import("//build/config/rust.gni")
import("//third_party/protobuf/proto_library.gni")

config("anonymous_tokens_config") {
  include_dirs = [
    "overrides",
    "src",
  ]
}

source_set("anonymous_tokens_public_key_client") {
  sources = [
    "src/anonymous_tokens/cpp/client/anonymous_tokens_public_key_client.cc",
    "src/anonymous_tokens/cpp/client/anonymous_tokens_public_key_client.h",
  ]

  public_configs = [ ":anonymous_tokens_config" ]

  deps = [
    ":proto_utils",
    ":status_utils",
  ]
  public_deps = [
    ":anonymous_tokens_cc_proto",
    "//third_party/abseil-cpp:absl",
  ]
}

source_set("anonymous_tokens_rsa_bssa_client") {
  sources = [
    "src/anonymous_tokens/cpp/client/anonymous_tokens_rsa_bssa_client.cc",
    "src/anonymous_tokens/cpp/client/anonymous_tokens_rsa_bssa_client.h",
  ]

  public_configs = [ ":anonymous_tokens_config" ]

  deps = [
    ":anonymous_tokens_pb_openssl_converters",
    ":crypto_utils",
    ":rsa_blinder",
    ":status_utils",
  ]
  public_deps = [
    ":anonymous_tokens_cc_proto",
    ":proto_utils",
    ":rsa_ssa_pss_verifier",
    "//third_party/abseil-cpp:absl",
  ]
}

source_set("anonymous_tokens_redemption_client") {
  sources = [
    "src/anonymous_tokens/cpp/client/anonymous_tokens_redemption_client.cc",
    "src/anonymous_tokens/cpp/client/anonymous_tokens_redemption_client.h",
  ]

  public_configs = [ ":anonymous_tokens_config" ]

  deps = [ ":constants" ]
  public_deps = [
    ":anonymous_tokens_cc_proto",
    "//third_party/abseil-cpp:absl",
  ]
}

source_set("anonymous_tokens_pb_openssl_converters") {
  sources = [
    "src/anonymous_tokens/cpp/crypto/anonymous_tokens_pb_openssl_converters.cc",
    "src/anonymous_tokens/cpp/crypto/anonymous_tokens_pb_openssl_converters.h",
  ]

  public_configs = [ ":anonymous_tokens_config" ]

  deps = [
    ":anonymous_tokens_cc_proto",
    ":constants",
    ":crypto_utils",
    ":status_utils",
    "//third_party/abseil-cpp:absl",
    "//third_party/boringssl",
  ]
  public_deps = [
    ":anonymous_tokens_cc_proto",
    "//third_party/abseil-cpp:absl",
  ]
}

proto_library("anonymous_tokens_cc_proto") {
  sources = [ "src/anonymous_tokens/proto/anonymous_tokens.proto" ]

  component_build_force_source_set = true
  cc_generator_options = "lite=true:"

  proto_in_dir = "src"

  deps = [ "//third_party/protobuf:timestamp_proto" ]
}

source_set("proto_utils") {
  sources = [
    "src/anonymous_tokens/cpp/shared/proto_utils.cc",
    "src/anonymous_tokens/cpp/shared/proto_utils.h",
  ]

  public_configs = [ ":anonymous_tokens_config" ]

  public_deps = [
    ":anonymous_tokens_cc_proto",
    "//third_party/abseil-cpp:absl",
  ]
}
source_set("status_utils") {
  sources = [ "src/anonymous_tokens/cpp/shared/status_utils.h" ]

  public_configs = [ ":anonymous_tokens_config" ]

  public_deps = [ "//third_party/abseil-cpp:absl" ]
}

source_set("blinder") {
  sources = [ "src/anonymous_tokens/cpp/crypto/blinder.h" ]
  public_configs = [ ":anonymous_tokens_config" ]
  public_deps = [ "//third_party/abseil-cpp:absl" ]
}

source_set("constants") {
  sources = [ "src/anonymous_tokens/cpp/crypto/constants.h" ]
  public_configs = [ ":anonymous_tokens_config" ]
  public_deps = [ "//third_party/abseil-cpp:absl" ]
}

source_set("crypto_utils") {
  sources = [
    "src/anonymous_tokens/cpp/crypto/crypto_utils.cc",
    "src/anonymous_tokens/cpp/crypto/crypto_utils.h",
  ]
  public_configs = [ ":anonymous_tokens_config" ]
  deps = [
    ":constants",
    ":status_utils",
  ]
  public_deps = [
    ":anonymous_tokens_cc_proto",
    "//third_party/abseil-cpp:absl",
    "//third_party/boringssl",
  ]
}

