package auth

import "errors"

var (
	ErrRegisterFieldsRequired = errors.New("email, password, and company name are required")
	ErrPasswordTooShort       = errors.New("password must be at least 8 characters")
	ErrUserNotFound           = errors.New("user not found")
	ErrNotCompanyMember       = errors.New("not a member of company")
	ErrInviteNotFound         = errors.New("invite not found")
	ErrEmailRequired          = errors.New("email is required")
	ErrSyntheticEmail         = errors.New("synthetic migration email cannot receive invites")
	ErrNotEligibleSetPassword = errors.New("user not eligible for set-password invite")
	ErrEmailMismatch          = errors.New("signed-in email does not match invite email")
)

// ClientError reports whether err is a known client-facing auth error.
func ClientError(err error) (msg string, ok bool) {
	switch {
	case err == nil:
		return "", false
	case errors.Is(err, ErrRegisterFieldsRequired),
		errors.Is(err, ErrPasswordTooShort),
		errors.Is(err, ErrPasswordAlreadySet),
		errors.Is(err, ErrUserExists),
		errors.Is(err, ErrInviteInvalid),
		errors.Is(err, ErrInvalidCredentials),
		errors.Is(err, ErrMustSetPassword),
		errors.Is(err, ErrUserNotFound),
		errors.Is(err, ErrNotCompanyMember),
		errors.Is(err, ErrInviteNotFound),
		errors.Is(err, ErrTokenInvalid),
		errors.Is(err, ErrEmailRequired),
		errors.Is(err, ErrSyntheticEmail),
		errors.Is(err, ErrNotEligibleSetPassword),
		errors.Is(err, ErrEmailMismatch):
		return err.Error(), true
	default:
		return "", false
	}
}