oidc

var (
	// ErrIssuerMismatch is returned when the ID token's iss differs from the
	// pinned issuer (H1a).
	ErrIssuerMismatch = errors.New("oidc: issuer mismatch")
	// ErrNonceMismatch is returned when the ID token's nonce does not match the
	// value bound in the state cookie (H4 — replay/CSRF on the token).
	ErrNonceMismatch = errors.New("oidc: nonce mismatch")
	// ErrAzpMismatch is returned when the authorized-party (azp) claim is present
	// and is not this client (H4).
	ErrAzpMismatch = errors.New("oidc: azp mismatch")
	// ErrTokenExpired is returned when exp/iat/nbf fall outside the allowed clock
	// skew (H4).
	ErrTokenExpired = errors.New("oidc: token outside validity window")
	// ErrMissingExpiry is returned when the ID token carries no exp claim; with
	// go-oidc's own expiry check disabled, an absent exp must fail closed rather
	// than grant an unbounded session.
	ErrMissingExpiry = errors.New("oidc: token has no expiry")
	// ErrEmailNotVerified is returned when email_verified is not true; an absent
	// claim is treated as false (D6c).
	ErrEmailNotVerified = errors.New("oidc: email not verified")
	// ErrTenantNotAllowed is returned when the tenant claim (tid/hd) is absent or
	// not present in the tenant_claims map (D6b/d) — never a fallback to default.
	ErrTenantNotAllowed = errors.New("oidc: tenant claim not allowed")
	// ErrTenantAmbiguous is a tenant claim whose array names MORE THAN ONE
	// accepted tenant. Picking one would be arbitrary and the choice would decide
	// which tenant's data the session reaches, so this fails closed instead.
	ErrTenantAmbiguous = errors.New("oidc: tenant claim names more than one accepted tenant")
	// ErrTenantClaimShape is a tenant claim that is neither a string nor an array
	// of strings. It is separate from ErrTenantNotAllowed on purpose: "not
	// allowed" sends an operator to inspect their tenant_claims map, which in this
	// case is correct, and nothing would tell them the value had a shape the pin
	// cannot read.
	ErrTenantClaimShape = errors.New("oidc: tenant claim is neither a string nor an array of strings")
	// ErrEmailDomainNotAllowed is returned when a non-empty allowed_email_domains
	// list does not include the verified email's domain (login-level allowlist).
	ErrEmailDomainNotAllowed = errors.New("oidc: email domain not allowed")
	// ErrNoSubject is returned when the ID token carries no subject — there is no
	// stable identity to key on.
	ErrNoSubject = errors.New("oidc: token has no subject")
	// ErrGroupOverage signals the IdP omitted the groups claim and returned a
	// _claim_names overage pointer instead (Azure Entra does this past ~200 group
	// memberships). Silently treating that as "no groups" would demote a heavily-
	// grouped user (often the most privileged) to default-deny / default_role with
	// no signal, so it fails closed with an actionable message: configure Entra
	// app roles (the "roles" claim) or narrow group membership. Full app-role
	// resolution is the EKS-validated follow-up.
	ErrGroupOverage = errors.New("oidc: group claim overage (IdP returned a _claim_names pointer, not the groups) — configure Entra app roles or the groups scope")
)

var ErrInvalidState = errors.New("invalid oidc state")

var ErrNoIDToken = errors.New("oidc: token response has no id_token")