TLS Encryption

tls_context ctx;
ctx.set_default_verify_paths();              // trust the system CAs
ctx.set_verify_mode(tls_verify_mode::peer);  // require + verify the peer
ctx.set_hostname("example.com");             // SNI + hostname check

// 1. Configure a context
tls_context ctx;
ctx.set_hostname("api.example.com");
if (auto ec = ctx.set_default_verify_paths(); ec)
    throw std::system_error(ec);
if (auto ec = ctx.set_verify_mode(tls_verify_mode::peer); ec)
    throw std::system_error(ec);

// 2. Connect a socket
corosio::tcp_socket sock(ioc);
sock.open();
if (auto [ec] = co_await sock.connect(endpoint); ec)
    throw std::system_error(ec);

// 3. Wrap the connected socket (pointer form; does not take ownership)
corosio::wolfssl_stream secure(&sock, ctx);
if (auto [ec] = co_await secure.handshake(wolfssl_stream::client); ec)
    throw std::system_error(ec);

// 4. Use encrypted I/O
auto [ec, n] = co_await secure.read_some(buffer);

// Read encrypted data
char buf[1024];
auto [ec, n] = co_await secure.read_some(
    capy::mutable_buffer(buf, sizeof(buf)));

// Write encrypted data
std::string msg = "Hello, TLS!";
auto [wec, wn] = co_await secure.write_some(
    capy::const_buffer(msg.data(), msg.size()));

auto [ec] = co_await secure.shutdown();
// Then close the underlying socket
sock.close();

capy::task<void> send_request(corosio::io_stream& stream)
{
    std::string request = "GET / HTTP/1.1\r\n\r\n";
    if (auto [ec, n] = co_await capy::write(
            stream, capy::const_buffer(request.data(), request.size())); ec)
        throw std::system_error(ec);

    std::string response;
    co_await capy::read(stream, capy::string_dynamic_buffer(&response));
}

capy::task<void> send_request(corosio::tls_stream& stream)
{
    std::string request = "GET / HTTP/1.1\r\n\r\n";
    if (auto [ec, n] = co_await capy::write(
            stream, capy::const_buffer(request.data(), request.size())); ec)
        throw std::system_error(ec);

    std::string response;
    co_await capy::read(stream, capy::string_dynamic_buffer(&response));
}

// Plain socket uses the io_stream overload
corosio::tcp_socket sock(ioc);
co_await send_request(sock);

// TLS stream uses the tls_stream overload
corosio::wolfssl_stream secure(&sock, ctx);
co_await send_request(secure);

capy::task<void> https_get(
    corosio::io_context& ioc,
    std::string_view hostname,
    std::uint16_t port)
{
    // Resolve hostname
    corosio::resolver resolver(ioc);
    auto [resolve_ec, results] = co_await resolver.resolve(
        hostname, std::to_string(port));
    if (resolve_ec)
        throw std::system_error(resolve_ec);

    // Connect TCP socket
    corosio::tcp_socket sock(ioc);
    sock.open();

    for (auto const& entry : results)
    {
        auto [ec] = co_await sock.connect(entry.get_endpoint());
        if (!ec)
            break;
    }

    // Configure TLS
    tls_context ctx;
    ctx.set_hostname(hostname);
    if (auto ec = ctx.set_default_verify_paths(); ec)
        throw std::system_error(ec);
    if (auto ec = ctx.set_verify_mode(tls_verify_mode::peer); ec)
        throw std::system_error(ec);

    // Wrap the connected socket (pointer form) and handshake
    corosio::wolfssl_stream secure(&sock, ctx);
    if (auto [ec] = co_await secure.handshake(wolfssl_stream::client); ec)
        throw std::system_error(ec);

    // Send HTTP request
    std::string request =
        "GET / HTTP/1.1\r\n"
        "Host: " + std::string(hostname) + "\r\n"
        "Connection: close\r\n"
        "\r\n";

    if (auto [ec, n] = co_await capy::write(
            secure, capy::const_buffer(request.data(), request.size())); ec)
        throw std::system_error(ec);

    // Read response
    std::string response;
    auto [ec, n] = co_await capy::read(
        secure, capy::string_dynamic_buffer(&response));

    // EOF expected when server closes
    if (ec && ec != capy::cond::eof)
        throw std::system_error(ec);

    std::cout << response << "\n";

    // Graceful shutdown
    co_await secure.shutdown();
}

capy::task<void> tls_server(
    corosio::io_context& ioc,
    std::uint16_t port)
{
    // Configure server TLS context
    tls_context ctx;
    ctx.use_certificate_chain_file("server-fullchain.pem");
    ctx.use_private_key_file("server.key", tls_file_format::pem);

    // Set up acceptor
    corosio::tcp_acceptor acc(ioc, corosio::endpoint(port));

    for (;;)
    {
        corosio::tcp_socket peer(ioc);
        auto [ec] = co_await acc.accept(peer);
        if (ec) break;

        // Spawn handler
        capy::run_async(ioc.get_executor())(
            handle_tls_client(std::move(peer), ctx));
    }
}

capy::task<void> handle_tls_client(
    corosio::tcp_socket sock,
    tls_context ctx)
{
    // Owning form: the handler owns the socket, so move it in
    corosio::wolfssl_stream secure(std::move(sock), ctx);

    auto [ec] = co_await secure.handshake(wolfssl_stream::server);
    if (ec)
        co_return;

    // Handle encrypted connection...
    char buf[1024];
    auto [read_ec, n] = co_await secure.read_some(
        capy::mutable_buffer(buf, sizeof(buf)));

    // Graceful shutdown
    co_await secure.shutdown();
}