-module(glitch@api@auth).
-compile([no_auto_import, nowarn_unused_vars, nowarn_unused_function, nowarn_nomatch]).

-export([new_authorization_code_grant_request/4, new_client_credentials_grant_request/2, new_refresh_token_grant_request/3, get_token/1, refresh_token/1, validate_token/1]).
-export_type([get_token_request/0, validate_token_response/0]).

-opaque get_token_request() :: {authorization_code_grant,
        binary(),
        binary(),
        binary(),
        glitch@types@grant:grant_type(),
        gleam@uri:uri()} |
    {client_credentials_grant,
        binary(),
        binary(),
        glitch@types@grant:grant_type()} |
    {refresh_token_grant,
        binary(),
        binary(),
        glitch@types@grant:grant_type(),
        binary()}.

-type validate_token_response() :: {validate_token_response,
        binary(),
        binary(),
        list(glitch@types@scope:scope()),
        binary(),
        integer()}.

-spec new_authorization_code_grant_request(
    binary(),
    binary(),
    binary(),
    gleam@uri:uri()
) -> get_token_request().
new_authorization_code_grant_request(
    Client_id,
    Client_secret,
    Code,
    Redirect_uri
) ->
    {authorization_code_grant,
        Client_id,
        Client_secret,
        Code,
        authorization_code,
        Redirect_uri}.

-spec new_client_credentials_grant_request(binary(), binary()) -> get_token_request().
new_client_credentials_grant_request(Client_id, Client_secret) ->
    {client_credentials_grant, Client_id, Client_secret, client_credentials}.

-spec new_refresh_token_grant_request(binary(), binary(), binary()) -> get_token_request().
new_refresh_token_grant_request(Client_id, Client_secret, Refresh_token) ->
    {refresh_token_grant,
        Client_id,
        Client_secret,
        refresh_token,
        Refresh_token}.

-spec get_token_request_to_form_data(get_token_request()) -> binary().
get_token_request_to_form_data(Get_token_request) ->
    _pipe = case Get_token_request of
        {authorization_code_grant,
            Client_id,
            Client_secret,
            Code,
            Grant_type,
            Redirect_uri} ->
            [{<<"client_id"/utf8>>, Client_id},
                {<<"client_secret"/utf8>>, Client_secret},
                {<<"code"/utf8>>, Code},
                {<<"grant_type"/utf8>>,
                    glitch@types@grant:to_string(Grant_type)},
                {<<"redirect_uri"/utf8>>, gleam@uri:to_string(Redirect_uri)}];

        {client_credentials_grant, Client_id@1, Client_secret@1, Grant_type@1} ->
            [{<<"client_id"/utf8>>, Client_id@1},
                {<<"client_secret"/utf8>>, Client_secret@1},
                {<<"grant_type"/utf8>>,
                    glitch@types@grant:to_string(Grant_type@1)}];

        {refresh_token_grant,
            Client_id@2,
            Client_secret@2,
            Grant_type@2,
            Refresh_token} ->
            [{<<"client_id"/utf8>>, Client_id@2},
                {<<"client_secret"/utf8>>, Client_secret@2},
                {<<"grant_type"/utf8>>,
                    glitch@types@grant:to_string(Grant_type@2)},
                {<<"refresh_token"/utf8>>,
                    gleam@uri:percent_encode(Refresh_token)}]
    end,
    gleam@uri:query_to_string(_pipe).

