acumen

-module(acumen@internal@jws).
-compile([no_auto_import, nowarn_unused_vars, nowarn_unused_function, nowarn_nomatch, inline]).
-define(FILEPATH, "src/acumen/internal/jws.gleam").
-export([sign_eab/4, sign_with_kid/5, sign_key_change_inner/3, sign_with_jwk/4]).

-if(?OTP_RELEASE >= 27).
-define(MODULEDOC(Str), -moduledoc(Str)).
-define(DOC(Str), -doc(Str)).
-else.
-define(MODULEDOC(Str), -compile([])).
-define(DOC(Str), -compile([])).
-endif.

?MODULEDOC(false).

-file("src/acumen/internal/jws.gleam", 65).
?DOC(false).
-spec algorithm_for_ec_key(gose:key(binary())) -> {ok, gose:signing_alg()} |
    {error, binary()}.
algorithm_for_ec_key(Key) ->
    gleam@result:'try'(
        begin
            _pipe = gose:ec_curve(Key),
            gleam@result:replace_error(_pipe, <<"failed to get EC curve"/utf8>>)
        end,
        fun(Curve) -> case Curve of
                p256 ->
                    {ok, {digital_signature, {ecdsa, ecdsa_p256}}};

                p384 ->
                    {ok, {digital_signature, {ecdsa, ecdsa_p384}}};

                p521 ->
                    {ok, {digital_signature, {ecdsa, ecdsa_p521}}};

                secp256k1 ->
                    {error,
                        <<"Secp256k1 is not supported for ACME JWS signing"/utf8>>}
            end end
    ).

-file("src/acumen/internal/jws.gleam", 79).
?DOC(false).
-spec algorithm_for_key(gose:key(binary())) -> {ok, gose:signing_alg()} |
    {error, binary()}.
algorithm_for_key(Key) ->
    case gose:key_type(Key) of
        ec_key_type ->
            algorithm_for_ec_key(Key);

        rsa_key_type ->
            {ok, {digital_signature, {rsa_pkcs1, rsa_pkcs1_sha256}}};

        okp_key_type ->
            {ok, {digital_signature, eddsa}};

        oct_key_type ->
            {error, <<"symmetric keys not supported for ACME"/utf8>>}
    end.

-file("src/acumen/internal/jws.gleam", 89).
?DOC(false).
-spec set_header(
    gose@jose@jws:jws(gose@jose@jws:unsigned(), gose@jose@jws:built()),
    binary(),
    gleam@json:json()
) -> {ok, gose@jose@jws:jws(gose@jose@jws:unsigned(), gose@jose@jws:built())} |
    {error, binary()}.
set_header(Unsigned, Name, Value) ->
    _pipe = gose@jose@jws:with_header(Unsigned, Name, Value),
    gleam@result:map_error(
        _pipe,
        fun acumen@internal@utils:gose_error_to_string/1
    ).

-file("src/acumen/internal/jws.gleam", 98).
?DOC(false).
-spec sign_and_serialize(
    gose@jose@jws:jws(gose@jose@jws:unsigned(), gose@jose@jws:built()),
    gose:key(binary()),
    binary()
) -> {ok, gleam@json:json()} | {error, binary()}.
sign_and_serialize(Unsigned, Key, Payload) ->
    _pipe = gose@jose@jws:sign(Unsigned, Key, gleam_stdlib:identity(Payload)),
    _pipe@1 = gleam@result:map(
        _pipe,
        fun gose@jose@jws:serialize_json_flattened/1
    ),
    gleam@result:map_error(
        _pipe@1,
        fun acumen@internal@utils:gose_error_to_string/1
    ).

-file("src/acumen/internal/jws.gleam", 11).
?DOC(false).
-spec sign_eab(bitstring(), binary(), binary(), acumen@url:url()) -> {ok,
        gleam@json:json()} |
    {error, binary()}.
sign_eab(Mac_key, Kid, Payload, Url) ->
    gleam@result:'try'(
        begin
            _pipe = gose:from_octet_bits(Mac_key),
            gleam@result:map_error(
                _pipe,
                fun acumen@internal@utils:gose_error_to_string/1
            )
        end,
        fun(Key) ->
            Url@1 = acumen@url:to_string(Url),
            _pipe@1 = gose@jose@jws:new({mac, {hmac, hmac_sha256}}),
            _pipe@2 = gose@jose@jws:with_kid(_pipe@1, Kid),
            _pipe@3 = set_header(
                _pipe@2,
                <<"url"/utf8>>,
                gleam@json:string(Url@1)
            ),
            gleam@result:'try'(
                _pipe@3,
                fun(_capture) -> sign_and_serialize(_capture, Key, Payload) end
            )
        end
    ).

