"""Error constants."""

UNAUTHORIZED_CODE = 'request_unauthorized'

AUTH_NOT_FOUND = 'AUTH_NOT_FOUND'
AUTH_EXPIRED = 'AUTH_EXPIRED'
AUTH_EXPIRED_MESSAGE = 'authorization expired by {expired_by_in_unix_time} ' \
    'unix time. token created at {created_at} unix time. ' \
    'request time is {request_time}, system time is {current_time} unix time.'
HMAC_MISMATCH = 'HMAC_MISMATCH'
SENDER_MISMATCH = 'SENDER_MISMATCH'
UNAUTHORIZED_MESSAGE = {
    AUTH_NOT_FOUND: 'authorization not found',
    AUTH_EXPIRED: AUTH_EXPIRED_MESSAGE,
    HMAC_MISMATCH: 'hmac does not match',
    SENDER_MISMATCH: 'sender does not match'}

UNAUTHORIZED_LOGGLY_MESSAGE = 'The service has received an unauthorized ' \
    'request in {environment} for {user_id} ' \
    '(cid: {correlation_id}). Error status: {error_status}. ' \
    'Error code: {error_code}. Error message: {error_message}.'

NO_AUTHORIZATION_MESSAGE = 'The service has received request without ' \
    'authorization header in {environment} for user_id: {user_id} ' \
    'with cid: {correlation_id}. Request method: {request_method}, ' \
    'url: {request_url}, body: {request_body}'
NO_GRASS_HEADERS_MESSAGE = 'The service has received request without ' \
    'GRASS headers in {environment} with cid: {correlation_id}. ' \
    'Request method: {request_method}, url: {request_url}, ' \
    'body: {request_body}'
ACCESS_DENIED_MESSAGE = 'The service has received an unauthorized ' \
    'request ({method} {path}) for {profile_id} ' \
    'profile (account) type: {profile_type}, roles: {roles}' \
    '(cid: {correlation_id}). '
LOG_NON_GRASS_HEADERS_ACCESS = None
SKIP_ROLE_CHECK_MESSAGE = 'Request from another microservice ({}), ' \
    'skipping role check.'

# standard error codes
ERROR_CODE_AUTHORIZATION = 'authorization_error'
ERROR_CODE_BAD_GRASS_REQUEST = 'bad_grass_request'
ERROR_CODE_BAD_REQUEST = 'bad_request'
ERROR_CODE_NOT_FOUND = 'not_found'
ERROR_CODE_BAD_HEADERS = 'bad_headers'

# error responses

# account-based responses
ERROR_CODE_INCOMPLETE_GRASS_HEADERS = ERROR_CODE_AUTHORIZATION
ERROR_MESSAGE_INCOMPLETE_GRASS_HEADERS = 'incomplete account headers'

ERROR_CODE_MISSING_GRASS_HEADERS = ERROR_CODE_BAD_GRASS_REQUEST
ERROR_MESSAGE_MISSING_GRASS_HEADERS = 'missing account headers'

ERROR_CODE_UNEXPECTED_GRASS_HEADERS = 'unexpected_grass_headers'
ERROR_MESSAGE_UNEXPECTED_GRASS_HEADERS = 'grass headers should not be supplied'

ERROR_CODE_ACCOUNT_WITHOUT_USER = 'account_without_user'
ERROR_MESSAGE_ACCOUNT_WITHOUT_USER = 'context has account without user'

ERROR_CODE_FORBIDDEN_USER = ERROR_CODE_AUTHORIZATION
ERROR_MESSAGE_FORBIDDEN_USER = 'user is forbidden'

ERROR_CODE_FORBIDDEN = ERROR_CODE_AUTHORIZATION
ERROR_MESSAGE_FORBIDDEN = 'access denied'

ERROR_CODE_USER_DOES_NOT_EXIST = ERROR_CODE_NOT_FOUND
ERROR_MESSAGE_USER_DOES_NOT_EXIST = 'user does not exist'

ERROR_CODE_USER_MISMATCH = 'user_mismatch'
ERROR_MESSAGE_USER_MISMATCH = 'user does not match account headers'

ERROR_CODE_SUBACCOUNT_DOES_NOT_EXIST = ERROR_CODE_NOT_FOUND
ERROR_MESSAGE_SUBACCOUNT_DOES_NOT_EXIST = 'subaccount does not exist'

ERROR_CODE_VENDOR_MISMATCH = 'vendor_mismatch'
ERROR_MESSAGE_VENDOR_MISMATCH = 'vendor does not not match'

ERROR_CODE_SUBACCOUNT_MISMATCH = 'subaccount_mismatch'
ERROR_MESSAGE_SUBACCOUNT_MISMATCH = 'subaccount does not match'

# profile-based responses
ERROR_CODE_INCOMPLETE_PROFILE_HEADERS = ERROR_CODE_BAD_REQUEST
ERROR_MESSAGE_INCOMPLETE_PROFILE_HEADERS = (
    'invalid combination of profile_type, profile_id, and identity_id')

ERROR_CODE_PROFILE_TYPE_MISMATCH = 'profile_type_mismatch'
ERROR_MESSAGE_PROFILE_TYPE_MISMATCH = (
    'profile type does not match profile headers')

ERROR_CODE_PROFILE_ID_MISMATCH = 'profile_id_mismatch'
ERROR_MESSAGE_PROFILE_ID_MISMATCH = 'profile id does not match profile headers'

ERROR_CODE_IDENTITY_ID_MISMATCH = 'identity_id_mismatch'
ERROR_MESSAGE_IDENTITY_ID_MISMATCH = (
    'identity id does not match profile headers')

ERROR_MESSAGE_INVALID_GRASS_ACCOUNT_TYPE = 'Invalid Grass Account Type'

INVALID_CLAIM = 'Invalid claims'
INVALID_TOKEN = 'Invalid token'
UNAUTHORIZED_JWT_MESSAGE = {
    AUTH_EXPIRED: 'Auth Token has expired',
    INVALID_CLAIM: 'Incorrect claims, please check the audience and issuer for'
                   ' the Auth Token. {msg}',
    INVALID_TOKEN: 'Unable to parse authentication token {msg}'}
INVALID_CLAIM_FORMAT = 'Invalid aud claim format in token'
MISSING_AUD_CLAIM = 'aud claim expected, but not in claims'