htpx

var (
	// ErrAPIKeyNotFound is returned by APIKeyStore implementations when
	// a lookup or delete targets a key that is not present. Replaces the
	// six "API key not found" anonymous errors.New sites in apikey.go.
	ErrAPIKeyNotFound = errors.New("htpx: api key not found")
	// ErrAPIKeyInvalid is returned by APIKeyManager.ValidateKey when the
	// provided key string does not hash to a known stored key. The
	// message intentionally avoids leaking whether the key was unknown
	// versus mismatched (to limit oracle behavior under brute-force).
	ErrAPIKeyInvalid = errors.New("htpx: invalid api key")
	// ErrAPIKeyDisabled is returned by APIKeyManager.ValidateKey when
	// the key exists but is not enabled.
	ErrAPIKeyDisabled = errors.New("htpx: api key is disabled")
	// ErrAPIKeyExpired is returned by APIKeyManager.ValidateKey when the
	// key exists, is enabled, but its ExpiresAt is in the past.
	ErrAPIKeyExpired = errors.New("htpx: api key is expired")

	// ErrFIDOUserNotFound is returned by FIDOStore implementations when
	// a user lookup misses. Returned by GetUser, GetUserByName, and
	// GetCredentials in MemoryFIDOStore.
	ErrFIDOUserNotFound = errors.New("htpx: fido user not found")
	// ErrFIDOConfigRequired is returned by NewFIDOServer when the
	// supplied configuration pointer is nil.
	ErrFIDOConfigRequired = errors.New("htpx: fido config is required")

	// ErrOIDCEndpointEmpty is returned by the API server constructor
	// when an authenticated build is requested without an OIDC endpoint
	// AND insecure-dev startup is not allowed.
	ErrOIDCEndpointEmpty = errors.New("htpx: oidc endpoint is empty")
	// ErrValidationSpecMissing is returned by WithValidation when OIDC
	// auth is configured but no OpenAPI spec was supplied. The OpenAPI
	// request validator mounted from the spec is the only component
	// that invokes the authentication function, so without a spec every
	// `security:`-declared route would be served unauthenticated
	// (fail-open). htpx has no embedded spec to fall back on; pass
	// WithSwaggerSpec before WithValidation. Sibling of appsec N-01
	// fixed in api/ (73d6568).
	ErrValidationSpecMissing = errors.New(
		"htpx: oidc auth is configured but no OpenAPI spec was supplied;" +
			" pass WithSwaggerSpec before WithValidation so the auth" +
			" enforcer can be mounted",
	)
	// ErrRegisterFunctionNil is returned by api.New when called without
	// a route registration function.
	ErrRegisterFunctionNil = errors.New("htpx: register function is nil")
	// ErrInsecureDevNonLoopback is returned by newListener when
	// APIC_INSECURE_DEV is set but the host is not a loopback address.
	ErrInsecureDevNonLoopback = errors.New("htpx: APIC_INSECURE_DEV is only allowed on loopback hosts")
	// ErrMissingTLSPaths is returned by newListener when neither
	// insecure-dev nor a cert/key path pair is provided.
	ErrMissingTLSPaths = errors.New("htpx: missing TLS cert/key paths")

	// ErrTransportNil is returned by WithTransport when the supplied
	// http.RoundTripper is nil.
	ErrTransportNil = errors.New("htpx: transport is nil")
	// ErrClientNil is returned by WithDoer when the supplied
	// HTTPClient is nil.
	ErrClientNil = errors.New("htpx: client is nil")

	// ErrCircuitBreakerOpen is returned by CircuitBreaker.Execute when
	// the breaker is in the open state and the call is short-circuited.
	ErrCircuitBreakerOpen = errors.New("htpx: circuit breaker is open")
	// ErrCacheMiss is returned by MemoryCacheStore.Get when no entry
	// exists for the requested key.
	ErrCacheMiss = errors.New("htpx: cache miss")
	// ErrCacheExpired is returned by MemoryCacheStore.Get when an entry
	// exists but its TTL has elapsed.
	ErrCacheExpired = errors.New("htpx: cache expired")

