use open_auth2::{
    ClientId, StateBuf,
    AddState,
    client::OAuth2Client,
    endpoints::{authorization::AuthorizationEndpoint, token::{TokenEndpoint, TokenResponse}},
    ext::pkce::{AddPkceChallenge, AddPkceVerifier, PkceCodeChallengeAndMethod},
    transport::HttpClient,
    client_id, code
};

// 1. Define your client.
struct MyClient;

impl OAuth2Client for MyClient {
    type TokenResponse = TokenResponse;

    fn client_id(&self) -> &ClientId {
        client_id!("my-client-id")
    }
}

async fn run(http_client: &impl HttpClient) -> Result<(), Box<dyn std::error::Error>> {
    let client = MyClient;
    let auth_uri = iref::Uri::new("https://auth.example.com/authorize")?;
    let token_uri = iref::Uri::new("https://auth.example.com/token")?;

    // 2. Generate PKCE challenge and state.
    let (pkce_challenge, pkce_verifier) = PkceCodeChallengeAndMethod::new_random_sha256();
    let state = StateBuf::new_random();

    // 3. Build the authorization redirect URL.
    let authorize_url = AuthorizationEndpoint::new(&client, auth_uri)
        .authorize_url(None, None)
        .with_state(Some(state))
        .with_pkce_challenge(pkce_challenge)
        .into_redirect_uri();

    println!("Open in browser: {authorize_url}");

    // 4. After the user is redirected back with a `code`, exchange it.
    let code = code!("received-code").to_owned();

    let token_response = TokenEndpoint::new(&client, token_uri)
        .exchange_code(code, None)
        .with_pkce_verifier(&pkce_verifier)
        .send(http_client)
        .await?;

    println!("Access token: {}", token_response.access_token);
    Ok(())
}