def format_sas_uri(hostname: str, device_id: str, module_id: str) -> str:
    """
    Return the sas uri used to make a sas token for the given device or module.

    :param str hostname: name of the host that is being authorized with.  In the case of
        a transparent gateway, this is the name of the destination host, and NOT the name
        of the gateway.
    :param str device_id: device_id for the device or module which is being authorized.
    :param str module_id: module_id for the module being authorized.  `None` if a device is being
        authorized.

    :return: The URI which gets signed to create the SAS token.
    """

    if module_id:
        return "{}/devices/{}/modules/{}".format(hostname, device_id, module_id)
    else:
        return "{}/devices/{}".format(hostname, device_id)