conncheck

const (
	// CodeOK marks a successful check.
	CodeOK Code = "ok"
	// CodeDNSFailure means the hostname did not resolve.
	CodeDNSFailure Code = "dns_failure"
	// CodeTimeout means the dial or handshake exceeded the deadline.
	CodeTimeout Code = "timeout"
	// CodeUnreachable means the TCP connection was refused or the network is unreachable.
	CodeUnreachable Code = "unreachable"
	// CodeHostKeyMismatch means the bastion presented a host key differing from
	// the TOFU-pinned one.
	CodeHostKeyMismatch Code = "host_key_mismatch"
	// CodeAuthRejected means the bastion refused the offered credentials.
	CodeAuthRejected Code = "auth_rejected"
	// CodeBadPrivateKey means the stored private key could not be parsed (wrong
	// format, or a wrong/missing passphrase).
	CodeBadPrivateKey Code = "bad_private_key"
	// CodeNoAuthMethod means the bastion row carries neither key nor password.
	CodeNoAuthMethod Code = "no_auth_method"
	// CodeViaCycle means the via_uid chain loops.
	CodeViaCycle Code = "via_cycle"
	// CodeViaNotSSH means via_uid points at a row that is not an SSH bastion.
	CodeViaNotSSH Code = "via_not_ssh"
	// CodeHandshakeFailed is an SSH handshake failure that is not an auth
	// rejection (protocol mismatch, no common algorithm, ...).
	CodeHandshakeFailed Code = "handshake_failed"
	// CodeDBAuthFailed means the target accepted the connection but refused the
	// stored database credentials (or the database name).
	CodeDBAuthFailed Code = "db_auth_failed"
	// CodeDBHandshakeFailed means the target was reachable but the protocol
	// handshake did not complete (wrong port, TLS mismatch, not a database).
	CodeDBHandshakeFailed Code = "db_handshake_failed"
	// CodeMissingConfig means the row is missing a field the protocol needs
	// before anything can be dialed (an Oracle row with no service name).
	CodeMissingConfig Code = "missing_config"
	// CodeUnsupported means no protocol-level probe exists for this protocol;
	// reachability was verified but credentials were not.
	CodeUnsupported Code = "auth_not_verified"
	// CodeK8sForbidden means the ServiceAccount authenticated but RBAC denied
	// it — practically always a missing `pods/portforward` verb.
	CodeK8sForbidden Code = "k8s_forbidden"
	// CodeK8sTargetNotFound means no pod or service by that name exists in the
	// cluster row's namespace.
	CodeK8sTargetNotFound Code = "k8s_target_not_found"
	// CodeK8sTargetNotReady means the target exists but no ready pod backs it.
	CodeK8sTargetNotReady Code = "k8s_target_not_ready"
	// CodeK8sCAPinMismatch means the API server's certificate is not vouched
	// for by the CA dbbat pinned on first connect. Distinct from a plain
	// handshake failure because there *was* a working connect: this is the
	// cluster CA rotating, or somebody in the middle, and only an operator can
	// tell which.
	CodeK8sCAPinMismatch Code = "k8s_ca_pin_mismatch"
	// CodeInternal is an unclassified failure.
	CodeInternal Code = "internal_error"
	// CodeOracleServiceNameConflict is a *warning* code, not a failure: this
	// Oracle row's upstream service name is also claimed by rows spelling their
	// host differently, so a client connecting with the shared service name is
	// refused ORA-12514 even though this row itself checks out.
	CodeOracleServiceNameConflict Code = "oracle_service_name_conflict"
)

const (
	// StageConfig covers everything that fails before any packet is sent:
	// missing credentials, an unusable private key, a via_uid cycle.
	StageConfig Stage = "config"
	// StageBastionDial is the TCP dial of the SSH bastion (DNS, routing, firewall).
	StageBastionDial Stage = "bastion_dial"
	// StageBastionAuth is the SSH handshake: host-key verification and auth.
	StageBastionAuth Stage = "bastion_auth"
	// StageTargetDial is the TCP dial of the database target — through the
	// bastion when via_uid is set, direct otherwise.
	StageTargetDial Stage = "target_dial"
	// StageTargetAuth is the protocol-level handshake and login against the
	// database target.
	StageTargetAuth Stage = "target_auth"
	// StageClusterAPI is reaching the Kubernetes API server (DNS, routing,
	// firewall, and the TLS trust established by the pasted CA bundle).
	StageClusterAPI Stage = "cluster_api"
	// StageClusterAuth is the API server accepting the ServiceAccount token.
	StageClusterAuth Stage = "cluster_auth"
	// StageClusterRBAC is the SelfSubjectAccessReview on `pods/portforward`:
	// authenticated, but may we actually open a tunnel in this namespace.
	StageClusterRBAC Stage = "cluster_rbac"
	// StageClusterTarget is resolving the addressed pod (or the ready pod
	// behind `svc/<name>`) and confirming it is Ready.
	StageClusterTarget Stage = "cluster_target"
)