use std::io::{stdout, Read, Write};
use std::net::TcpStream;
use std::sync::Arc;

fn main() -> Result<(), Box<dyn std::error::Error>> {
    // let hostname = "github.com";
    let hostname = "wiki.dn42";
    let port = 443;

    // 1. Load the system's native root certificates
    let mut root_store = rustls::RootCertStore::empty();
    let native_certs = rustls_native_certs::load_native_certs().unwrap();
    
    for cert in native_certs {
        root_store.add(cert).ok(); // Add valid certs, ignore errors
    }

    // 2. Create the Client Configuration
    let mut config = rustls::ClientConfig::builder()
        .with_root_certificates(root_store)
        .with_no_client_auth();
    config.key_log = Arc::new(rustls::KeyLogFile::new());
    let arc_config = Arc::new(config);

    // 3. Connect via TCP
    let mut sock = TcpStream::connect((hostname, port))?;

    // 4. Wrap TCP stream in TLS
    let server_name = hostname.try_into()?;
    let mut conn = rustls::ClientConnection::new(arc_config, server_name)?;
    
    // rustls::Stream handles the encryption logic over the socket
    let mut tls_stream = rustls::Stream::new(&mut conn, &mut sock);

    // 5. Send a simple HTTP GET request
    let request = format!(
        "GET / HTTP/1.1\r\n\
         Host: {}\r\n\
         Connection: close\r\n\
         User-Agent: rustls-client\r\n\
         \r\n",
        hostname
    );
    tls_stream.write_all(request.as_bytes())?;

    // 6. Read and print the response
    let mut plaintext = Vec::new();
    tls_stream.read_to_end(&mut plaintext)?;
    
    stdout().write_all(&plaintext)?;

    Ok(())
}