{
  "error": "error_code",
  "error_description": "Human-readable description of the error",
  "error_uri": "https://sigmaidentity.com/docs/errors#error_code"
}

{
  "error": "invalid_request",
  "error_description": "Missing required parameter: client_id"
}

{
  "error": "unauthorized_client",
  "error_description": "Client is not authorized to use this authorization grant type"
}

{
  "error": "access_denied",
  "error_description": "User denied the authorization request"
}

{
  "error": "unsupported_response_type",
  "error_description": "Response type 'token' is not supported"
}

{
  "error": "invalid_scope",
  "error_description": "Requested scope 'admin' is not available"
}

{
  "error": "server_error",
  "error_description": "The authorization server encountered an unexpected condition"
}

{
  "error": "temporarily_unavailable",
  "error_description": "The authorization server is currently unable to handle the request"
}

{
  "error": "invalid_request",
  "error_description": "Missing required parameter: code"
}

{
  "error": "invalid_client",
  "error_description": "Client authentication failed"
}

{
  "error": "invalid_grant",
  "error_description": "Authorization code is invalid or expired"
}

{
  "error": "unauthorized_client",
  "error_description": "Client is not authorized to use this grant type"
}

{
  "error": "unsupported_grant_type",
  "error_description": "Grant type 'password' is not supported"
}

{
  "error": "invalid_scope",
  "error_description": "Requested scope exceeds authorized scope"
}

{
  "error": "invalid_signature",
  "error_description": "Bitcoin signature verification failed"
}

{
  "error": "invalid_timestamp",
  "error_description": "Signature timestamp is too old or too far in the future"
}

{
  "error": "invalid_public_key",
  "error_description": "Public key is not a valid secp256k1 point"
}

{
  "error": "missing_auth_token",
  "error_description": "X-Auth-Token header is required for Bitcoin authentication"
}

{
  "error": "malformed_auth_token",
  "error_description": "Auth token format is invalid"
}

{
  "error": "invalid_token",
  "error_description": "Access token is invalid or expired"
}

{
  "error": "insufficient_scope",
  "error_description": "Token does not have required scope for this resource"
}

{
  "error": "backup_not_found",
  "error_description": "No backup found for this user"
}

{
  "error": "backup_too_large",
  "error_description": "Backup size exceeds maximum allowed limit of 1MB"
}

{
  "error": "invalid_backup_format",
  "error_description": "Backup data is not properly formatted"
}

{
  "error": "encryption_required",
  "error_description": "Backup data must be encrypted before storage"
}

{
  "error": "rate_limit_exceeded",
  "error_description": "Too many requests. Please try again later.",
  "retry_after": 60
}

X-RateLimit-Limit: 100
X-RateLimit-Remaining: 0
X-RateLimit-Reset: 1642248600
Retry-After: 60

{
  "error": "google_auth_failed",
  "error_description": "Google authentication was unsuccessful",
  "provider_error": "access_denied"
}

{
  "error": "github_auth_failed",
  "error_description": "GitHub authentication was unsuccessful",
  "provider_error": "application_suspended"
}

interface SigmaAuthError {
    error: string;
    error_description: string;
    error_uri?: string;
    retry_after?: number;
    provider_error?: string;
}

class SigmaAuthClient {
    async handleError(response: Response): Promise<never> {
        const error: SigmaAuthError = await response.json();
        
        switch (error.error) {
            case 'rate_limit_exceeded':
                const retryAfter = error.retry_after || 60;
                throw new RateLimitError(error.error_description, retryAfter);
                
            case 'invalid_grant':
                // Authorization code expired or invalid
                throw new AuthorizationError(error.error_description);
                
            case 'access_denied':
                // User denied access
                throw new AccessDeniedError(error.error_description);
                
            case 'invalid_signature':
                // Bitcoin signature verification failed
                throw new SignatureError(error.error_description);
                
            default:
                throw new SigmaAuthError(error.error, error.error_description);
        }
    }
}

const retryWithBackoff = async (
    operation: () => Promise<Response>,
    maxRetries: number = 3
): Promise<Response> => {
    for (let attempt = 1; attempt <= maxRetries; attempt++) {
        try {
            const response = await operation();
            
            if (response.ok) {
                return response;
            }
            
            if (response.status === 429) {
                // Rate limited - check retry-after header
                const retryAfter = response.headers.get('retry-after');
                const delay = retryAfter ? parseInt(retryAfter) * 1000 : Math.pow(2, attempt) * 1000;
                
                if (attempt < maxRetries) {
                    await new Promise(resolve => setTimeout(resolve, delay));
                    continue;
                }
            }
            
            if (response.status >= 500 && attempt < maxRetries) {
                // Server error - retry with exponential backoff
                const delay = Math.pow(2, attempt) * 1000;
                await new Promise(resolve => setTimeout(resolve, delay));
                continue;
            }
            
            return response;
        } catch (error) {
            if (attempt === maxRetries) {
                throw error;
            }
            
            // Network error - retry with exponential backoff
            const delay = Math.pow(2, attempt) * 1000;
            await new Promise(resolve => setTimeout(resolve, delay));
        }
    }
    
    throw new Error('Max retries exceeded');
};

const authenticateWithRecovery = async (provider: string) => {
    try {
        return await authenticate(provider);
    } catch (error) {
        if (error instanceof AuthorizationError) {
            // Clear stored authorization code and retry
            clearStoredAuthCode();
            return await authenticate(provider);
        }
        
        if (error instanceof SignatureError) {
            // Regenerate signature with current timestamp
            return await authenticateWithNewSignature(provider);
        }
        
        if (error instanceof RateLimitError) {
            // Wait for rate limit to reset
            await new Promise(resolve => 
                setTimeout(resolve, error.retryAfter * 1000)
            );
            return await authenticate(provider);
        }
        
        throw error;
    }
};

// Client-side debugging
localStorage.setItem('sigma_debug', 'true');

// This will log additional error details to console

const logError = (error: SigmaAuthError, context: any) => {
    const errorData = {
        error: error.error,
        description: error.error_description,
        timestamp: new Date().toISOString(),
        context: context,
        userAgent: navigator.userAgent,
        url: window.location.href
    };
    
    // Send to logging service
    console.error('Sigma Auth Error:', errorData);
};

const validateAuthRequest = (params: AuthParams): void => {
    if (!params.client_id) {
        throw new Error('client_id is required');
    }
    
    if (!params.redirect_uri) {
        throw new Error('redirect_uri is required');
    }
    
    if (!isValidUrl(params.redirect_uri)) {
        throw new Error('redirect_uri must be a valid HTTPS URL');
    }
    
    if (params.provider && !['sigma', 'google', 'github'].includes(params.provider)) {
        throw new Error('Invalid provider specified');
    }
};