/**
 * Domain error types for the IAM (auth) module.
 * Mirrors `apps/domain/src/auth/error.rs`.
 */
import type { DomainError } from "../core/error.ts";

/** Shared repository error type for IAM persistence. */
export type RepositoryError = DomainError;

/** Errors from service / use-case operations in the IAM domain. */
export type ServiceError =
  | { kind: "repository"; error: DomainError }
  | { kind: "invalid_config"; message: string }
  | { kind: "state_mismatch" }
  | { kind: "oauth_provider"; message: string }
  | { kind: "other"; message: string };

export function repositoryErr(err: DomainError): ServiceError {
  return { kind: "repository", error: err };
}
export function invalidConfig(message: string): ServiceError {
  return { kind: "invalid_config", message };
}
export function stateMismatch(): ServiceError {
  return { kind: "state_mismatch" };
}
export function oauthProvider(message: string): ServiceError {
  return { kind: "oauth_provider", message };
}
export function authOther(message: string): ServiceError {
  return { kind: "other", message };
}

export function serviceErrorToString(e: ServiceError): string {
  switch (e.kind) {
    case "repository":
      return `repository error: ${e.error.message}`;
    case "invalid_config":
      return `invalid configuration: ${e.message}`;
    case "state_mismatch":
      return `OAuth state mismatch — possible CSRF attack`;
    case "oauth_provider":
      return `OAuth provider error: ${e.message}`;
    case "other":
      return e.message;
  }
}