atproto_client

-module(atproto@oauth@resource).
-compile([no_auto_import, nowarn_unused_vars, nowarn_unused_function, nowarn_nomatch, inline]).
-define(FILEPATH, "src/atproto/oauth/resource.gleam").
-export([client/3]).

-if(?OTP_RELEASE >= 27).
-define(MODULEDOC(Str), -moduledoc(Str)).
-define(DOC(Str), -doc(Str)).
-else.
-define(MODULEDOC(Str), -compile([])).
-define(DOC(Str), -compile([])).
-endif.

?MODULEDOC(
    " DPoP-authenticated resource requests: wraps a transport so every request\n"
    " carries `Authorization: DPoP <token>` and a proof bound to its method, URL,\n"
    " and access-token hash, with the server-nonce retry. Token refresh is the\n"
    " caller's job (it owns session persistence); this module only signs.\n"
    "\n"
    " A thin sync wrapper over the effect kernel in `atproto/oauth/core/resource`:\n"
    " it computes the access-token hash (`ath`) once and runs the per-request\n"
    " signing effect against the base client.\n"
).

-file("src/atproto/oauth/resource.gleam", 32).
-spec base64url(bitstring()) -> binary().
base64url(Bits) ->
    gleam@bit_array:base64_url_encode(Bits, false).

-file("src/atproto/oauth/resource.gleam", 19).
?DOC(" A client that signs every request against the given DPoP-bound access token.\n").
-spec client(atproto@xrpc:client(), binary(), gose:key(binary())) -> atproto@xrpc:client().
client(Base, Access_token, Dpop_key) ->
    Ath = base64url(
        gleam@crypto:hash(sha256, gleam_stdlib:identity(Access_token))
    ),
    {client,
        fun(Req) ->
            _pipe = atproto@oauth@runner:run(
                atproto@oauth@core@resource:send(Req, Access_token, Ath),
                Base,
                Dpop_key
            ),
            gleam@result:map_error(_pipe, fun(Field@0) -> {other, Field@0} end)
        end}.