ioio Development

use std::sync::Arc;
use rustls::{ClientConfig, Error, RootCertStore};
use rustls::crypto::aws_lc_rs::{
    default_provider,
    cipher_suite::TLS13_AES_256_GCM_SHA384,
    kx_group::X25519MLKEM768,
};

pub fn hybrid_client(
    trusted_roots: RootCertStore,
) -> Result<ClientConfig, Error> {
    let mut provider = default_provider();
    provider.kx_groups = vec![X25519MLKEM768];
    provider.cipher_suites = vec![TLS13_AES_256_GCM_SHA384];

    let mut client = ClientConfig::builder_with_provider(
        Arc::new(provider),
    )
    .with_protocol_versions(&[&rustls::version::TLS13])?
    .with_root_certificates(trusted_roots)
    .with_no_client_auth();

    // Require fresh hybrid key establishment on every connection.
    client.resumption = rustls::client::Resumption::disabled();
    client.enable_early_data = false;

    Ok(client)
}