oauth2

const (
	AuthErrorCodeInvalidRequest           AuthErrorCode = "invalid_request"
	AuthErrorCodeUnauthorizedClient       AuthErrorCode = "unauthorized_client"
	AuthErrorCodeAccessDenied             AuthErrorCode = "access_denied"
	AuthErrorCodeUnsupportedResponseType  AuthErrorCode = "unsupported_response_type"
	AuthErrorCodeInvalidScope             AuthErrorCode = "invalid_scope"
	AuthErrorCodeErrServerError           AuthErrorCode = "server_error"
	AuthErrorCodeErrTemporarilyUnvailable AuthErrorCode = "temporarily_unavailable"
)

const (
	// The request is missing a required parameter, includes an unsupported
	// parameter or parameter value, repeats the same parameter, uses more than
	// one method for including an access token, or is otherwise malformed.  The
	// resource server SHOULD respond with the HTTP 400 (Bad Request) status
	// code.
	BearerErrorCodeInvalidRequest BearerErrorCode = "invalid_request"
	// The access token provided is expired, revoked, malformed, or invalid for
	// other reasons.  The resource SHOULD respond with the HTTP 401
	// (Unauthorized) status code.  The client MAY request a new access token
	// and retry the protected resource request.
	BearerErrorCodeInvalidToken BearerErrorCode = "invalid_token"
	// The request requires higher privileges than provided by the access token.
	// The resource server SHOULD respond with the HTTP 403 (Forbidden) status
	// code and MAY include the "scope" attribute with the scope necessary to
	// access the protected resource.
	BearerErrorCodeInsufficientScope BearerErrorCode = "insufficient_scope"
)

const (
	GrantTypeAuthorizationCode GrantType = "authorization_code"
	GrantTypeRefreshToken      GrantType = "refresh_token"
)

const (
	ResponseTypeCode     ResponseType = "code"
	ResponseTypeImplicit ResponseType = "token"

	CodeChallengeMethodS256 = "S256"
)

const (
	// TokenErrorCodeInvalidRequest: The request is missing a required
	// parameter, includes an unsupported parameter value (other than grant
	// type), repeats a parameter, includes multiple credentials, utilizes more
	// than one mechanism for authenticating the client, or is otherwise
	// malformed.
	TokenErrorCodeInvalidRequest TokenErrorCode = "invalid_request"
	// TokenErrorCodeInvalidClient: Client authentication failed (e.g., unknown
	// client, no client authentication included, or unsupported authentication
	// method).  The authorization server MAY return an HTTP 401 (Unauthorized)
	// status code to indicate which HTTP authentication schemes are supported.
	// If the client attempted to authenticate via the "Authorization" request
	// header field, the authorization server MUST respond with an HTTP 401
	// (Unauthorized) status code and include the "WWW-Authenticate" response
	// header field matching the authentication scheme used by the client.
	TokenErrorCodeInvalidClient TokenErrorCode = "invalid_client"
	// TokenErrorCodeInvalidGrant: The provided authorization grant (e.g.,
	// authorization code, resource owner credentials) or refresh token is
	// invalid, expired, revoked, does not match the redirection URI used in the
	// authorization request, or was issued to another client.
	TokenErrorCodeInvalidGrant TokenErrorCode = "invalid_grant"
	// TokenErrorCodeUnauthorizedClient: The authenticated client is not
	// authorized to use this authorization grant type.
	TokenErrorCodeUnauthorizedClient TokenErrorCode = "unauthorized_client"
	// TokenErrorCodeUnsupportedGrantType: The authorization grant type is not
	// supported by the authorization server.
	TokenErrorCodeUnsupportedGrantType TokenErrorCode = "unsupported_grant_type"
	// TokenErrorCodeInvalidScope: The requested scope is invalid, unknown,
	// malformed, or exceeds the scope granted by the resource owner.
	TokenErrorCodeInvalidScope TokenErrorCode = "invalid_scope"
)

const (
	TokenTypeBearer TokenType = "Bearer"
)