flwr_oauth2

-module(flwr_oauth2@pkce).
-compile([no_auto_import, nowarn_unused_vars, nowarn_unused_function, nowarn_nomatch, inline]).
-define(FILEPATH, "src/flwr_oauth2/pkce.gleam").
-export([to_http_request/1, to_string/1, new/0, to_challenge/1]).
-export_type([verifier/0, challenge/0, authorization_code_grant_token_request_with_p_k_c_e/0]).

-if(?OTP_RELEASE >= 27).
-define(MODULEDOC(Str), -moduledoc(Str)).
-define(DOC(Str), -doc(Str)).
-else.
-define(MODULEDOC(Str), -compile([])).
-define(DOC(Str), -compile([])).
-endif.

?MODULEDOC(" This module provides functions to create PKCE Verifiers and Challens as per [RFC7636](https://datatracker.ietf.org/doc/html/rfc7636).\n").

-type verifier() :: {verifier, binary()}.

-type challenge() :: {challenge, binary()}.

-type authorization_code_grant_token_request_with_p_k_c_e() :: {authorization_code_grant_token_request_with_p_k_c_e,
        gleam@uri:uri(),
        flwr_oauth2@authentication:client_authentication(),
        gleam@option:option(gleam@uri:uri()),
        binary(),
        binary()}.

-file("src/flwr_oauth2/pkce.gleam", 60).
-spec code_verifier_modifier(binary()) -> fun((gleam@http@request:request(list({binary(),
    binary()}))) -> {ok, gleam@http@request:request(list({binary(), binary()}))} |
    {error, any()}).
code_verifier_modifier(Code_verifier) ->
    fun(Req) -> _pipe = erlang:element(4, Req),
        _pipe@1 = lists:append(
            _pipe,
            [{<<"code_verifier"/utf8>>, Code_verifier}]
        ),
        _pipe@2 = gleam@http@request:set_body(Req, _pipe@1),
        {ok, _pipe@2} end.

-file("src/flwr_oauth2/pkce.gleam", 41).
-spec to_http_request(authorization_code_grant_token_request_with_p_k_c_e()) -> {ok,
        gleam@http@request:request(binary())} |
    {error, flwr_oauth2@token_request:request_error()}.
to_http_request(Request) ->
    {authorization_code_grant_token_request_with_p_k_c_e,
        Token_endpoint,
        Authentication,
        Redirect_uri,
        Code,
        Code_verifier} = Request,
    _pipe = {authorization_code_grant_token_request,
        Token_endpoint,
        Authentication,
        Redirect_uri,
        Code},
    flwr_oauth2@token_request:to_http_request_with_modifiers(
        _pipe,
        [code_verifier_modifier(Code_verifier)]
    ).

-file("src/flwr_oauth2/pkce.gleam", 71).
-spec to_string(authorization_code_grant_token_request_with_p_k_c_e()) -> binary().
to_string(Request) ->
    {authorization_code_grant_token_request_with_p_k_c_e,
        Token_endpoint,
        Auth,
        Redirect_uri,
        Code,
        Code_verifier} = Request,
    <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<"AuthorizationCodeGrantTokenRequestWithPKCE("/utf8,
                                                                "token_endpoint="/utf8>>/binary,
                                                            (gleam@uri:to_string(
                                                                Token_endpoint
                                                            ))/binary>>/binary,
                                                        ", "/utf8>>/binary,
                                                    "authentication="/utf8>>/binary,
                                                (flwr_oauth2@authentication:to_string(
                                                    Auth
                                                ))/binary>>/binary,
                                            ", "/utf8>>/binary,
                                        "redirect_uri="/utf8>>/binary,
                                    (begin
                                        _pipe = gleam@option:map(
                                            Redirect_uri,
                                            fun gleam@uri:to_string/1
                                        ),
                                        gleam@option:unwrap(
                                            _pipe,
                                            <<"None"/utf8>>
                                        )
                                    end)/binary>>/binary,
                                ", "/utf8>>/binary,
                            "code="/utf8>>/binary,
                        Code/binary>>/binary,
                    ", "/utf8>>/binary,
                "code_verifier="/utf8>>/binary,
            Code_verifier/binary>>/binary,
        ")"/utf8>>.

-file("src/flwr_oauth2/pkce.gleam", 106).
?DOC(
    " Creates a new code verifier as per [RFC7636 4.1](https://datatracker.ietf.org/doc/html/rfc7636#section-4.1).\n"
    " Uses a default length for the verifier of 128.\n"
    " \n"
    " For the definition of the code verifier see this excerpt from RFC7636:\n"
    " > high-entropy cryptographic random STRING using the\n"
    " > unreserved characters [A-Z] / [a-z] / [0-9] / \"-\" / \".\" / \"_\" / \"~\"\n"
    " > from Section 2.3 of [RFC3986], with a minimum length of 43 characters\n"
    " > and a maximum length of 128 characters.\n"
).
-spec new() -> verifier().
new() ->
    _pipe = flwr_oauth2@helpers:generate_random_string(
        <<"ABCDEFGHIJKLMNOPQRSTUVWXYZ"/utf8,
            "abcdefghijklmnopqrstuvwxyz"/utf8,
            "0123456789"/utf8,
            "-._~"/utf8>>,
        128
    ),
    {verifier, _pipe}.

-file("src/flwr_oauth2/pkce.gleam", 113).
?DOC(
    " Creates a code challenge from a given verifier.\n"
    " The given code verifier should conform to the RFC7636 definition of a code verifier, otherwise the resulting code challenge will be invalid.\n"
).
-spec to_challenge(verifier()) -> challenge().
to_challenge(Verifier) ->
    _pipe = erlang:element(2, Verifier),
    _pipe@1 = gleam_stdlib:identity(_pipe),
    _pipe@2 = gleam@crypto:hash(sha256, _pipe@1),
    _pipe@3 = gleam@bit_array:base64_url_encode(_pipe@2, false),
    {challenge, _pipe@3}.