// Package certpaths centralizes the on-disk locations of the CA and
// server cert/key files. The CLI layer, the security layer, and the
// doctor layer all need to agree on these paths, so they're factored
// into their own package to avoid import cycles (cli <-> doctor).
package certpaths

import (
	"os"
	"path/filepath"
)

const (
	defaultCADir   = ".orca"
	caCertFilename = "ca.crt"
	caKeyFilename  = "ca.key"
)

// Dir returns the directory the local CA lives in. Honors $ORCA_HOME
// for testability; otherwise defaults to ~/.orca.
func Dir() string {
	if p := os.Getenv("ORCA_HOME"); p != "" {
		return p
	}
	home, _ := os.UserHomeDir()
	return filepath.Join(home, defaultCADir)
}

// CACertPath returns the path to ca.crt.
func CACertPath() string { return filepath.Join(Dir(), caCertFilename) }

// CAKeyPath returns the path to ca.key.
func CAKeyPath() string { return filepath.Join(Dir(), caKeyFilename) }

// ServerCertPath returns the path to server.crt.
func ServerCertPath() string { return filepath.Join(Dir(), "server.crt") }

// ServerKeyPath returns the path to server.key.
func ServerKeyPath() string { return filepath.Join(Dir(), "server.key") }