package mysql

import (
	"crypto/tls"
	"crypto/x509"
	"database/sql"
	"fmt"

	"github.com/go-sql-driver/mysql"
)

func newDB(dsn string, tlsConfig *TLSConfig) (*sql.DB, error) {
	cfg, err := mysql.ParseDSN(dsn)
	if err != nil {
		return nil, err
	}
	if tlsConfig != nil {
		rootCertPool := x509.NewCertPool()
		if ok := rootCertPool.AppendCertsFromPEM(tlsConfig.CA); !ok {
			return nil, fmt.Errorf(("can't append ca"))
		}
		clientCert := make([]tls.Certificate, 0, 1)
		certs, err := tls.X509KeyPair(tlsConfig.Cert, tlsConfig.Key)
		if err != nil {
			return nil, fmt.Errorf("invalid cert and key: %w", err)
		}
		clientCert = append(clientCert, certs)
		if err := mysql.RegisterTLSConfig(tlsConfigName, &tls.Config{
			RootCAs:      rootCertPool,
			Certificates: clientCert,
			MinVersion:   tls.VersionTLS12,
		}); err != nil {
			return nil, fmt.Errorf("can't register tls config: %w", err)
		}
		defer mysql.DeregisterTLSConfig(tlsConfigName)

		cfg.TLSConfig = tlsConfigName
	}
	connector, err := mysql.NewConnector(cfg)
	if err != nil {
		return nil, err
	}

	db := sql.OpenDB(connector)
	return db, nil
}