//! Process-wide rustls crypto provider.
//!
//! Every HTTPS client in the graph (reqwest, object_store, async-nats,
//! k-ap) is built without a bundled provider so the binaries link `ring`
//! only. rustls therefore needs one installed before the first client is
//! built, or client construction panics.

use std::sync::Once;

/// Installs `ring` as the process default. Idempotent; a provider installed
/// earlier by someone else is left in place.
pub fn install_crypto_provider() {
    static INSTALL: Once = Once::new();
    INSTALL.call_once(|| {
        let _ = rustls::crypto::ring::default_provider().install_default();
    });
}

#[cfg(test)]
mod tests {
    use super::*;

    /// Only test in this crate's lib test binary, so nothing else in this
    /// process installs a provider before `install_crypto_provider` runs.
    #[test]
    fn https_client_builds_after_install() {
        install_crypto_provider();
        install_crypto_provider();
        reqwest::Client::builder()
            .build()
            .expect("reqwest client builds");
        assert!(rustls::crypto::CryptoProvider::get_default().is_some());
    }
}