use std::sync::Arc;
use rustls::{Certificate, TLSError};
use webpki::DNSName;

/// Preserve TLS client certificates but do not verify them.
/// Probably unsafe, TODO implement trust-on-first-use for these
pub struct TrustAnyClientCertOrAnonymous;

impl TrustAnyClientCertOrAnonymous {
    pub fn new() -> Arc<Self> {
        Arc::new(Self)
    }
}

impl rustls::ClientCertVerifier for TrustAnyClientCertOrAnonymous {
    fn offer_client_auth(&self) -> bool {
        true
    }

    fn client_auth_mandatory(&self, _sni: Option<&DNSName>) -> Option<bool> {
        Some(false)
    }

    fn client_auth_root_subjects(&self, _sni: Option<&DNSName>) -> Option<rustls::DistinguishedNames> {
        log::debug!("uhhh what the hell is client_auth_root_subjects");
        Some(rustls::DistinguishedNames::new())
    }

    fn verify_client_cert(&self, _presented_certs: &[Certificate], _sni: Option<&DNSName>) -> Result<rustls::ClientCertVerified, TLSError> {
        log::debug!("verification? never heard of it");
        Ok(rustls::ClientCertVerified::assertion())
    }

    fn verify_tls12_signature(&self, _message: &[u8], _cert: &Certificate, _dss: &rustls::internal::msgs::handshake::DigitallySignedStruct) -> Result<rustls::HandshakeSignatureValid, TLSError> {
        log::debug!("verification? also never heard of it");
        Ok(rustls::HandshakeSignatureValid::assertion())
    }
}