package proxmox

import (
	"crypto/x509"
	"errors"
	"strings"
)

// The causes a call to Proxmox can fail on TRUST (R-1380, felhom.eu `03` §12a). A symptom alarm („the agent channel is
// down") exists; these name the cause.
const (
	TrustPinnedCertChanged = "pinned_cert_changed" // the pinned certificate is not the one Proxmox serves any more
	TrustCAMismatch        = "ca_mismatch"         // the CA file did not sign the served certificate
	TrustCertExpired       = "cert_expired"        // the served certificate (or the CA) has ended
	TrustCAFileUnreadable  = "ca_file_unreadable"  // the CA file is missing or holds no certificate
	TrustNameMismatch      = "name_mismatch"       // the certificate does not name the address the agent calls
)

// TrustProblem names why err is a TRUST failure, or "" when it is none (a refused connection, a 401, a timeout).
func TrustProblem(err error) string {
	if err == nil {
		return ""
	}
	var ua x509.UnknownAuthorityError
	var inv x509.CertificateInvalidError
	var hn x509.HostnameError
	switch {
	case strings.Contains(err.Error(), "TLS pin mismatch"):
		return TrustPinnedCertChanged
	case errors.As(err, &ua):
		return TrustCAMismatch
	case errors.As(err, &inv):
		if inv.Reason == x509.Expired {
			return TrustCertExpired
		}
		return TrustCAMismatch
	case errors.As(err, &hn):
		return TrustNameMismatch
	case strings.Contains(err.Error(), "reading TLS CA file"), strings.Contains(err.Error(), "contained no usable certificates"):
		return TrustCAFileUnreadable
	}
	return ""
}