//! IdentityError — all errors from the el-identity system.

use thiserror::Error;

#[derive(Debug, Error, Clone)]
pub enum IdentityError {
    #[error("user not found: {0}")]
    UserNotFound(String),

    #[error("session not found or expired")]
    SessionNotFound,

    #[error("session expired")]
    SessionExpired,

    #[error("OAuth error: {0}")]
    OAuthError(String),

    #[error("OAuth provider not configured: {0}")]
    ProviderNotConfigured(String),

    #[error("token exchange failed: {status} {body}")]
    TokenExchangeFailed { status: u16, body: String },

    #[error("token refresh failed: {0}")]
    TokenRefreshFailed(String),

    #[error("PKCE verification failed")]
    PkceVerificationFailed,

    #[error("graph error: {0}")]
    GraphError(String),

    #[error("serialization error: {0}")]
    SerializationError(String),

    #[error("authentication required")]
    Unauthenticated,

    #[error("forbidden: requires role '{0}'")]
    Forbidden(String),

    #[error("forbidden: requires scope '{0}'")]
    ScopeForbidden(String),

    #[error("invalid credentials")]
    InvalidCredentials,

    #[error("role not found: {0}")]
    RoleNotFound(String),

    #[error("node not found: {0}")]
    NodeNotFound(String),
}

pub type IdentityResult<T> = Result<T, IdentityError>;