import NIOSSL

/// The TLS posture used when connecting to the database.
///
/// The executable derives a posture from its `database.tls` configuration and passes it along as part of ``Configuration``; the MySQL driver
/// receives the resulting `TLSConfiguration` through ``tlsConfiguration``.
public enum TLS: Sendable {

    /// Connect without TLS, in plaintext.
    case off

    /// Connect over TLS when the server offers it, falling back to plaintext otherwise.
    case prefer

    /// Connect only over TLS, refusing the connection when the server offers none.
    ///
    /// - Important: the refusal is not yet enforced — until it is, `require` behaves like ``prefer`` and silently falls back to plaintext when the
    ///   server offers no TLS.
    case require

}

// MARK: - Properties

extension TLS {

    /// The NIO TLS configuration passed to the MySQL driver for this posture.
    ///
    /// Returns `nil` for ``off`` (connect in plaintext) and the default client configuration for ``prefer`` and ``require``.
    ///
    /// - Note: the driver gives a supplied configuration ``prefer`` semantics natively — it upgrades to TLS only when the server advertises support,
    ///   and continues in plaintext otherwise — so `prefer` is fully enforced. `require` maps to the same configuration and therefore currently
    ///   behaves like ``prefer``: the refusal when the server offers no TLS is not yet enforced.
    var tlsConfiguration: TLSConfiguration? {
        switch self {
        case .off: nil
        default: .makeClientConfiguration()
        }
    }

}