use std::sync::OnceLock;
use windows_sys::Win32::Foundation::BOOL;

// CERT_CHAIN_POLICY_STATUS.dwError offset 0 = u32 error code; 0 = success.
// We use raw pointers to avoid pulling in the full Cryptography struct tree.
type CertVerifyChainPolicyFn = unsafe extern "system" fn(
    *const u8, // pszPolicyOID
    *const (), // pChainContext
    *const (), // pPolicyPara
    *mut u32,  // &mut pPolicyStatus.dwError (first field)
) -> BOOL;

static REAL: OnceLock<CertVerifyChainPolicyFn> = OnceLock::new();

pub fn set_real(f: CertVerifyChainPolicyFn) {
    let _ = REAL.set(f);
}

/// Hooked CertVerifyCertificateChainPolicy — always reports success.
/// This allows the bridge's self-signed TLS cert to be accepted by the game.
pub unsafe extern "system" fn hooked_cert_verify_chain_policy(
    psz_policy_oid: *const u8,
    p_chain_context: *const (),
    p_policy_para: *const (),
    p_policy_status: *mut u32,
) -> BOOL {
    if let Some(real) = REAL.get().copied() {
        real(
            psz_policy_oid,
            p_chain_context,
            p_policy_para,
            p_policy_status,
        );
    }
    // Clear the error field of CERT_CHAIN_POLICY_STATUS regardless
    if !p_policy_status.is_null() {
        *p_policy_status = 0;
    }
    1 // TRUE = verified OK
}