namespace DodoSSH.Api.Features.Identity;

/// <summary>
/// The enrollment request was structurally unacceptable.
/// </summary>
/// <remarks>
/// The message is returned to the caller. Keep it about the shape of their own request and never
/// about other accounts or stored state.
/// </remarks>
internal sealed class EnrollmentInvalidException(string message) : Exception(message);

/// <summary>The identity-provider token did not bind the supplied keys.</summary>
internal sealed class IdentityBindingInvalidException(string message) : Exception(message);

/// <summary>
/// The device registration request was structurally unacceptable.
/// </summary>
/// <remarks>
/// Its own type rather than <see cref="EnrollmentInvalidException"/>, whose rules it largely shares.
/// Registering a device is not enrolling, and the problem code a client switches on should not claim it
/// was. As with enrollment, the message reaches the caller: keep it about the shape of their request.
/// </remarks>
internal sealed class DeviceRegistrationInvalidException(string message) : Exception(message);

/// <summary>
/// The caller already holds a current identity key that is not the one being enrolled.
/// </summary>
/// <remarks>
/// Re-sending an identical enrollment is <em>not</em> this: that is a retry, and it succeeds
/// idempotently. This is a second, different key, which would silently orphan every vault key
/// wrapped to the first one.
/// </remarks>
internal sealed class AlreadyEnrolledException(string message) : Exception(message);