	// ErrReadResponseBody is wrapped via errors.Join when ReadJSON fails
	// to read the response body off the wire.
	ErrReadResponseBody = errors.New("htpx: failed to read response body")
	// ErrUnmarshalResponseBody is wrapped via errors.Join when ReadJSON
	// fails to decode the response body as JSON.
	ErrUnmarshalResponseBody = errors.New("htpx: failed to unmarshal response body")
	// ErrResponseBodyTooLarge is returned when a response body exceeds the
	// client's maxResponseBytes ceiling (see WithMaxResponseBytes). PERF-0024.
	ErrResponseBodyTooLarge = errors.New("htpx: response body exceeds maximum")

	// ErrNoTokenToRefresh is returned by TokenRefresher.Start when the
	// refresher has no current token to refresh.
	ErrNoTokenToRefresh = errors.New("htpx: no token to refresh")

	// ErrAuthTokenMissing is returned by AuthToken when no JWT is
	// present in the request context.
	ErrAuthTokenMissing = errors.New("htpx: failed to get auth token")
	// ErrJWTMissingScopeClaim is returned by OIDC.Authenticate when
	// scopes are required but the token has no "scope" claim.
	ErrJWTMissingScopeClaim = errors.New("htpx: missing scope claim in jwt")
	// ErrJWTScopeClaimNotString is returned by OIDC.Authenticate when
	// the "scope" claim exists but is not a string.
	ErrJWTScopeClaimNotString = errors.New("htpx: jwt scope claim is not a string")
	// ErrJWKEndpointEmpty is returned by OIDC.UnmarshalJSON when the
	// JWK endpoint returns no keys at cold start.
	ErrJWKEndpointEmpty = errors.New("htpx: no keys found in jwk endpoint")
	// ErrUnsupportedJWTAlg is returned by ExtractToken when an inbound
	// token declares a JWS algorithm outside the asymmetric allowlist
	// (e.g. "none" or HS256/384/512). Mirrors api/oidc.go (QG-060) so the
	// JWKS verification path cannot be downgraded via algorithm
	// confusion. QG-081.
	ErrUnsupportedJWTAlg = errors.New("htpx: unsupported jwt algorithm")

