"""Safe, stable authentication errors."""

from __future__ import annotations


class AuthError(Exception):
    """An error whose public code/message is safe to expose to a caller."""

    code = "authentication_failed"
    public_message = "Authentication failed."

    def __init__(self, message: str | None = None) -> None:
        super().__init__(message or self.public_message)


class ConfigurationError(AuthError):
    code = "authentication_configuration_error"
    public_message = "Authentication is not configured."


class ProviderUnavailable(AuthError):
    code = "identity_provider_unavailable"
    public_message = "The identity provider is temporarily unavailable."


class InvalidToken(AuthError):
    code = "invalid_token"
    public_message = "The supplied credential is invalid."


class TokenExchangeError(AuthError):
    code = "token_exchange_failed"
    public_message = "Authentication could not be completed."


class InvalidState(AuthError):
    code = "invalid_auth_state"
    public_message = "Authentication could not be completed."


class CSRFError(AuthError):
    code = "csrf_failed"
    public_message = "The request could not be verified."


class SessionExpired(AuthError):
    code = "session_expired"
    public_message = "The session has expired."


class UnknownMachinePrincipal(AuthError):
    code = "unknown_machine_principal"
    public_message = "The machine client is not registered."


class RevokedMachinePrincipal(AuthError):
    code = "revoked_machine_principal"
    public_message = "The machine client is disabled."