/*
 * cafile.c
 * vim: expandtab:ts=4:sts=4:sw=4
 *
 * Copyright (C) 2022 Steffen Jaeckel <jaeckel-floss@eyet-services.de>
 *
 * SPDX-License-Identifier: GPL-3.0-or-later WITH OpenSSL-exception
 */

#include "config.h"

#include <fcntl.h>
#include <glib.h>
#include <errno.h>
#include <string.h>
#include <sys/wait.h>

#include "common.h"
#include "config/files.h"
#include "log.h"
#include "xmpp/xmpp.h"

static gchar*
_cafile_name(void)
{
    auto_gchar gchar* certs_dir = files_get_data_path(DIR_CERTS);
    if (!create_dir(certs_dir)) {
        return NULL;
    }
    return g_strdup_printf("%s/CAfile.pem", certs_dir);
}

void
cafile_add(const TLSCertificate* cert)
{
    if (!cert->pem) {
        log_error("[CAfile] can't store cert with fingerprint %s: PEM is empty", cert->fingerprint);
        return;
    }
    auto_gchar gchar* cafile = _cafile_name();
    if (!cafile)
        return;
    auto_gchar gchar* contents = NULL;
    auto_gchar gchar* new_contents = NULL;
    gsize length;
    auto_gerror GError* glib_error = NULL;
    if (g_file_test(cafile, G_FILE_TEST_EXISTS)) {
        if (!g_file_get_contents(cafile, &contents, &length, &glib_error)) {
            log_error("[CAfile] could not read from %s: %s", cafile, PROF_GERROR_MESSAGE(glib_error));
            return;
        }
        if (strstr(contents, cert->fingerprint)) {
            log_debug("[CAfile] fingerprint %s already stored", cert->fingerprint);
            return;
        }
        if (strstr(contents, cert->fingerprint_sha1)) {
            log_debug("[CAfile] fingerprint %s already stored", cert->fingerprint_sha1);
            return;
        }
    }
    const char* header = "# Profanity CAfile\n# DO NOT EDIT - this file is automatically generated";
    new_contents = g_strdup_printf("%s\n# %s\n%s", contents ? contents : header, cert->fingerprint, cert->pem);
    if (!g_file_set_contents(cafile, new_contents, -1, &glib_error))
        log_error("[CAfile] could not write to %s: %s", cafile, PROF_GERROR_MESSAGE(glib_error));
}

gchar*
cafile_get_name(void)
{
    gchar* cafile = _cafile_name();
    if (!g_file_test(cafile, G_FILE_TEST_EXISTS)) {
        /* That's no problem!
         * There's no need to have a profanity-specific CAfile if all CA's
         * of servers you're trying to connect to are in your OS trust-store
         */
        log_debug("[CAfile] file %s not created yet", cafile);
        g_free(cafile);
        cafile = NULL;
    }
    return cafile;
}