package boxid

import (
	"crypto/x509"
	"embed"
	"encoding/pem"
	"fmt"
	"strings"
)

//go:embed certs/*.pem
var certFS embed.FS

// EmbeddedCerts returns AWS's instance-identity signing certificates by
// region, from certs/<aws-region>.pem. A region with no file has no
// certificate, so its boxes never verify: that is the safe default.
func EmbeddedCerts() (map[string]*x509.Certificate, error) {
	entries, err := certFS.ReadDir("certs")
	if err != nil {
		return nil, err
	}
	out := map[string]*x509.Certificate{}
	for _, e := range entries {
		region, ok := strings.CutSuffix(e.Name(), ".pem")
		if !ok {
			continue
		}
		raw, err := certFS.ReadFile("certs/" + e.Name())
		if err != nil {
			return nil, err
		}
		block, _ := pem.Decode(raw)
		if block == nil {
			return nil, fmt.Errorf("boxid: certs/%s is not PEM", e.Name())
		}
		cert, err := x509.ParseCertificate(block.Bytes)
		if err != nil {
			return nil, fmt.Errorf("boxid: certs/%s: %w", e.Name(), err)
		}
		out[region] = cert
	}
	return out, nil
}