namespace DodoSSH.Contracts;

/// <summary>
/// Stable machine-readable error codes returned in the <c>code</c> extension of an
/// RFC 9457 ProblemDetails response.
/// </summary>
/// <remarks>
/// These live in Contracts so the client switches on constants rather than parsing prose.
/// The values are part of the public contract: add freely, never rename or repurpose.
/// </remarks>
public static class ProblemCodes
{
    /// <summary>The base URI that every problem <c>type</c> is formed under.</summary>
    public const string TypeBaseUri = "https://dodossh.dev/problems/";

    /// <summary>A push operation's <c>expectedVersion</c> did not match the stored row.</summary>
    public const string VaultConflict = "vault-conflict";

    /// <summary>The caller is authenticated but lacks the required permission.</summary>
    public const string Forbidden = "forbidden";

    /// <summary>The sync cursor was malformed, or failed its integrity tag.</summary>
    public const string InvalidCursor = "invalid-cursor";

    /// <summary>An <c>Idempotency-Key</c> was reused with a different request body.</summary>
    public const string IdempotencyKeyReuse = "idempotency-key-reuse";

    /// <summary>The caller has not yet enrolled a public key, so no vault is reachable.</summary>
    public const string EnrollmentRequired = "enrollment-required";

    /// <summary>Enrollment was attempted for a user who already holds a different current key.</summary>
    public const string AlreadyEnrolled = "already-enrolled";

    /// <summary>
    /// The enrollment request was structurally invalid: a bad key length, mismatched KDF
    /// parameters, a statement that does not describe the caller, or a vault id already in use.
    /// </summary>
    public const string InvalidEnrollment = "invalid-enrollment";

    /// <summary>
    /// The identity-provider token did not bind the supplied keys: a bad signature, the wrong
    /// subject or audience, an expired token, or a <c>nonce</c> that is not the statement's hash.
    /// </summary>
    public const string IdentityBindingInvalid = "identity-binding-invalid";

    /// <summary>
    /// A device registration was structurally invalid: a public key of the wrong length, a missing or
    /// oversized wrap, or a blank name.
    /// </summary>
    /// <remarks>
    /// Distinct from <see cref="InvalidEnrollment"/> even though the rules overlap, because the two are
    /// different requests and a client showing "your enrollment was rejected" when somebody added a
    /// fingerprint reader would be describing the wrong thing entirely.
    /// </remarks>
    public const string InvalidDeviceRegistration = "invalid-device-registration";

    /// <summary>The relay refused the requested target. Never states why, to avoid a probe oracle.</summary>
    public const string RelayTargetRejected = "relay-target-rejected";

    /// <summary>The relay ticket is expired, already used, or not valid for this node.</summary>
    public const string RelayTicketInvalid = "relay-ticket-invalid";

    /// <summary>A per-user or per-node relay session limit was reached.</summary>
    public const string RelayLimitReached = "relay-limit-reached";

    /// <summary>The client is older than the server's <c>minClientVersion</c>.</summary>
    public const string ClientTooOld = "client-too-old";

    /// <summary>A push batch exceeded the operation count or payload size cap.</summary>
    public const string PushBatchTooLarge = "push-batch-too-large";
}