-file("src/acumen/internal/jws.gleam", 108).
?DOC(false).
-spec sign_request(
    gose:key(binary()),
    binary(),
    binary(),
    acumen@url:url(),
    fun((gose@jose@jws:jws(gose@jose@jws:unsigned(), gose@jose@jws:built())) -> {ok,
            gose@jose@jws:jws(gose@jose@jws:unsigned(), gose@jose@jws:built())} |
        {error, binary()})
) -> {ok, binary()} | {error, binary()}.
sign_request(Key, Payload, Nonce, Url, With_identity) ->
    gleam@result:'try'(
        algorithm_for_key(Key),
        fun(Alg) ->
            Url@1 = acumen@url:to_string(Url),
            _pipe = gose@jose@jws:new(Alg),
            _pipe@1 = set_header(
                _pipe,
                <<"nonce"/utf8>>,
                gleam@json:string(Nonce)
            ),
            _pipe@2 = gleam@result:'try'(
                _pipe@1,
                fun(_capture) ->
                    set_header(
                        _capture,
                        <<"url"/utf8>>,
                        gleam@json:string(Url@1)
                    )
                end
            ),
            _pipe@3 = gleam@result:'try'(_pipe@2, With_identity),
            _pipe@4 = gleam@result:'try'(
                _pipe@3,
                fun(_capture@1) ->
                    sign_and_serialize(_capture@1, Key, Payload)
                end
            ),
            gleam@result:map(_pipe@4, fun gleam@json:to_string/1)
        end
    ).

-file("src/acumen/internal/jws.gleam", 52).
?DOC(false).
-spec sign_with_kid(
    gose:key(binary()),
    acumen@url:url(),
    binary(),
    binary(),
    acumen@url:url()
) -> {ok, binary()} | {error, binary()}.
sign_with_kid(Key, Kid, Payload, Nonce, Url) ->
    Kid_string = acumen@url:to_string(Kid),
    sign_request(
        Key,
        Payload,
        Nonce,
        Url,
        fun(Unsigned) -> {ok, gose@jose@jws:with_kid(Unsigned, Kid_string)} end
    ).

-file("src/acumen/internal/jws.gleam", 127).
?DOC(false).
-spec with_jwk_identity(
    gose@jose@jws:jws(gose@jose@jws:unsigned(), gose@jose@jws:built()),
    gose:key(binary())
) -> {ok, gose@jose@jws:jws(gose@jose@jws:unsigned(), gose@jose@jws:built())} |
    {error, binary()}.
with_jwk_identity(Unsigned, Key) ->
    gleam@result:'try'(
        begin
            _pipe = gose:public_key(Key),
            gleam@result:map_error(
                _pipe,
                fun acumen@internal@utils:gose_error_to_string/1
            )
        end,
        fun(Public_key) ->
            set_header(
                Unsigned,
                <<"jwk"/utf8>>,
                gose@jose@jwk:to_json(Public_key)
            )
        end
    ).

-file("src/acumen/internal/jws.gleam", 29).
?DOC(false).
-spec sign_key_change_inner(gose:key(binary()), binary(), acumen@url:url()) -> {ok,
        gleam@json:json()} |
    {error, binary()}.
sign_key_change_inner(New_key, Payload, Url) ->
    gleam@result:'try'(
        algorithm_for_key(New_key),
        fun(Alg) ->
            Url@1 = acumen@url:to_string(Url),
            _pipe = gose@jose@jws:new(Alg),
            _pipe@1 = set_header(
                _pipe,
                <<"url"/utf8>>,
                gleam@json:string(Url@1)
            ),
            _pipe@2 = gleam@result:'try'(
                _pipe@1,
                fun(_capture) -> with_jwk_identity(_capture, New_key) end
            ),
            gleam@result:'try'(
                _pipe@2,
                fun(_capture@1) ->
                    sign_and_serialize(_capture@1, New_key, Payload)
                end
            )
        end
    ).

-file("src/acumen/internal/jws.gleam", 43).
?DOC(false).
-spec sign_with_jwk(gose:key(binary()), binary(), binary(), acumen@url:url()) -> {ok,
        binary()} |
    {error, binary()}.
sign_with_jwk(Key, Payload, Nonce, Url) ->
    sign_request(
        Key,
        Payload,
        Nonce,
        Url,
        fun(_capture) -> with_jwk_identity(_capture, Key) end
    ).