := caCertPool.AppendCertsFromPEM(caPEMBytes); !added {
		return nil, errors.New("ca file did not contain a valid cert")
	}
	return &tls.Config{
		// Force server to deman and verify cert from clients.
		ClientAuth: tls.RequireAndVerifyClientCert,
		// CAs that will be used to verify client certs.
		ClientCAs: caCertPool,
		// Safer to default to tls 1.3
		MinVersion: tls.VersionTLS13,
	}, nil
}