//! The rustls crypto provider, and the one place an HTTP client is built.
//!
//! reqwest is compiled `rustls-no-provider` to keep aws-lc-rs (a C backend) out
//! of the tree, which means `ClientBuilder::build` fails unless a provider has
//! been installed process-wide first. Every client therefore comes from
//! [`client`], so the two cannot get out of order.

use std::time::Duration;

/// Install ring as the process-wide rustls crypto provider. Idempotent (guarded
/// by a `Once`), so `main` and the client builder can both call it.
pub(crate) fn install_crypto_provider() {
    static INSTALLED: std::sync::Once = std::sync::Once::new();
    INSTALLED.call_once(|| {
        let _ = rustls::crypto::ring::default_provider().install_default();
    });
}

/// An HTTP client with a provider guaranteed to be installed.
pub(crate) fn client(timeout: Duration) -> reqwest::Result<reqwest::Client> {
    install_crypto_provider();
    reqwest::Client::builder().timeout(timeout).build()
}