"""Custom exceptions for the ECP Auth package.

All exceptions inherit from ``ECPAuthError`` to allow catching
any package-specific error with a single except clause.
"""


class ECPAuthError(Exception):
    """Base exception for all ECP Auth errors.

    Attributes:
        message: Human-readable error description.
    """

    def __init__(self, message: str = "An ECP authentication error occurred.") -> None:
        self.message = message
        super().__init__(self.message)


class CertificateParsingError(ECPAuthError):
    """Raised when a certificate or PKCS#12 file cannot be parsed.

    This may occur due to an invalid file format, corrupted data,
    or an incorrect password for the PKCS#12 container.
    """

    def __init__(self, message: str = "Failed to parse the certificate.") -> None:
        super().__init__(message)


class CertificateValidationError(ECPAuthError):
    """Raised when a certificate fails validation checks.

    Validation failures include expired certificates, untrusted
    certificate chains, revoked certificates, or missing required
    key usage extensions.
    """

    def __init__(self, message: str = "Certificate validation failed.") -> None:
        super().__init__(message)


class CertificateExpiredError(CertificateValidationError):
    """Raised when a certificate has expired or is not yet valid.

    Attributes:
        not_before: The earliest date the certificate is valid.
        not_after: The latest date the certificate is valid.
    """

    def __init__(self, message: str = "The certificate has expired or is not yet valid.") -> None:
        super().__init__(message)


class CertificateRevokedError(CertificateValidationError):
    """Raised when a certificate has been revoked."""

    def __init__(self, message: str = "The certificate has been revoked.") -> None:
        super().__init__(message)


class SignatureVerificationError(ECPAuthError):
    """Raised when a digital signature verification fails.

    This indicates that the signature does not match the expected
    data, the signing algorithm is unsupported, or the public key
    is incompatible.
    """

    def __init__(self, message: str = "Signature verification failed.") -> None:
        super().__init__(message)


class ChallengeError(ECPAuthError):
    """Raised for errors related to the challenge-response protocol.

    This includes expired challenges, missing challenges, or
    challenges that have already been used.
    """

    def __init__(self, message: str = "Challenge-response error.") -> None:
        super().__init__(message)


class ChallengeExpiredError(ChallengeError):
    """Raised when a challenge nonce has expired."""

    def __init__(self, message: str = "The challenge has expired.") -> None:
        super().__init__(message)


class UnsupportedAlgorithmError(ECPAuthError):
    """Raised when an unsupported cryptographic algorithm is encountered."""

    def __init__(self, message: str = "Unsupported cryptographic algorithm.") -> None:
        super().__init__(message)


class AuthenticationFailedError(ECPAuthError):
    """Raised when ECP authentication fails for any reason.

    This is a high-level error that wraps more specific errors
    from the authentication pipeline.
    """

    def __init__(self, message: str = "ECP authentication failed.") -> None:
        super().__init__(message)
