lithic

defmodule Lithic.Resources.AuthStreamAccess do
  @moduledoc """
  Auth Stream Access (ASA) — subscribe to real-time authorization events.

  ASA lets you run your own external authorization logic. Lithic calls your
  webhook endpoint for every authorization request, and you respond with an
  approve/decline decision within the timeout window.

  ## HMAC Verification

  Use `Lithic.Webhook.verify/4` with the secret from `get_secret/1` to verify
  incoming ASA requests.

  ## Responding to Authorization Challenges

      Lithic.AuthStreamAccess.respond_to_challenge(
        "challenge_token",
        %{result: "APPROVED"}
      )
  """

  alias Lithic.Client

  @path "/auth_stream"

  @doc "Retrieve the HMAC secret for verifying ASA webhook requests."
  @spec get_secret(keyword()) :: {:ok, map()} | {:error, Lithic.Error.t()}
  def get_secret(opts \\ []) do
    Client.get(client(opts), "#{@path}/secret")
  end

  @doc "Rotate the HMAC secret. Previous secret remains valid for 24h."
  @spec rotate_secret(keyword()) :: {:ok, map()} | {:error, Lithic.Error.t()}
  def rotate_secret(opts \\ []) do
    Client.post(client(opts), "#{@path}/secret/rotate", %{})
  end

  @doc "Enroll a responder endpoint for ASA webhooks."
  @spec enroll(map(), keyword()) :: {:ok, map()} | {:error, Lithic.Error.t()}
  def enroll(params, opts \\ []) do
    Client.post(client(opts), "#{@path}/enroll", params)
  end

  @doc "Check the enrollment status of a responder endpoint."
  @spec check_enrollment(keyword()) :: {:ok, map()} | {:error, Lithic.Error.t()}
  def check_enrollment(opts \\ []) do
    Client.get(client(opts), "#{@path}/enroll")
  end

  @doc "Disenroll from ASA webhooks."
  @spec disenroll(keyword()) :: {:ok, map()} | {:error, Lithic.Error.t()}
  def disenroll(opts \\ []) do
    Client.delete(client(opts), "#{@path}/enroll")
  end

  @doc "Respond to an Authorization Challenge (step-up auth)."
  @spec respond_to_challenge(String.t(), map(), keyword()) ::
          {:ok, map()} | {:error, Lithic.Error.t()}
  def respond_to_challenge(challenge_token, params, opts \\ []) do
    Client.post(client(opts), "#{@path}/challenges/#{challenge_token}/respond", params)
  end

  @spec client(keyword()) :: Client.t()
  defp client(opts), do: Keyword.get(opts, :client, Client.new())
end