flwr_oauth2

-module(flwr_oauth2@pkce).
-compile([no_auto_import, nowarn_unused_vars, nowarn_unused_function, nowarn_nomatch, inline]).
-define(FILEPATH, "src/flwr_oauth2/pkce.gleam").
-export([to_challenge/1, new/0]).
-export_type([verifier/0, challenge/0]).

-if(?OTP_RELEASE >= 27).
-define(MODULEDOC(Str), -moduledoc(Str)).
-define(DOC(Str), -doc(Str)).
-else.
-define(MODULEDOC(Str), -compile([])).
-define(DOC(Str), -compile([])).
-endif.

?MODULEDOC(" This module provides functions to create PKCE Verifiers and Challens as per [RFC7636](https://datatracker.ietf.org/doc/html/rfc7636).\n").

-type verifier() :: {verifier, binary()}.

-type challenge() :: {challenge, binary()}.

-file("src/flwr_oauth2/pkce.gleam", 37).
?DOC(
    " Creates a code challenge from a given verifier.\n"
    " The given code verifier should conform to the RFC7636 definition of a code verifier, otherwise the resulting code challenge will be invalid.\n"
).
-spec to_challenge(verifier()) -> challenge().
to_challenge(Verifier) ->
    _pipe = erlang:element(2, Verifier),
    _pipe@1 = gleam_stdlib:identity(_pipe),
    _pipe@2 = gleam@crypto:hash(sha256, _pipe@1),
    _pipe@3 = gleam@bit_array:base64_url_encode(_pipe@2, false),
    {challenge, _pipe@3}.

-file("src/flwr_oauth2/pkce.gleam", 30).
?DOC(
    " Creates a new code verifier as per [RFC7636 4.1](https://datatracker.ietf.org/doc/html/rfc7636#section-4.1).\n"
    " Uses a default length for the verifier of 128.\n"
    " \n"
    " For the definition of the code verifier see this excerpt from RFC7636:\n"
    " > high-entropy cryptographic random STRING using the\n"
    " > unreserved characters [A-Z] / [a-z] / [0-9] / \"-\" / \".\" / \"_\" / \"~\"\n"
    " > from Section 2.3 of [RFC3986], with a minimum length of 43 characters\n"
    " > and a maximum length of 128 characters.\n"
).
-spec new() -> verifier().
new() ->
    _pipe = flwr_oauth2@helpers:generate_random_string(
        <<"ABCDEFGHIJKLMNOPQRSTUVWXYZ"/utf8,
            "abcdefghijklmnopqrstuvwxyz"/utf8,
            "0123456789"/utf8,
            "-._~"/utf8>>,
        128
    ),
    {verifier, _pipe}.