package tlsreload

import (
	"crypto/tls"
	"crypto/x509"
	"errors"
	"fmt"

	"proxy-pool/internal/domain/workerruntime"
)

var ErrInvalidSPIFFEIdentity = errors.New("invalid SPIFFE workload identity")

// ResolveSPIFFEIdentity returns the logical Worker or Checker ID encoded in a
// role-specific SPIFFE URI SAN. It only accepts the exact identity shape that
// the Controller authorizer accepts for a control-plane request.
func ResolveSPIFFEIdentity(certificateFile, keyFile, trustDomain, environment, role string) (string, error) {
	if certificateFile == "" || keyFile == "" || trustDomain == "" || environment == "" || (role != "worker" && role != "checker") {
		return "", ErrInvalidSPIFFEIdentity
	}
	certificate, err := tls.LoadX509KeyPair(certificateFile, keyFile)
	if err != nil || len(certificate.Certificate) == 0 {
		return "", fmt.Errorf("%w: load client certificate", ErrInvalidSPIFFEIdentity)
	}
	leaf, err := x509.ParseCertificate(certificate.Certificate[0])
	if err != nil {
		return "", fmt.Errorf("%w: parse client certificate", ErrInvalidSPIFFEIdentity)
	}
	identity, ok := workerruntime.SingleSPIFFEIdentity(leaf.URIs, trustDomain, environment, role)
	if !ok {
		return "", ErrInvalidSPIFFEIdentity
	}
	return identity, nil
}