package edge

// Ported from titogo internal/carlos/certcache.go (itself adapted from
// Eleven's certcache.go): the certificate-cache seam. Edge boxes in a pool
// must eventually SHARE issued certs, so every issuance artifact goes through
// one autocert.Cache chosen here, never direct file I/O. autocert already
// defines exactly the interface a remote backend needs (Get/Put/Delete with
// ctx, ErrCacheMiss for absent), so there is no parallel abstraction: an S3
// backend is a drop-in behind this constructor.

import (
	"fmt"
	"os"
	"strings"

	"golang.org/x/crypto/acme/autocert"
)

// newCertCache returns the certificate cache selected by CARLOS_CERT_CACHE.
// Unset (or "dir") is the on-disk layout — autocert.DirCache over dir, cache
// keys as plain file names — so an existing cache keeps working over a
// restart with no migration. "s3" is reserved for a pooled-edge backend;
// until it exists it refuses to start, because failing loudly beats silently
// minting certs into a local dir the rest of a pool can't see.
//
// Sharing arrived as a WRAPPER around what this returns, not as a backend
// selected here: certsync.go's publishingCache keeps the local cache as the
// durable copy and publishes every entry to the control bucket under
// control/certs/, which is what the multi-region spec's "one issuer, every
// edge serves" needs — a pure remote backend would put a network round trip
// on the issuance path and leave a box with nothing local when the bucket
// blips. "s3" therefore stays reserved and still refuses.
func newCertCache(dir string) (autocert.Cache, error) {
	switch backend := strings.TrimSpace(os.Getenv("CARLOS_CERT_CACHE")); backend {
	case "", "dir":
		return autocert.DirCache(dir), nil
	case "s3":
		return nil, fmt.Errorf("CARLOS_CERT_CACHE=s3: reserved, not implemented yet")
	default:
		return nil, fmt.Errorf("CARLOS_CERT_CACHE=%q: want unset, \"dir\", or \"s3\"", backend)
	}
}