common

var (
	ErrInvalidToken                            = errors.Sentinel("invalid token")
	ErrExpiredToken                            = errors.Sentinel("token expired")
	ErrTokenVersionMismatch                    = errors.Sentinel("token version mismatch")
	ErrUserNotFound                            = errors.Sentinel("user not found")
	ErrAmbiguousUserEmail                      = Classify(ErrConflict, errors.Sentinel("multiple accounts share this email"))
	ErrTokenValidation                         = Classify(ErrUnauthorized, errors.Sentinel("Invalid token claims"))
	ErrSessionRevoked                          = Classify(ErrUnauthorized, errors.Sentinel("Session has been revoked"))
	ErrUpgradeInProgress                       = Classify(ErrConflict, errors.Sentinel("an upgrade is already in progress"))
	ErrUpdateAllInProgress                     = Classify(ErrConflict, errors.Sentinel("an update-all job is already in progress"))
	ErrTemplateNotFound                        = Classify(ErrNotFound, errors.Sentinel("Template not found"))
	ErrInvalidEnvKey                           = Classify(ErrValidation, errors.Sentinel("Invalid environment key"))
	ErrGlobalVariableNotFound                  = Classify(ErrNotFound, errors.Sentinel("Global variable not found"))
	ErrGlobalVariableConflict                  = Classify(ErrConflict, errors.Sentinel("Global variable already exists"))
	ErrGlobalVariableScopeRequired             = Classify(ErrValidation, errors.Sentinel("At least one environment is required when a variable is not scoped to all environments"))
	ErrGlobalVariableSecretValueRequired       = Classify(ErrValidation, errors.Sentinel("A new value is required when making a secret variable readable"))
	ErrSwarmNotEnabled                         = Classify(ErrBadRequest, errors.Sentinel("Swarm mode is not enabled"))
	ErrSwarmManagerRequired                    = Classify(ErrForbidden, errors.Sentinel("Swarm manager access required"))
	ErrRoleNotFound                            = Classify(ErrNotFound, errors.Sentinel("Role not found"))
	ErrRoleBuiltIn                             = Classify(ErrForbidden, errors.Sentinel("Built-in role cannot be modified"))
	ErrRoleNameTaken                           = Classify(ErrConflict, errors.Sentinel("Role name already in use"))
	ErrUnknownPermission                       = Classify(ErrValidation, errors.Sentinel("Unknown permission"))
	ErrRolePermissionEscalation                = Classify(ErrForbidden, errors.Sentinel("cannot grant a permission you do not hold"))
	ErrInvalidRoleAssignment                   = Classify(ErrBadRequest, errors.Sentinel("invalid role assignment"))
	ErrFederatedCredentialNotFound             = Classify(ErrNotFound, errors.Sentinel("federated credential not found"))
	ErrFederatedCredentialInvalid              = Classify(ErrValidation, errors.Sentinel("invalid federated credential"))
	ErrFederatedCredentialInvalidRequest       = Classify(ErrBadRequest, errors.Sentinel("invalid federated token exchange request"))
	ErrFederatedCredentialInvalidGrant         = Classify(ErrUnauthorized, errors.Sentinel("invalid federated token grant"))
	ErrFederatedCredentialPermissionEscalation = Classify(ErrForbidden, errors.Sentinel("cannot map a federated credential to a role you do not hold"))
	ErrOidcMappingNotFound                     = Classify(ErrNotFound, errors.Sentinel("OIDC role mapping not found"))
	ErrOidcMappingEnvManaged                   = Classify(ErrConflict, errors.Sentinel("OIDC role mapping is managed by OIDC_ROLE_MAPPINGS and cannot be edited at runtime"))
	ErrNoGlobalAdminRemains                    = Classify(ErrConflict, errors.Sentinel("At least one user must retain a global Admin role assignment"))
	ErrProjectNotFound                         = Classify(ErrNotFound, errors.Sentinel("Project not found"))
	ErrProjectArchived                         = Classify(ErrConflict, errors.Sentinel("project is archived and must be unarchived before this action"))
	ErrProjectMustBeStopped                    = Classify(ErrConflict, errors.Sentinel("project must be stopped before archiving"))
	ErrProjectWorkspaceConflict                = Classify(ErrConflict, errors.Sentinel("Project workspace changed; refresh it and try again"))
	ErrProjectWorkspaceForbidden               = Classify(ErrForbidden, errors.Sentinel("Forbidden project workspace path"))
	ErrProjectWorkspaceBadRequest              = Classify(ErrBadRequest, errors.Sentinel("Invalid project workspace request"))
	ErrProjectWorkspaceNotFound                = Classify(ErrNotFound, errors.Sentinel("Project workspace file not found"))
	ErrVolumeWorkspaceConflict                 = Classify(ErrConflict, errors.Sentinel("Volume workspace changed; refresh it and try again"))
	ErrVolumeWorkspaceForbidden                = Classify(ErrForbidden, errors.Sentinel("Forbidden volume workspace path"))
	ErrVolumeWorkspaceBadRequest               = Classify(ErrBadRequest, errors.Sentinel("Invalid volume workspace request"))
	ErrVolumeWorkspaceNotFound                 = Classify(ErrNotFound, errors.Sentinel("Volume workspace file not found"))
	ErrProjectComposeFileNotFound              = Classify(ErrNotFound, errors.Sentinel("Project compose file not found"))
	ErrComposeFileNotFound                     = Classify(ErrNotFound, errors.Sentinel("no compose file found"))
	ErrEnvironmentInvalidProxyTarget           = Classify(ErrBadRequest, errors.Sentinel("Invalid proxy target URL"))
	ErrEnvironmentConnectionTestFailed         = Classify(ErrBadRequest, errors.Sentinel("Environment connection test failed"))
	ErrUnsafeRemoteURL                         = Classify(ErrBadRequest, errors.Sentinel("Remote URL is not allowed"))
	ErrImageScanInProgress                     = Classify(ErrConflict, errors.Sentinel("an image update check is already in progress"))
	ErrInvalidNotificationPayloadTemplate      = Classify(ErrValidation, errors.Sentinel("invalid generic webhook payload template"))
	ErrRedeployAfterSyncFailed                 = errors.Sentinel("redeploy failed")
	ErrGitOpsSyncProjectBindingBroken          = errors.Sentinel("GitOps sync project binding broken")
	ErrUploadSessionNotFound                   = Classify(ErrNotFound, errors.Sentinel("Upload session not found"))
	ErrUploadSessionIncomplete                 = Classify(ErrConflict, errors.Sentinel("Upload session is incomplete"))
	ErrUploadKindMismatch                      = Classify(ErrBadRequest, errors.Sentinel("Upload session kind does not match this endpoint"))
	ErrUploadChunkInvalid                      = Classify(ErrValidation, errors.Sentinel("Invalid upload chunk"))
	ErrUploadSessionInvalid                    = Classify(ErrValidation, errors.Sentinel("Invalid upload session request"))
)

var SystemUser = User{
	Username: "System",
}