use std::time::Duration;

/// Shared TLS config for every ureq client so OS/enterprise root CAs are honored
/// (#643). ureq's default `RootCerts::WebPki` ignores the system store, so requests
/// fail with `UnknownIssuer` behind TLS-intercepting corporate proxies. Inject this
/// into a `ureq::config::Config::builder().tls_config(platform_tls_config())` at each
/// call site — ureq's builder scope typestate is private, so a shared *builder*
/// cannot be returned from a function; the shared piece is this `TlsConfig`.
pub fn platform_tls_config() -> ureq::tls::TlsConfig {
    ureq::tls::TlsConfig::builder()
        .root_certs(ureq::tls::RootCerts::PlatformVerifier)
        .build()
}

/// Builds a ureq agent from an already-assembled config (kept as a thin, nameable
/// wrapper so call sites read uniformly alongside `platform_tls_config`).
pub fn ureq_agent(config: ureq::config::Config) -> ureq::Agent {
    ureq::Agent::new_with_config(config)
}

/// Agent that honors platform roots and bounds only the connection-setup phases
/// (DNS/connect/first-byte) — a large but progressing download stays uncapped.
pub fn ureq_agent_with_timeouts(
    timeout_resolve: Option<Duration>,
    timeout_connect: Option<Duration>,
    timeout_recv_response: Option<Duration>,
) -> ureq::Agent {
    ureq::config::Config::builder()
        .tls_config(platform_tls_config())
        .timeout_resolve(timeout_resolve)
        .timeout_connect(timeout_connect)
        .timeout_recv_response(timeout_recv_response)
        .build()
        .into()
}