	// ErrSignatureConfigRequired is returned by NewSigner when given a
	// nil SignatureConfig.
	ErrSignatureConfigRequired = errors.New("htpx: signature config is required")
	// ErrSignatureKeyIDRequired is returned by NewSigner when the
	// SignatureConfig has an empty KeyID.
	ErrSignatureKeyIDRequired = errors.New("htpx: signature key id is required")
	// ErrSignaturePrivateKeyRequired is returned by NewSigner when the
	// SignatureConfig has a nil PrivateKey.
	ErrSignaturePrivateKeyRequired = errors.New("htpx: signature private key is required")
	// ErrSignatureHMACKeyType is returned by Signer.sign and Verifier.verify
	// when the configured key for HMAC algorithms is not a []byte.
	ErrSignatureHMACKeyType = errors.New("htpx: hmac key must be []byte")
	// ErrSignatureRSAPrivateKey is returned by Signer.sign when the
	// configured private key is not an *rsa.PrivateKey.
	ErrSignatureRSAPrivateKey = errors.New("htpx: rsa private key required")
	// ErrSignatureECDSAPrivateKey is returned by Signer.sign when the
	// configured private key is not an *ecdsa.PrivateKey.
	ErrSignatureECDSAPrivateKey = errors.New("htpx: ecdsa private key required")
	// ErrSignatureED25519PrivateKey is returned by Signer.sign when the
	// configured private key is not an ed25519.PrivateKey.
	ErrSignatureED25519PrivateKey = errors.New("htpx: ed25519 private key required")
	// ErrSignatureMissingAuthHeader is returned by VerifyRequest when
	// the request has no Authorization header.
	ErrSignatureMissingAuthHeader = errors.New("htpx: missing authorization header")
	// ErrSignatureDateHeaderMissing is returned by VerifyRequest when
	// the signed headers include "date" but the request has none.
	ErrSignatureDateHeaderMissing = errors.New("htpx: date header required but not found")
	// ErrSignatureClockSkew is returned by VerifyRequest when the date
	// header is outside the configured clock-skew window. The message
	// intentionally retains the substring "clock skew" for compatibility
	// with existing tests that match on it.
	ErrSignatureClockSkew = errors.New("htpx: date header outside allowed clock skew")
	// ErrSignatureHMACVerify is returned by Verifier.verify when the
	// HMAC signature does not match the expected value.
	ErrSignatureHMACVerify = errors.New("htpx: hmac verification failed")
	// ErrSignatureRSAPublicKey is returned by Verifier.verify when the
	// configured public key is not an *rsa.PublicKey.
	ErrSignatureRSAPublicKey = errors.New("htpx: rsa public key required")
	// ErrSignatureECDSAPublicKey is returned by Verifier.verify when the
	// configured public key is not an *ecdsa.PublicKey.
	ErrSignatureECDSAPublicKey = errors.New("htpx: ecdsa public key required")
	// ErrSignatureECDSAVerify is returned by Verifier.verify when the
	// ECDSA signature does not match.
	ErrSignatureECDSAVerify = errors.New("htpx: ecdsa verification failed")
	// ErrSignatureED25519PublicKey is returned by Verifier.verify when
	// the configured public key is not an ed25519.PublicKey.
	ErrSignatureED25519PublicKey = errors.New("htpx: ed25519 public key required")
	// ErrSignatureED25519Verify is returned by Verifier.verify when the
	// Ed25519 signature does not match.
	ErrSignatureED25519Verify = errors.New("htpx: ed25519 verification failed")
	// ErrSignatureHeaderFormat is returned by parseSignatureHeader when
	// the Authorization header does not start with "Signature ".
	ErrSignatureHeaderFormat = errors.New("htpx: invalid signature header format")
	// ErrSignatureHeaderIncomplete is returned by parseSignatureHeader
	// when the Signature header is missing required fields.
	ErrSignatureHeaderIncomplete = errors.New("htpx: incomplete signature header")
	// ErrSignatureDigestHeaderMissing is returned by verifyDigest when
	// the request is missing the Digest header that was signed.
	ErrSignatureDigestHeaderMissing = errors.New("htpx: digest header required but not found")
	// ErrSignatureDigestUnsupported is returned by verifyDigest when the
	// Digest header uses an algorithm other than SHA-256.
	ErrSignatureDigestUnsupported = errors.New("htpx: only SHA-256 digest supported")
	// ErrSignatureDigestMismatch is returned by verifyDigest when the
	// computed digest does not match the value supplied in the header.
	ErrSignatureDigestMismatch = errors.New("htpx: digest mismatch")
	// ErrSignaturePEMDecode is returned by LoadPrivateKey and
	// LoadPublicKey when the PEM block cannot be decoded.
	ErrSignaturePEMDecode = errors.New("htpx: failed to decode PEM block")
)

var (
	GET    = WithMethod(http.MethodGet)
	POST   = WithMethod(http.MethodPost)
	PUT    = WithMethod(http.MethodPut)
	DELETE = WithMethod(http.MethodDelete)
	PATCH  = WithMethod(http.MethodPatch)
)

var ErrAuthHeaderMissing = errors.New("htpx: authorization header missing")

var ErrEmptyAudience = errors.New("htpx: empty audience")

var ErrInvalidScheme = errors.New("htpx: invalid scheme")

var ErrInvalidURL = errors.New("htpx: invalid url")

var ErrIssuerMismatch = errors.New("htpx: discovery issuer does not match the discovery URL")

var ErrJWKSTransportWrapped = errors.New("htpx: jwks transport is a wrapped Doer (ClientWrapper), not a single-hop http.RoundTripper")

var ErrMalformedAuthHeader = errors.New("htpx: malformed authorization header")

var ErrNotApplicable = errors.New("htpx: rewriter not applicable")

var ErrSignatureBodyTooLarge = errors.New("htpx: signed-request body exceeds size cap")