import { BadRequestException, HttpStatus } from '@nestjs/common';

/**
 * RFC 6749 §5.2 — `invalid_grant`: provided authorization grant (password, refresh_token,
 * etc.) is invalid, expired, revoked, does not match the redirection URI used in the
 * authorization request, or was issued to another client. Returned with HTTP 400.
 *
 * Critically, this single error covers ALL credential-related failure modes in the
 * password grant flow (user not found, password mismatch, account inactive, refresh token
 * expired, refresh token revoked, refresh token unknown) to prevent enumeration attacks
 * per RFC 6819 §5.3.4.
 *
 * `statusCode` is included in the body so the NestJS Apollo driver's
 * `createTransformHttpErrorFn` sets `extensions.originalError`. Without it the field
 * is absent and any frontend code reading `originalError.error` silently receives undefined.
 */
export class InvalidGrantError extends BadRequestException {
  constructor() {
    super({ statusCode: HttpStatus.BAD_REQUEST, error: 'invalid_grant' });
  }
}
