"context"

	"math"

	"sync"

	if len(b) == 0 || string(b) == "null" {

		return nil

	}

	if i > math.MaxInt32 {

		i = math.MaxInt32

	}

// RegisterBrokenAuthHeaderProvider previously did something. It is now a no-op.

//

// Deprecated: this function no longer does anything. Caller code that

// wants to avoid potential extra HTTP requests made during

// auto-probing of the provider's auth style should set

// Endpoint.AuthStyle.

func RegisterBrokenAuthHeaderProvider(tokenURL string) {}

// AuthStyle is a copy of the golang.org/x/oauth2 package's AuthStyle type.

type AuthStyle int

const (

	AuthStyleUnknown  AuthStyle = 0

	AuthStyleInParams AuthStyle = 1

	AuthStyleInHeader AuthStyle = 2

)

// authStyleCache is the set of tokenURLs we've successfully used via

// RetrieveToken and which style auth we ended up using.

// It's called a cache, but it doesn't (yet?) shrink. It's expected that

// the set of OAuth2 servers a program contacts over time is fixed and

// small.

var authStyleCache struct {

	sync.Mutex

	m map[string]AuthStyle // keyed by tokenURL

// ResetAuthCache resets the global authentication style cache used

// for AuthStyleUnknown token requests.

func ResetAuthCache() {

	authStyleCache.Lock()

	defer authStyleCache.Unlock()

	authStyleCache.m = nil

// lookupAuthStyle reports which auth style we last used with tokenURL

// when calling RetrieveToken and whether we have ever done so.

func lookupAuthStyle(tokenURL string) (style AuthStyle, ok bool) {

	authStyleCache.Lock()

	defer authStyleCache.Unlock()

	style, ok = authStyleCache.m[tokenURL]

	return

// setAuthStyle adds an entry to authStyleCache, documented above.

func setAuthStyle(tokenURL string, v AuthStyle) {

	authStyleCache.Lock()

	defer authStyleCache.Unlock()

	if authStyleCache.m == nil {

		authStyleCache.m = make(map[string]AuthStyle)

	authStyleCache.m[tokenURL] = v

// newTokenRequest returns a new *http.Request to retrieve a new token

// from tokenURL using the provided clientID, clientSecret, and POST

// body parameters.

//

// inParams is whether the clientID & clientSecret should be encoded

// as the POST body. An 'inParams' value of true means to send it in

// the POST body (along with any values in v); false means to send it

// in the Authorization header.

func newTokenRequest(tokenURL, clientID, clientSecret string, v url.Values, authStyle AuthStyle) (*http.Request, error) {

	if authStyle == AuthStyleInParams {

		v = cloneURLValues(v)

	if authStyle == AuthStyleInHeader {

	return req, nil

}

func cloneURLValues(v url.Values) url.Values {

	v2 := make(url.Values, len(v))

	for k, vv := range v {

		v2[k] = append([]string(nil), vv...)

	}

	return v2

}

func RetrieveToken(ctx context.Context, clientID, clientSecret, tokenURL string, v url.Values, authStyle AuthStyle) (*Token, error) {

	needsAuthStyleProbe := authStyle == 0

	if needsAuthStyleProbe {

		if style, ok := lookupAuthStyle(tokenURL); ok {

			authStyle = style

			needsAuthStyleProbe = false

		} else {

			authStyle = AuthStyleInHeader // the first way we'll try

		}

	}

	req, err := newTokenRequest(tokenURL, clientID, clientSecret, v, authStyle)

	if err != nil {

		return nil, err

	}

	token, err := doTokenRoundTrip(ctx, req)

	if err != nil && needsAuthStyleProbe {

		// If we get an error, assume the server wants the

		// clientID & clientSecret in a different form.

		// See https://code.google.com/p/goauth2/issues/detail?id=31 for background.

		// In summary:

		// - Reddit only accepts client secret in the Authorization header

		// - Dropbox accepts either it in URL param or Auth header, but not both.

		// - Google only accepts URL param (not spec compliant?), not Auth header

		// - Stripe only accepts client secret in Auth header with Bearer method, not Basic

		//

		// We used to maintain a big table in this code of all the sites and which way

		// they went, but maintaining it didn't scale & got annoying.

		// So just try both ways.

		authStyle = AuthStyleInParams // the second way we'll try

		req, _ = newTokenRequest(tokenURL, clientID, clientSecret, v, authStyle)

		token, err = doTokenRoundTrip(ctx, req)

	}

	if needsAuthStyleProbe && err == nil {

		setAuthStyle(tokenURL, authStyle)

	}

	// Don't overwrite `RefreshToken` with an empty value

	// if this was a token refreshing request.

	if token != nil && token.RefreshToken == "" {

		token.RefreshToken = v.Get("refresh_token")

	}

	return token, err

}

func doTokenRoundTrip(ctx context.Context, req *http.Request) (*Token, error) {

	r.Body.Close()

		return nil, errors.New("oauth2: server response missing access_token")