package authz

import (
	"context"
	"crypto/x509"
	"net"

	"gitlab.com/gitlab-org/software-supply-chain-security/authorization/sparkled/pkg/pls"
	"google.golang.org/grpc"
	"google.golang.org/grpc/credentials"
	"google.golang.org/grpc/credentials/insecure"
)

func NewGrpcConnection(ctx context.Context, host string) *grpc.ClientConn {
	connection, err := grpc.NewClient(
		host,
		grpc.WithTransportCredentials(credentialsFor(ctx, host)),
	)
	if err != nil {
		pls.LogErrorNow(ctx, err)
	}

	return connection
}

func credentialsFor(ctx context.Context, host string) credentials.TransportCredentials {
	if host == "" {
		return insecure.NewCredentials()
	}

	_, port, err := net.SplitHostPort(host)
	if err != nil {
		pls.LogErrorNow(ctx, err)
		return insecure.NewCredentials()
	}

	if port != "443" {
		return insecure.NewCredentials()
	}

	pool, err := x509.SystemCertPool()
	if err != nil {
		return insecure.NewCredentials()
	}

	return credentials.NewClientTLSFromCert(pool, "")
}