source_set("rsa_blinder") {
  sources = [
    "src/anonymous_tokens/cpp/crypto/rsa_blinder.cc",
    "src/anonymous_tokens/cpp/crypto/rsa_blinder.h",
  ]
  public_configs = [ ":anonymous_tokens_config" ]
  deps = [
    ":blinder",
    ":constants",
    ":crypto_utils",
    ":status_utils",
  ]
  public_deps = [
    ":anonymous_tokens_cc_proto",
    "//third_party/abseil-cpp:absl",
    "//third_party/boringssl",
  ]
}

source_set("blind_signer") {
  sources = [ "src/anonymous_tokens/cpp/crypto/blind_signer.h" ]
  public_configs = [ ":anonymous_tokens_config" ]
  public_deps = [ "//third_party/abseil-cpp:absl" ]
}

source_set("rsa_blind_signer") {
  sources = [
    "src/anonymous_tokens/cpp/crypto/rsa_blind_signer.cc",
    "src/anonymous_tokens/cpp/crypto/rsa_blind_signer.h",
  ]
  public_configs = [ ":anonymous_tokens_config" ]
  deps = [
    ":anonymous_tokens_pb_openssl_converters",
    ":blind_signer",
    ":constants",
    ":crypto_utils",
    ":status_utils",
  ]
  public_deps = [
    ":anonymous_tokens_cc_proto",
    "//third_party/abseil-cpp:absl",
    "//third_party/boringssl",
  ]
}

source_set("verifier") {
  sources = [ "src/anonymous_tokens/cpp/crypto/verifier.h" ]
  public_configs = [ ":anonymous_tokens_config" ]
  public_deps = [ "//third_party/abseil-cpp:absl" ]
}

source_set("rsa_ssa_pss_verifier") {
  sources = [
    "src/anonymous_tokens/cpp/crypto/rsa_ssa_pss_verifier.cc",
    "src/anonymous_tokens/cpp/crypto/rsa_ssa_pss_verifier.h",
  ]
  public_configs = [ ":anonymous_tokens_config" ]
  deps = [
    ":anonymous_tokens_pb_openssl_converters",
    ":constants",
    ":crypto_utils",
    ":status_utils",
    ":verifier",
  ]
  public_deps = [
    ":anonymous_tokens_cc_proto",
    "//third_party/abseil-cpp:absl",
    "//third_party/boringssl",
  ]
}

source_set("rsa_bssa_public_metadata_client") {
  sources = [
    "src/anonymous_tokens/cpp/privacy_pass/rsa_bssa_public_metadata_client.cc",
    "src/anonymous_tokens/cpp/privacy_pass/rsa_bssa_public_metadata_client.h",
  ]
  public_configs = [ ":anonymous_tokens_config" ]
  deps = [
    ":constants",
    ":crypto_utils",
    ":rsa_blinder",
    ":status_utils",
    ":tokens_encodings",
  ]
  public_deps = [
    "//third_party/abseil-cpp:absl",
    "//third_party/boringssl",
  ]
}

source_set("tokens_encodings") {
  sources = [
    "src/anonymous_tokens/cpp/privacy_pass/token_encodings.cc",
    "src/anonymous_tokens/cpp/privacy_pass/token_encodings.h",
  ]
  public_configs = [ ":anonymous_tokens_config" ]
  deps = [ ":status_utils" ]
  public_deps = [
    "//third_party/abseil-cpp:absl",
    "//third_party/boringssl",
  ]
}

source_set("athm_token_encodings_utils") {
  sources = [
    "src/anonymous_tokens/cpp/privacy_pass/athm_token_encodings_utils.cc",
    "src/anonymous_tokens/cpp/privacy_pass/athm_token_encodings_utils.h",
  ]
  public_configs = [ ":anonymous_tokens_config" ]
  deps = [ ":status_utils" ]
  public_deps = [
    "//third_party/abseil-cpp:absl",
    "//third_party/boringssl",
  ]
}

static_library("anonymous_tokens_test_support") {
  testonly = true
  sources = [
    "overrides/anonymous_tokens/cpp/testing/testdata_utils.h",
    "src/anonymous_tokens/cpp/testing/proto_utils.cc",
    "src/anonymous_tokens/cpp/testing/proto_utils.h",
    "src/anonymous_tokens/cpp/testing/utils.cc",
    "src/anonymous_tokens/cpp/testing/utils.h",
    "testdata_utils_impl.cc",
    "testdata_utils_impl.h",
  ]
  public_configs = [ ":anonymous_tokens_config" ]
  deps = [
    ":constants",
    ":crypto_utils",
    ":status_utils",
    "//base",
  ]
  public_deps = [
    ":anonymous_tokens_cc_proto",
    "//third_party/abseil-cpp:absl",
    "//third_party/boringssl",
  ]
}

