oidc

var (
	// ErrInvalidRequest indicates the request is missing a required parameter, includes an invalid parameter value,
	// includes a parameter more than once, or is otherwise malformed.
	ErrInvalidRequest = errors.New("invalid_request")

	// ErrInvalidGrant indicates the provided authorization grant or refresh token is invalid, expired, revoked, does
	// not match the redirection URI used in the authorization request, or was issued to another client.
	ErrInvalidGrant = errors.New("invalid_grant")

	// ErrInvalidClient indicates client authentication failed (e.g. unknown client, no client authentication included,
	// or unsupported authentication method).
	ErrInvalidClient = errors.New("invalid_client")

	// ErrUnauthorizedClient indicates the client is not authorized to request an authorization code using this method.
	ErrUnauthorizedClient = errors.New("unauthorized_client")

	// ErrAccessDenied indicates the resource owner or authorization server denied the request.
	ErrAccessDenied = errors.New("access_denied")

	// ErrUnsupportedResponseType indicates the authorization server does not support obtaining and authorization code
	// using this method.
	ErrUnsupportedResponseType = errors.New("unsupported_response_type")

	// ErrUnsupportedGrantType indicates the authorization grant type is not supported by the authorization server.
	ErrUnsupportedGrantType = errors.New("unsupported_grant_type")

	// ErrInvalidScope indicates the request scope is invalid, unknown, or malformed.
	ErrInvalidScope = errors.New("invalid_scope")

	// ErrServerError indicates the authorization server encountered an unexpected condition that prevented it from
	// fulfilling the request.
	ErrServerError = errors.New("server_error")

	// ErrTemporarilyUnavailable indicates the authorization server is currently unable to handle the request due to a
	// temporary overloading or maintenance of the server.
	ErrTemporarilyUnavailable = errors.New("temporarily_unavailable")

	// ErrInteractionRequired indicates the authorization server requires some form of End-User interaction to proceed.
	// This error may be returned when prompt=none is requested, but the authentication request cannot complete without
	// user interaction.
	ErrInteractionRequired = errors.New("interaction_required")

	// ErrLoginRequired indicates the authorization server requires End-User authentication. This error may be returned
	// when prompt=none is requested, but the authentication request cannot complete without requesting user to login.
	ErrLoginRequired = errors.New("login_required")

	// ErrAccountSelectionRequired indicates the user is required to select a session at the authorization server. This
	// error may be returned when user has several live session at the authorization server, but prompt=none is requested,
	// hence the authentication request cannot proceed without asking user to select a session.
	ErrAccountSelectionRequired = errors.New("account_selection_required")

	// ErrConsentRequired indicates the authorization server requires End-User consent. This error may be returned when
	// prompt=none is requested, but the authentication request cannot complete without display an interface to user
	// and ask for consent.
	ErrConsentRequired = errors.New("consent_required")

	// ErrInvalidRequestUri indicates that the "request_uri" returns error or its content is invalid.
	ErrInvalidRequestUri = errors.New("invalid_request_uri")

	// ErrInvalidRequestObject indicates the "request" parameter contains an invalid request object.
	ErrInvalidRequestObject = errors.New("invalid_request_object")

	// ErrRequestNotSupported indicates the server does not support the use of "request" parameter.
	ErrRequestNotSupported = errors.New("request_not_supported")

	// ErrRequestUriNotSupported indicates the server does not support the use of "request_uri" parameter.
	ErrRequestUriNotSupported = errors.New("request_uri_not_supported")

	// ErrRegistrationNotSupported indicates the server does not support the use of "registration" parameter.
	ErrRegistrationNotSupported = errors.New("registration_not_supported")

	// ErrUnauthorized indicates client does not have enough permission to access the resource.
	ErrUnauthorized = errors.New("unauthorized")
)

var (
	ErrInvalidRedirectUri  = fmt.Errorf(`%w: "redirect_uri" is invalid, relative or contains fragment`, ErrInvalidRequest)
	ErrInsecureRedirectUri = fmt.Errorf(`%w: "redirect_uri" is not secure`, ErrInvalidRequest)
)

var (
	ErrInvalidAuthMethod = fmt.Errorf(`%w: "auth_method" is invalid`, ErrInvalidRequest)
)

var ErrInvalidClaims = fmt.Errorf(`"%w: "claims" is invalid`, ErrInvalidRequest)

var (
	ErrInvalidCodeChallengeMethod = fmt.Errorf(`%w: "code_challenge_method" is invalid`, ErrInvalidRequest)
)

var (
	ErrInvalidDisplay = fmt.Errorf(`%w: "display" is invalid`, ErrInvalidRequest)
)

var (
	ErrInvalidGrantType = fmt.Errorf(`%w: "grant_type" is invalid`, ErrInvalidRequest)
)

var ErrInvalidPrompt = fmt.Errorf(`%w: "prompt" is invalid`, ErrInvalidRequest)

var (
	ErrInvalidResponseMode = fmt.Errorf(`%w: "response_mode" is invalid`, ErrInvalidRequest)
)

var (
	ErrInvalidResponseType = fmt.Errorf(`%w: "response_type" is invalid`, ErrInvalidRequest)
)

var (
	ErrInvalidSubjectType = fmt.Errorf("%w: subject type is invalid", ErrInvalidRequest)
)