authorizer

var (
	// ErrTokenExchangeUnauthorized maps rejected source tokens to 401.
	ErrTokenExchangeUnauthorized = errors.New("token exchange unauthorized")

	// ErrTokenExchangeForbidden signals scope refusal from identity
	// (400 invalid_scope, RFC 6749 §5.2); the middleware projects to 403.
	ErrTokenExchangeForbidden = errors.New("token exchange forbidden")

	// ErrTokenExchangeUnavailable classifies transport and upstream availability failures.
	ErrTokenExchangeUnavailable = errors.New("token exchange unavailable")

	// ErrTokenExchangeFailed indicates token exchange returned a non-retriable
	// non-success response status that is neither 401 nor 5xx.
	ErrTokenExchangeFailed = errors.New("token exchange failed")

	// ErrTokenExchangeInvalidResponse indicates a malformed successful response body.
	ErrTokenExchangeInvalidResponse = errors.New("token exchange invalid response")

	// ErrTokenExchangeMissingAccessToken indicates a successful response omitted
	// the access_token field.
	ErrTokenExchangeMissingAccessToken = errors.New("token exchange response missing access token")

	// ErrPassportInvalid indicates exchange returned an unusable passport payload.
	ErrPassportInvalid = errors.New("passport invalid")
)