errors.go

package authkit

import (
	"encoding/json"
	"errors"
	"strings"
)

// Invitation and access code errors.
var (
	// ErrInvalidAccessCode is returned when an access code format is invalid.
	ErrInvalidAccessCode = errors.New("invalid access code format")

	// ErrAccessCodeExpired is returned when an access code has expired.
	ErrAccessCodeExpired = errors.New("access code has expired")

	// ErrAccessCodeUsed is returned when an access code has already been used.
	ErrAccessCodeUsed = errors.New("access code has already been used")

	// ErrInvitationNotFound is returned when an invitation cannot be found.
	ErrInvitationNotFound = errors.New("invitation not found")

	// ErrInvitationExpired is returned when an invitation has expired.
	ErrInvitationExpired = errors.New("invitation has expired")
)

// Organization errors.
var (
	// ErrUnauthorizedOrgAction is returned when a user attempts an action
	// they don't have permission for within an organization.
	ErrUnauthorizedOrgAction = errors.New("unauthorized organization action")

	// ErrUserAlreadyExists is returned when attempting to create a user
	// that already exists in the identity provider.
	ErrUserAlreadyExists = errors.New("user already exists")
)

// APIError represents a structured error from the Zitadel API.
type APIError struct {
	StatusCode int
	Code       int      `json:"code"`
	Message    string   `json:"message"`
	Details    []Detail `json:"details,omitempty"`
	RawBody    string
}

// Detail represents additional error details from the Zitadel API.
type Detail struct {
	Type    string `json:"@type"`
	ID      string `json:"id"`
	Message string `json:"message"`
}

func (e *APIError) Error() string {
	if e.Message != "" {
		return e.Message
	}
	return e.RawBody
}

// UserMessage returns a user-friendly error message extracted from the API error.
func (e *APIError) UserMessage() string {
	if len(e.Details) > 0 && e.Details[0].Message != "" {
		return e.Details[0].Message
	}
	if e.Message != "" {
		msg := e.Message
		if idx := strings.Index(msg, " ("); idx > 0 {
			msg = msg[:idx]
		}
		return msg
	}
	return "An unexpected error occurred"
}

// NewAPIError creates a new APIError from an HTTP status code and response body.
func NewAPIError(statusCode int, body []byte) *APIError {
	apiErr := &APIError{
		StatusCode: statusCode,
		RawBody:    string(body),
	}
	json.Unmarshal(body, apiErr)
	return apiErr
}

// IsAPIError checks if an error is an APIError and returns it if so.
func IsAPIError(err error) (*APIError, bool) {
	var apiErr *APIError
	if errors.As(err, &apiErr) {
		return apiErr, true
	}
	return nil, false
}