/**
 * Error codes the Ed25519 admin auth flow can surface to the UI. Each maps to
 * a dedicated screen (see `core/auth/pages`) rather than a generic toast,
 * because the recovery action differs per code (re-login vs. retry vs. wait).
 */
export type AuthErrorCode =
  | 'session-expired'
  | 'invalid-signature'
  | 'unauthorized'
  | 'forbidden'
  | 'backend-unavailable';

export interface AuthError {
  code: AuthErrorCode;
  message: string;
  /** HTTP status that produced this error, when known (absent for client-side errors, e.g. no Ed25519 support). */
  status?: number;
}

/** Maps a backend HTTP status to the AuthErrorCode screen it should route to. */
export function authErrorCodeFromStatus(status: number): AuthErrorCode {
  switch (status) {
    case 401:
      return 'unauthorized';
    case 403:
      return 'forbidden';
    case 0:
      return 'backend-unavailable';
    default:
      return status >= 500 ? 'backend-unavailable' : 'unauthorized';
  }
}
