// Host application is darrynten/xero-accounting-php

$config = [
    'key' => CONSUMER_KEY,
    'secret' => CONSUMER_SECRET,
    'applicationType' => APPLICATION_TYPE,
];

$xeroClient = new XeroOauth($config);
$result = $xeroClient->request('GET', 'TaxRates');

/**
 *
 * TODO this package should figure this all out based on
 * information passed into XeroOauth - use the config
 * factory to do this.
 *
 * This is currently forcing the host application to keep track
 * of all this information.
 *
 * We can use darrynten/any-cache to store tokens
 */

$config [
    'key' => CONSUMER_KEY,
    'secret' => CONSUMER_SECRET,
    /**
     * TODO
     *
     * The host application should only have to pass in the app
     * type and the factory should be used to get the appropriate
     * signing mechanisms etc
     *
     * This applies to as much config as possible
     */
    'sign_with' => 'HMAC-SHA1',
    // other options
]

// Get Request Token
$handler = new RequestHandler($config);

/**
 * TODO
 *
 * The host application should not concern itself with this, it should
 * only have to `$xeroClient->request('GET', 'Currencies')`
 *
 */
try {
    $handler->request('GET', 'Currencies');
} catch (AuthException $e) {
    $authData = $handler->getAuthData();
    // we store oauth_token from $authData and direct user to
    // https://api.xero.com/oauth/Authorize?oauth_token=REQUEST_TOKEN_HERE
}

/**
 * TODO
 *
 * All of the below should be kept and tracked using this package.
 *
 * Host applications that would need redirect urls etc would need
 * to provide this in the config.
 *
 * There is configuration factory functionality in place for the
 * three types of applications (public, partner, private)
 *
 */

// Get Access Token
// We assume that user granted access by visiting this url
// https://app.xero.com/oauth/APIAuthorise?oauth_token=REQUEST_TOKEN_HERE
$config['token'] = REQUEST_TOKEN_HERE;
$config['token_secret'] = $authData['oauth_token_secret']; // see above
$config['oauth_verifier'] = '563499'; // we collect after user grants permission
$handler = new RequestHandler($config);
$handler->request('GET', 'Currencies');
$authData = $handler->getAuthData();

/*
Array
(
    [oauth_token] => ACCESS_TOKEN_HERE
    [oauth_token_secret] => TOKEN_SECRET_HERE
    [oauth_expires_in] => DateTime Object
        (
            [date] => 2017-08-15 14:03:58.079112
            [timezone_type] => 3
            [timezone] => UTC
        )

    [oauth_verifier] => 563499
    [token_verified] => true
)

/**
 * TODO
 *
 * Tokens that come back like this should be tracked internally
 * using the darrynten/any-cache package
 *
 * Expires etc can all be tracked in a cache with that package.
 *
 */
// 'token_verified' is true so we can use ACCESS_TOKEN_HERE to make requests
*/

// Example of real request
$config['token'] = ACCESS_TOKEN_HERE;
$config['token_secret'] = TOKEN_SECRET_HERE;
$config['token_expires_in'] = $datetimeObject; // see above
$config['token_verified'] = true;

/**
 * TODO
 *
 * This should be the only thing the host has to worry about
 */
$handler = new RequestHandler($config);
$response = $handler->request('GET', 'Currencies');

/*
{
  "Id": "3f0d9d3a-6540-4668-87a4-06621ff7eac10",
  "Status": "OK",
  "ProviderName": "Public app",
  "DateTimeUTC": "\/Date(1502804191899)\/",
  "Currencies": [
    {
      "Code": "ZAR",
      "Description": "South African Rand"
    }
  ]
}
*/