defmodule WhoNeedHelp.GoogleAuth do
  @moduledoc """
  Provider boundary for Google OpenID Connect authentication.

  Provider access and ID tokens are consumed inside the adapter and are never
  returned to controllers or persisted by the application.
  """

  @type identity :: %{
          provider_uid: String.t(),
          email: String.t(),
          email_verified: true,
          display_name: String.t()
        }

  @callback enabled?() :: boolean()
  @callback authorize_url(String.t()) ::
              {:ok, %{url: String.t(), session_params: map()}} | {:error, term()}
  @callback callback(String.t(), map(), map()) :: {:ok, identity()} | {:error, term()}

  def enabled?, do: adapter().enabled?()

  def authorize_url(redirect_uri), do: adapter().authorize_url(redirect_uri)

  def callback(redirect_uri, params, session_params),
    do: adapter().callback(redirect_uri, params, session_params)

  defp adapter do
    Application.get_env(
      :who_need_help,
      :google_auth_adapter,
      WhoNeedHelp.GoogleAuth.AssentAdapter
    )
  end
end
