// Package pgwire contains the minimal PostgreSQL wire framing PawSQL needs before proxying.
package pgwire

import (
	"encoding/binary"
	"errors"
	"fmt"
	"io"
)

const (
	sslRequestLength uint32 = 8
	sslRequestCode   uint32 = 80877103
)

var ErrNotSSLRequest = errors.New("expected PostgreSQL SSLRequest")

// ReadSSLRequest validates the eight-byte PostgreSQL SSL negotiation request.
func ReadSSLRequest(reader io.Reader) error {
	var request [8]byte
	if _, err := io.ReadFull(reader, request[:]); err != nil {
		return fmt.Errorf("read PostgreSQL SSLRequest: %w", err)
	}
	if length := binary.BigEndian.Uint32(request[0:4]); length != sslRequestLength {
		return fmt.Errorf("%w: invalid length %d", ErrNotSSLRequest, length)
	}
	if code := binary.BigEndian.Uint32(request[4:8]); code != sslRequestCode {
		return fmt.Errorf("%w: invalid request code %d", ErrNotSSLRequest, code)
	}
	return nil
}

// SSLRequest returns the exact client preamble used to request TLS from PostgreSQL.
// It exists to make protocol-level tests and clients unambiguous.
func SSLRequest() [8]byte {
	var request [8]byte
	binary.BigEndian.PutUint32(request[0:4], sslRequestLength)
	binary.BigEndian.PutUint32(request[4:8], sslRequestCode)
	return request
}