# Sourced by dev-index.sh and dev-stack.sh: where the personal data server is,
# and how to trust it.
#
# Not a command anyone runs. It sets PDS_URL, exports DIDBOT_EXTRA_CA_CERTS,
# and defines `pds_curl`.

# The zone's own hostname, not `localhost`. A server is surveyed by reading
# the DID document at the host it is addressed as, and a development server
# serves its own document under the zone it mints accounts in. didbot serves
# it over TLS on 443, so the URL has no port.
PDS_ZONE="${VIBESCROBBLE_PDS_ZONE:-agents.localhost}"
PDS_URL="${VIBESCROBBLE_PDS_URL:-https://${PDS_ZONE}}"

# The authority didbot signs a `.localhost` zone's certificates with. The
# index adds it to the roots it trusts.
export DIDBOT_EXTRA_CA_CERTS="${DIDBOT_EXTRA_CA_CERTS:-${XDG_STATE_HOME:-$HOME/.local/state}/didbot/local-ca/ca.pem}"

# `curl` against PDS_URL. `--cacert` replaces curl's own store rather than
# adding to it, so it is only passed for a `.localhost` server.
pds_curl() {
    local host="${PDS_URL#*://}"
    host="${host%%[:/]*}"
    case "$host" in
        localhost | *.localhost) curl --cacert "$DIDBOT_EXTRA_CA_CERTS" "$@" ;;
        *) curl "$@" ;;
    esac
}