package main

import (
	"fmt"
	"net/http"
	"net/url"
	"time"
)

// brokerClient builds an HTTPS client that presents the host's TPM-backed mTLS
// identity to the enrol-broker's host plane and verifies the broker's server cert
// against the fleet CA. serverName for hostname verification is taken from the
// broker URL's host.
func brokerClient(id *tpmIdentity, brokerURL, caFile string) (*http.Client, error) {
	u, err := url.Parse(brokerURL)
	if err != nil {
		return nil, fmt.Errorf("parse broker URL %q: %w", brokerURL, err)
	}
	if u.Scheme != "https" {
		return nil, fmt.Errorf("broker URL must be https (mTLS), got %q", u.Scheme)
	}
	tlsCfg, err := mtlsClientConfig(id, caFile, u.Hostname())
	if err != nil {
		return nil, err
	}
	tr := &http.Transport{TLSClientConfig: tlsCfg}
	return &http.Client{Timeout: 30 * time.Second, Transport: tr}, nil
}