sso

var (
	ErrSSONotConfigured = errors.New("SSO not configured for this organization")
	ErrStateExpired     = errors.New("SSO session expired, please try again")
	ErrStateInvalid     = errors.New("invalid SSO state")
	ErrAutoProvisionOff = apierrors.NewForbiddenError("account provisioning is disabled; contact your administrator", nil)
	ErrUserSuspended    = apierrors.NewForbiddenError("account suspended", nil)
	// ErrEmailUnverified fires when the ID token's email claim is not verified
	// by the IdP. Per OIDC spec the `email` claim MUST NOT be trusted for
	// account-binding decisions (auto-provision or login-match) without
	// email_verified==true; otherwise a permissive IdP that lets a user
	// register victim@example.com unverified would let the attacker SSO into
	// the victim's existing account (US-43.10 / F8).
	ErrEmailUnverified = apierrors.NewForbiddenError("identity provider has not verified the email claim", nil)
	// ErrRedirectBaseURLNotSet fires when an SSO flow needs to build an
	// absolute callback URL but oidc.redirectBaseUrl is not configured.
	// Returned instead of deriving the URL from X-Forwarded-* / Host headers
	// (F11): those headers are attacker-influenceable at a misconfigured
	// reverse proxy, and the SSO callback URL is security-sensitive (it is
	// where the IdP redirects with the authorization code). The deployment
	// must state the canonical base URL explicitly.
	ErrRedirectBaseURLNotSet = errors.New("OIDC redirect base URL is not configured; set oidc.redirectBaseUrl")
)

var ErrDNSNotMatching = errors.New("DNS TXT record does not contain the verification token")

var ErrDomainNotClaimed = errors.New("domain is not in claimed domains")

var ErrNoVerificationToken = errors.New("no verification token configured; rotate one first")