"""Exceptions raised by AuthProvider implementations.

These are caught by the route layer and translated to HTTP responses
(401 for :class:`InvalidCredentials`, 501 for :class:`ProviderNotImplemented`).
"""


class AuthProviderError(Exception):
    """Base class for all auth provider errors."""


class InvalidCredentials(AuthProviderError):
    """Raised when username / password is wrong, or the user is inactive.

    Translates to HTTP 401. The error message MUST NOT leak which of
    "user not found" vs "wrong password" vs "user inactive" failed —
    that is a username enumeration risk.
    """


class ProviderNotImplemented(AuthProviderError):
    """Raised when a configured provider is not yet implemented.

    Translates to HTTP 501. Used by :class:`StubOIDCProvider` and any
    future adapter that is registered but has no real implementation.
    """