bundle_data("test_data") {
  visibility = [ ":anonymous_tokens_tests" ]
  testonly = true
  sources = [
    "src/anonymous_tokens/testdata/strong_rsa_modulus2048_example.binarypb",
    "src/anonymous_tokens/testdata/strong_rsa_modulus2048_example_2.binarypb",
    "src/anonymous_tokens/testdata/strong_rsa_modulus3072_example.binarypb",
    "src/anonymous_tokens/testdata/strong_rsa_modulus4096_example.binarypb",
  ]
  outputs = [ "{{bundle_resources_dir}}/" +
              "{{source_root_relative_dir}}/{{source_file_part}}" ]
}

source_set("anonymous_tokens_tests") {
  testonly = true
  sources = [
    "src/anonymous_tokens/cpp/client/anonymous_tokens_public_key_client_test.cc",
    "src/anonymous_tokens/cpp/client/anonymous_tokens_redemption_client_test.cc",
    "src/anonymous_tokens/cpp/client/anonymous_tokens_rsa_bssa_client_test.cc",
    "src/anonymous_tokens/cpp/crypto/anonymous_tokens_pb_openssl_converters_test.cc",
    "src/anonymous_tokens/cpp/crypto/crypto_utils_test.cc",
    "src/anonymous_tokens/cpp/crypto/rsa_blind_signer_test.cc",
    "src/anonymous_tokens/cpp/crypto/rsa_blinder_test.cc",
    "src/anonymous_tokens/cpp/crypto/rsa_ssa_pss_verifier_test.cc",
    "src/anonymous_tokens/cpp/privacy_pass/rsa_bssa_public_metadata_client_test.cc",
    "src/anonymous_tokens/cpp/privacy_pass/token_encodings_test.cc",
    "src/anonymous_tokens/cpp/shared/proto_utils_test.cc",
  ]

  data = [ "src/anonymous_tokens/testdata/" ]
  public_configs = [ ":anonymous_tokens_config" ]
  deps = [
    ":anonymous_tokens_pb_openssl_converters",
    ":anonymous_tokens_public_key_client",
    ":anonymous_tokens_redemption_client",
    ":anonymous_tokens_rsa_bssa_client",
    ":anonymous_tokens_test_support",
    ":constants",
    ":crypto_utils",
    ":proto_utils",
    ":rsa_blind_signer",
    ":rsa_blinder",
    ":rsa_bssa_public_metadata_client",
    ":rsa_ssa_pss_verifier",
    ":status_utils",
    ":tokens_encodings",
    "//testing/gmock",
    "//testing/gtest",
    "//third_party/abseil-cpp:absl",
  ]
  if (is_ios) {
    deps += [ ":test_data" ]
  }
}

# Anonymous Tokens with Hidden Metadata (ATHM), built from the autorolled
# upstream mirror at src/athm. We build the `boringssl` backend so the elliptic
# curve / hashing primitives come from Chromium's in-tree BoringSSL (via the
# bssl_sys FFI bindings) rather than a pure-Rust crypto stack. The crate's Cargo
# `default = ["rustcrypto"]` feature is irrelevant here: rust_static_library
# does not run Cargo, so only the explicitly listed features are enabled.
if (enable_rust) {
  import("//build/rust/rust_static_library.gni")

  rust_static_library("athm") {
    crate_name = "athm"
    crate_root = "src/athm/src/lib.rs"
    sources = [
      "src/athm/src/backend/boringssl.rs",
      "src/athm/src/backend/mod.rs",
      "src/athm/src/lib.rs",
    ]
    edition = "2021"
    allow_unsafe = true  # Raw bssl_sys FFI; reviewed per-call SAFETY blocks.
    features = [ "boringssl" ]

    # athm is upstream third-party code (autorolled mirror), so cap its lints to
    # `allow` the way Cargo does for dependencies, rather than enforcing
    # Chromium's first-party `-D warnings`.
    rustflags = [ "--cap-lints=allow" ]
    deps = [
      "//third_party/boringssl:bssl_sys",
      "//third_party/rust/subtle/v2:lib",
      "//third_party/rust/zeroize/v1:lib",
    ]
  }
}