<?php

declare(strict_types=1);

namespace GNexus\GAuth\OAuth;

use GNexus\GAuth\Config\GAuthConfig;

final readonly class AuthorizationUrlBuilder
{
    public function __construct(private GAuthConfig $config)
    {
    }

    /**
     * @param array<int, string> $scopes
     */
    public function build(string $state, string $pkceChallenge, ?string $returnTo = null, array $scopes = []): string
    {
        $query = [
            'response_type' => 'code',
            'client_id' => $this->config->clientId(),
            'redirect_uri' => $this->config->redirectUri(),
            'state' => $state,
            'code_challenge' => $pkceChallenge,
            'code_challenge_method' => 'S256',
        ];

        if ($scopes !== []) {
            $query['scope'] = implode(' ', $scopes);
        }

        if ($returnTo !== null && $returnTo !== '') {
            $query['return_to'] = $returnTo;
        }

        return $this->config->authorizeUrl() . '?' . http_build_query($query, arg_separator: '&', encoding_type: PHP_QUERY_RFC3986);
    }
}