validateHubTls function

String? validateHubTls(ArgResults args)

Validates the Hub's TLS source — exactly one of --tls-dir or (--cert + --key), never neither (the Hub has no insecure mode). Returns the trimmed --tls-dir in directory mode, otherwise null.

Implementation

String? validateHubTls(ArgResults args) {
  final tlsDir = (args['tls-dir'] as String?)?.trim();
  final cert = args['cert'] as String?;
  final key = args['key'] as String?;
  final hasCertOrKey =
      (cert != null && cert.isNotEmpty) || (key != null && key.isNotEmpty);

  if (tlsDir != null && tlsDir.isNotEmpty) {
    if (hasCertOrKey) {
      throw CliError('use either --tls-dir or --cert/--key, not both');
    }
    if (!File('$tlsDir/fullchain.pem').existsSync() ||
        !File('$tlsDir/privkey.pem').existsSync()) {
      throw CliError(
        '--tls-dir "$tlsDir" must contain fullchain.pem and privkey.pem',
      );
    }
    return tlsDir;
  }

  if (cert == null || cert.isEmpty || key == null || key.isEmpty) {
    throw CliError(
      '--cert and --key are required unless --tls-dir is set '
      '(try: omnyserver cert gen)',
    );
  }
  return null;
}