package webutil

import (
	"fmt"
	"io/ioutil"
	"net/http"
)

// GetRAXCert : Fetch current rackspace CA cert from ssl tool
// Deprecated: Use in new location of github.rackspace.com/gorax/webutil
func GetRAXCert(selector string) ([]byte, error) {
	/* Information on certs: https://ssltool.rackspace.com/rscerts/

	Example of usage:

	// Get the SystemCertPool, continue with an empty pool on error
	log.Debug("Loading system certificate pool")
	rootCAs, _ := x509.SystemCertPool()
	if rootCAs == nil {
		rootCAs = x509.NewCertPool()
	}

	// Get the current Rackspace internal CA
	log.Debug("Requesting Rackspace CA Cert")
	raxCA, err := webutil.GetRAXCert("internal")
	if err != nil {
		panic(err)
	}

	// Append our cert to the system pool
	if ok := rootCAs.AppendCertsFromPEM(raxCA); !ok {
		log.Println("No certs appended, using system certs only")
	}

	// Tell the client to use the new list of certs
	client := &http.Client{
		Transport: &http.Transport{
			TLSClientConfig: &tls.Config{
				RootCAs: rootCAs,
			},
		},
		CheckRedirect: func(req *http.Request, via []*http.Request) error {
			return http.ErrUseLastResponse // Do not follow redirects
		},
	}

	*/
	var url string

	switch selector {
	case "ca_level_1": // Rackspace CA Level 1 (Barbican Root)
		url = "https://ssltool.rackspace.com/rscerts/rs_ca_level1.crt"
	case "internal": // Rackspace Internal Root CA (deprecated, but still in use)
		url = "https://ssltool.rackspace.com/rscerts/rs_internal_ca.crt"
	case "issuing_ca_1": // Rackspace Issuing CA 1
		url = "https://ssltool.rackspace.com/rscerts/rs_issuing_ca_1.crt"
	case "ord1_intermediate":
		url = "https://ssltool.rackspace.com/rscerts/ord1_rs_ca_01.crt"
	case "lon3_intermediate":
		url = "https://ssltool.rackspace.com/rscerts/lon3_rs_ca_01.crt"
	default: // Rackspace Root CA 1  (CSS Root)
		url = "https://ssltool.rackspace.com/rscerts/rs_root_ca_1.crt"
	}

	resp, err := http.Get(url)
	if err != nil {
		return []byte{}, fmt.Errorf("error getting url: %s", err.Error())
	}
	defer resp.Body.Close()

	body, err := ioutil.ReadAll(resp.Body)
	if err != nil {
		return []byte{}, fmt.Errorf("error reading response body: %s", err.Error())
	}

	if resp.StatusCode != 200 {
		return []byte{}, fmt.Errorf("unexpected response from ssltool: %v - %v", resp.Status, string(body))
	}

	return body, nil
}