/// Error types for the HTTPS mTLS tunnel.
///
/// All errors are designed to be actionable and fail-closed — they never
/// silently degrade to an insecure path.
use thiserror::Error;

/// Errors that occur when loading or configuring TLS material.
#[derive(Debug, Error)]
pub enum TlsError {
    #[error("missing {0}")]
    Missing(&'static str),

    #[error("invalid {0}: {1}")]
    Invalid(&'static str, String),

    #[error("certificate identity mismatch: {0}")]
    IdentityMismatch(String),

    #[error("certificate expired: {0}")]
    Expired(String),

    #[error("certificate verification failed: {0}")]
    VerificationFailed(String),

    #[error("I/O error: {0}")]
    Io(#[from] std::io::Error),
}

/// Errors that occur during application-level authentication.
#[derive(Debug, Error)]
pub enum AuthError {
    #[error("auth token missing")]
    Missing,

    #[error("auth token invalid")]
    Invalid,

    #[error("auth not yet completed")]
    NotAuthenticated,
}

/// Errors that occur during tunnel lifecycle operations.
#[derive(Debug, Error)]
pub enum TunnelError {
    #[error("TLS error: {0}")]
    Tls(#[from] TlsError),

    #[error("auth error: {0}")]
    Auth(#[from] AuthError),

    #[error("bind error on {0}: {1}")]
    BindError(String, String),

    #[error("connection refused: {0}")]
    #[allow(dead_code)]
    ConnectionRefused(String),

    #[error("port {0} already in use")]
    PortInUse(u16),

    #[error("I/O error: {0}")]
    Io(#[from] std::io::Error),

    #[error("protocol error: {0}")]
    Protocol(String),

    #[error("hostname error: {0}")]
    Host(#[from] HostError),
}

/// Errors returned during hostname resolution.
#[derive(Debug, Error)]
pub enum HostError {
    #[error("DNS resolution failed for '{0}': {1}")]
    DnsResolution(String, String),

    #[error("hostname '{0}' is empty or invalid")]
    InvalidHostname(String),

    #[error("no addresses resolved for '{0}'")]
    NoAddresses(String),
}