defmodule AshAtproto.Auth do
  @entity %Spark.Dsl.Entity{
    name: :atproto,
    describe: "Strategy which allows authentication through atproto's oauth.",
    examples: [
      """
      atproto do
        registration_enabled? true

        base_url MyApp.GetSecret
        private_key MyApp.GetSecret
        key_id MyApp.GetSecret
        scopes MyApp.GetSecret
        extra_redirect_uris MyApp.GetSecret
      end
      """
    ],
    target: __MODULE__,
    args: [{:optional, :name, :atproto}],
    schema: [
      name: [
        type: :atom,
        doc: """
        The strategy name.
        """,
        required: true
      ],
      registration_enabled?: [
        type: :boolean,
        doc:
          "If enabled, new users will be able to register for your site when authenticating and not already present. If not, only existing users will be able to authenticate.",
        default: true
      ],
      register_action_name: [
        type: :atom,
        doc:
          "The name of the action to use to register a user, if `registration_enabled?` is `true`. Defaults to `register_with_<name>` See the \"Registration and Sign-in\" section of the strategy docs for more.",
        required: false
      ],
      sign_in_action_name: [
        type: :atom,
        doc:
          "The name of the action to use to sign in an existing user, if `sign_in_enabled?` is `true`. Defaults to `sign_in_with_<strategy>`, which is generated for you by default. See the \"Registration and Sign-in\" section of the strategy docs for more information.",
        required: false
      ],
      identity_resource: [
        type: {:or, [{:behaviour, Ash.Resource}, {:in, [false]}]},
        doc:
          "The resource used to store user identities, or `false` to disable. See the User Identities section of the strategy docs for more.",
        default: false
      ],
      identity_relationship_name: [
        type: :atom,
        doc: "Name of the relationship to the provider identities resource",
        default: :identities
      ],
      identity_relationship_user_id_attribute: [
        type: :atom,
        doc:
          "The name of the destination (user_id) attribute on your provider identity resource. Only necessary if you've changed the `user_id_attribute_name` option of the provider identity.",
        default: :user_id
      ],
      base_url: [
        type: AshAuthentication.Dsl.secret_type(),
        doc: "Your application's base URL, including the path the Auth controller is mounted on.",
        required: true
      ],
      private_key: [
        type: AshAuthentication.Dsl.secret_type(),
        doc: "ES256 private key.",
        required: true
      ],
      key_id: [
        type: AshAuthentication.Dsl.secret_type(),
        doc: "Key identifier for JWTs.",
        required: true
      ],
      scopes: [
        type: AshAuthentication.Dsl.secret_list_type(),
        doc: "Optional additional scopes.",
        default: []
      ],
      extra_redirect_uris: [
        type: AshAuthentication.Dsl.secret_list_type(),
        doc: "Optional additional redirect URIs.",
        default: []
      ]
    ]
  }

  defstruct name: :atproto,
            registration_enabled?: true,
            register_action_name: nil,
            sign_in_action_name: nil,
            identity_resource: nil,
            identity_relationship_name: nil,
            identity_relationship_user_id_attribute: nil,
            base_url: nil,
            private_key: nil,
            key_id: nil,
            scopes: nil,
            extra_redirect_uris: nil,
            resource: nil,
            __spark_metadata__: nil

  use AshAuthentication.Strategy.Custom, entity: @entity

  defdelegate transform(strategy, dsl_state), to: AshAtproto.Auth.Transformer
end