package cursor

import (
	"cursor/internal/certs"
	"fmt"
)

// migrateCATrust verifies both sides of the migration. Removing the legacy
// trust is necessary because its private key has already been public.
func migrateCATrust(cert []byte, trusted func([]byte) (bool, error), migrate func() error) error {
	current, err := trusted(cert)
	if err != nil {
		return err
	}
	legacy, err := trusted(certs.EmbeddedCACertPEM())
	if err != nil {
		return err
	}
	if current && !legacy {
		return nil
	}
	if err := migrate(); err != nil {
		return err
	}
	current, err = trusted(cert)
	if err != nil {
		return err
	}
	legacy, err = trusted(certs.EmbeddedCACertPEM())
	if err != nil {
		return err
	}
	if !current || legacy {
		return fmt.Errorf("证书迁移未完成：需要信任本机 CA 并移除旧共享 CA；请重试授权")
	}
	return nil
}