-spec get_token(get_token_request()) -> {ok,
        glitch@types@access_token:access_token()} |
    {error, glitch@error:twitch_error()}.
get_token(Get_token_request) ->
    case Get_token_request of
        {refresh_token_grant, _, _, _, _} ->
            {error, {auth_error, invalid_get_token_request}};

        _ ->
            _pipe = glitch@api@api_request:new_auth_request(),
            _pipe@1 = glitch@api@api_request:set_body(
                _pipe,
                get_token_request_to_form_data(Get_token_request)
            ),
            _pipe@2 = glitch@api@api_request:set_path(
                _pipe@1,
                <<"oauth2/token"/utf8>>
            ),
            _pipe@3 = glitch@api@api_request:set_header(
                _pipe@2,
                {<<"content-type"/utf8>>,
                    <<"application/x-www-form-urlencoded"/utf8>>}
            ),
            _pipe@4 = glitch@api@api_request:set_method(_pipe@3, post),
            _pipe@5 = glitch@api@api:send(_pipe@4),
            gleam@result:'try'(
                _pipe@5,
                fun(_capture) ->
                    glitch@api@api_response:get_data(
                        _capture,
                        glitch@types@access_token:decoder()
                    )
                end
            )
    end.

-spec refresh_token(get_token_request()) -> {ok,
        glitch@types@access_token:access_token()} |
    {error, glitch@error:twitch_error()}.
refresh_token(Get_token_request) ->
    case Get_token_request of
        {refresh_token_grant, _, _, _, _} ->
            _pipe = glitch@api@api_request:new_auth_request(),
            _pipe@1 = glitch@api@api_request:set_body(
                _pipe,
                get_token_request_to_form_data(Get_token_request)
            ),
            _pipe@2 = glitch@api@api_request:set_path(
                _pipe@1,
                <<"oauth2/token"/utf8>>
            ),
            _pipe@3 = glitch@api@api_request:set_header(
                _pipe@2,
                {<<"content-type"/utf8>>,
                    <<"application/x-www-form-urlencoded"/utf8>>}
            ),
            _pipe@4 = glitch@api@api_request:set_method(_pipe@3, post),
            _pipe@5 = glitch@api@api:send(_pipe@4),
            gleam@result:'try'(
                _pipe@5,
                fun(_capture) ->
                    glitch@api@api_response:get_data(
                        _capture,
                        glitch@types@access_token:decoder()
                    )
                end
            );

        _ ->
            {error, {auth_error, invalid_get_token_request}}
    end.

-spec validate_token_response_decoder() -> fun((gleam@dynamic:dynamic_()) -> {ok,
        validate_token_response()} |
    {error, list(gleam@dynamic:decode_error())}).
validate_token_response_decoder() ->
    fun(Data) -> _pipe = Data,
        (gleam@dynamic:decode5(
            fun(Field@0, Field@1, Field@2, Field@3, Field@4) -> {validate_token_response, Field@0, Field@1, Field@2, Field@3, Field@4} end,
            gleam@dynamic:field(
                <<"client_id"/utf8>>,
                fun gleam@dynamic:string/1
            ),
            gleam@dynamic:field(<<"login"/utf8>>, fun gleam@dynamic:string/1),
            gleam@dynamic:field(
                <<"scopes"/utf8>>,
                gleam@dynamic:list(glitch@types@scope:decoder())
            ),
            gleam@dynamic:field(<<"user_id"/utf8>>, fun gleam@dynamic:string/1),
            gleam@dynamic:field(<<"expires_in"/utf8>>, fun gleam@dynamic:int/1)
        ))(_pipe) end.

-spec validate_token(glitch@types@access_token:access_token()) -> {ok,
        validate_token_response()} |
    {error, glitch@error:twitch_error()}.
validate_token(Access_token) ->
    _pipe = glitch@api@api_request:new_auth_request(),
    _pipe@1 = glitch@api@api_request:set_path(_pipe, <<"oauth2/validate"/utf8>>),
    _pipe@2 = glitch@api@api_request:set_header(
        _pipe@1,
        {<<"Authorization"/utf8>>,
            <<"OAuth "/utf8,
                (glitch@types@access_token:token(Access_token))/binary>>}
    ),
    _pipe@3 = glitch@api@api_request:set_method(_pipe@2, get),
    _pipe@4 = glitch@api@api:send(_pipe@3),
    gleam@result:'try'(
        _pipe@4,
        fun(_capture) ->
            glitch@api@api_response:get_data(
                _capture,
                validate_token_response_decoder()
            )
        end
    ).