import NIOSSL
import PostgresNIO

/// The TLS posture used when connecting to the database.
///
/// The executable derives a posture from its `database.tls` configuration and passes it along as part of ``Configuration``; the PostgreSQL driver
/// receives the resulting connection TLS mode through ``postgresTLS()``.
public enum TLS: Sendable {

    /// Connect without TLS, in plaintext.
    case off

    /// Connect over TLS when the server offers it, falling back to plaintext otherwise.
    case prefer

    /// Connect only over TLS, refusing the connection when the server offers none.
    case require

}

// MARK: - Methods

extension TLS {

    /// The connection TLS mode passed to the PostgreSQL driver for this posture.
    ///
    /// Returns `.disable` for ``off`` (connect in plaintext) and the default client configuration for ``prefer`` and ``require``. The driver enforces
    /// both semantics natively: `prefer` upgrades to TLS only when the server advertises support and continues in plaintext otherwise, while `require`
    /// refuses the connection when the server offers no TLS.
    ///
    /// - Throws: an error when the TLS context cannot be built from the default client configuration.
    /// - Returns: the connection TLS mode for this posture.
    func postgresTLS() throws -> PostgresConnection.Configuration.TLS {
        switch self {
        case .off: .disable
        case .prefer: .prefer(try NIOSSLContext(configuration: .makeClientConfiguration()))
        case .require: .require(try NIOSSLContext(configuration: .makeClientConfiguration()))
        }
    }

}