// Copyright (c) 2026, Salesforce, Inc.,
// All rights reserved.
// For full license text, see the LICENSE.txt file

//! PDK LDAP Library
//!
//! Library for LDAP authentication via HTTP service calls. Provides LDAP client
//! functionality for Flex Gateway policies to authenticate users against LDAP servers.
//!
//! ## Important: Authorization Extraction
//!
//! **This library does NOT extract authorization values from HTTP requests.**
//! Policies are responsible for:
//!
//! - Extracting credentials from `Authorization` headers (e.g., Basic auth)
//! - Evaluating DataWeave expressions
//! - Reading from the request body
//! - Passing the extracted authorization value to this library
//!
//! The library's role is to communicate with the LDAP service, not to extract credentials.
//!
//! ## Primary Types
//!
//! - [`LdapClient`] — main client for LDAP authentication operations
//! - [`LdapBuilderInstance`] — builder for creating [`LdapClient`] instances
//! - [`LdapBuilder`] — factory injected by the PDK context for creating [`LdapClient`]s
//! - [`LdapError`] — error type for LDAP operations
//! - [`ConfigError`] — configuration validation errors
//!
//! ## Example
//!
//! ```rust,ignore
//! use pdk_ldap_lib::{LdapBuilder, LdapClient, LdapError};
//!
//! // Step 1: Policy extracts authorization value (this library does NOT do this)
//! let username = extract_username_from_request()?;
//! let password = extract_password_from_request()?;
//!
//! // Step 2: Configure and build the LDAP client
//! let client = ldap_builder
//!     .new()
//!     .server_url("ldap://ldap.example.com:389".to_string())
//!     .server_user_dn("cn=admin,dc=example,dc=com".to_string())
//!     .server_user_password("secret".to_string())
//!     .search_base("ou=users,dc=example,dc=com".to_string())
//!     .search_filter("(uid={0})".to_string())
//!     .search_in_subtree()
//!     .build()?;
//!
//! // Step 3: Authenticate
//! match client.authenticate(&username, &password).await {
//!     Ok(()) => { /* allow request */ }
//!     Err(LdapError::AuthenticationFailed) => { /* reject with 401 */ }
//!     Err(LdapError::ServerError) => { /* reject with 503 */ }
//!     Err(e) => { /* handle other errors */ }
//! }
//! ```

pub mod builder;
mod client;
mod error;

pub use builder::{LdapBuilder, LdapBuilderInstance};
pub use client::LdapClient;
pub use error::{ConfigError, LdapError};
