-module(flwr_oauth2@assertions).
-compile([no_auto_import, nowarn_unused_vars, nowarn_unused_function, nowarn_nomatch, inline]).
-define(FILEPATH, "src/flwr_oauth2/assertions.gleam").
-export([to_http_request/1, to_saml_http_request/1, to_authentication/3, to_saml_authentication/2, to_jwt_http_request/1, to_jwt_authentication/2]).
-export_type([assertion_authorization_grant_request/0, preset_assertion_authorization_grant_request/0]).

-if(?OTP_RELEASE >= 27).
-define(MODULEDOC(Str), -moduledoc(Str)).
-define(DOC(Str), -doc(Str)).
-else.
-define(MODULEDOC(Str), -compile([])).
-define(DOC(Str), -compile([])).
-endif.

?MODULEDOC(
    " This module aims to implement [RFC7522](https://datatracker.ietf.org/doc/html/rfc7522) Security Assertion Markup Language (SAML) 2.0 Profile for OAuth 2.0 for OAuth 2.0 Client Authentication and Authorization Grants and [RFC7523](https://datatracker.ietf.org/doc/html/rfc7523) JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants.\n"
    " For more infomation on the Authorization Assertion Grant Type see [RFC7521](https://datatracker.ietf.org/doc/html/rfc7521).\n"
).

-type assertion_authorization_grant_request() :: {assertion_authorization_grant_request,
        gleam@uri:uri(),
        binary(),
        binary(),
        gleam@option:option(flwr_oauth2@authentication:client_authentication()),
        list(binary())}.

-type preset_assertion_authorization_grant_request() :: {preset_assertion_authorization_grant_request,
        gleam@uri:uri(),
        binary(),
        gleam@option:option(flwr_oauth2@authentication:client_authentication()),
        list(binary())}.

-file("src/flwr_oauth2/assertions.gleam", 107).
-spec to_http_request(assertion_authorization_grant_request()) -> {ok,
        gleam@http@request:request(binary())} |
    {error, flwr_oauth2@token_request:request_error()}.
to_http_request(Grant) ->
    Scope@1 = begin
        gleam@bool:guard(
            gleam@list:is_empty(erlang:element(6, Grant)),
            none,
            fun() ->
                Scope = begin
                    _pipe = erlang:element(6, Grant),
                    gleam@string:join(_pipe, <<" "/utf8>>)
                end,
                _pipe@1 = {<<"scope"/utf8>>, Scope},
                {some, _pipe@1}
            end
        )
    end,
    Body = begin
        _pipe@2 = [{<<"grant_type"/utf8>>, erlang:element(4, Grant)},
            {<<"assertion"/utf8>>, erlang:element(3, Grant)}],
        flwr_oauth2@helpers:add_if_present(_pipe@2, Scope@1)
    end,
    Auth_mods = case erlang:element(5, Grant) of
        {some, Auth} ->
            [flwr_oauth2@token_request:authorization_setter(Auth)];

        none ->
            []
    end,
    _pipe@3 = flwr_oauth2@token_request:setup_request(
        erlang:element(2, Grant),
        Body
    ),
    _pipe@4 = gleam@result:'try'(
        _pipe@3,
        fun(_capture) ->
            flwr_oauth2@token_request:apply_modifiers(_capture, Auth_mods)
        end
    ),
    gleam@result:map(
        _pipe@4,
        fun flwr_oauth2@token_request:request_body_to_string/1
    ).

-file("src/flwr_oauth2/assertions.gleam", 39).
-spec to_saml_http_request(preset_assertion_authorization_grant_request()) -> {ok,
        gleam@http@request:request(binary())} |
    {error, flwr_oauth2@token_request:request_error()}.
to_saml_http_request(Grant) ->
    {preset_assertion_authorization_grant_request,
        Token_endpoint,
        Assertion,
        Authentication,
        Scope} = Grant,
    _pipe = {assertion_authorization_grant_request,
        Token_endpoint,
        Assertion,
        <<"urn:ietf:params:oauth:grant-type:saml2-bearer"/utf8>>,
        Authentication,
        Scope},
    to_http_request(_pipe).

-file("src/flwr_oauth2/assertions.gleam", 95).
-spec to_authentication(flwr_oauth2@common:client_id(), binary(), binary()) -> flwr_oauth2@authentication:client_authentication().
to_authentication(Client_id, Client_assertion, Client_assertion_type) ->
    {client_assertion, Client_id, Client_assertion, Client_assertion_type}.

-file("src/flwr_oauth2/assertions.gleam", 58).
-spec to_saml_authentication(flwr_oauth2@common:client_id(), binary()) -> flwr_oauth2@authentication:client_authentication().
to_saml_authentication(Client_id, Client_assertion) ->
    to_authentication(
        Client_id,
        Client_assertion,
        <<"urn:ietf:params:oauth:client-assertion-type:saml2-bearer"/utf8>>
    ).

-file("src/flwr_oauth2/assertions.gleam", 69).
-spec to_jwt_http_request(preset_assertion_authorization_grant_request()) -> {ok,
        gleam@http@request:request(binary())} |
    {error, flwr_oauth2@token_request:request_error()}.
to_jwt_http_request(Grant) ->
    {preset_assertion_authorization_grant_request,
        Token_endpoint,
        Assertion,
        Authentication,
        Scope} = Grant,
    _pipe = {assertion_authorization_grant_request,
        Token_endpoint,
        Assertion,
        <<"urn:ietf:params:oauth:grant-type:jwt-bearer"/utf8>>,
        Authentication,
        Scope},
    to_http_request(_pipe).

-file("src/flwr_oauth2/assertions.gleam", 88).
-spec to_jwt_authentication(flwr_oauth2@common:client_id(), binary()) -> flwr_oauth2@authentication:client_authentication().
to_jwt_authentication(Client_id, Client_assertion) ->
    to_authentication(
        Client_id,
        Client_assertion,
        <<"urn:ietf:params:oauth:client-assertion-type:jwt-bearer"/utf8>>
    ).