package auth

import (
	"context"

	"github.com/hashicorp/vault/api"
)

func init() { register(certMethod{}) }

// certMethod is TLS client-cert auth. The certificate itself is supplied at
// the transport layer via profile.tls.client_cert/client_key (see
// config.Settings and internal/vault.NewClient) — this method's Login is
// just the POST that tells Vault which cert role to match against.
//
// api/auth/cert has no tagged release (only a pseudo-version on the module
// proxy), so this is implemented as a two-line raw request rather than
// pulling in an unreleased dependency.
type certMethod struct{}

func (certMethod) Name() string         { return "cert" }
func (certMethod) DisplayName() string  { return "TLS Certificate" }
func (certMethod) DefaultMount() string { return "cert" }

func (certMethod) Description() string {
	return "Client-certificate auth. Configure tls.client_cert / tls.client_key on the profile first."
}

func (certMethod) Fields() []Field {
	return []Field{
		{Name: "name", Label: "Cert role name (optional)", Kind: FieldText},
	}
}

func (certMethod) Login(ctx context.Context, c *api.Client, req Request) (*api.Secret, error) {
	mount := mountOf(req, "cert")
	data := map[string]interface{}{}
	if name := req.Creds.Get("name"); name != "" {
		data["name"] = name
	}
	return loginWrite(ctx, c, mount, "login", data)
}