use irtt_proto::ProtoError;
use thiserror::Error;

/// An internal server failure.
///
/// This type deliberately does **not** describe rejected traffic. Malformed,
/// unauthenticated, unsupported and policy-refused datagrams are not errors:
/// the protocol defines no rejection response, so they are answered with
/// silence and reported as `Ok(None)` from
/// [`ServerCore::handle_datagram`](crate::ServerCore::handle_datagram). An
/// inbound [`ProtoError`] never reaches a caller — that is the whole point of
/// the admission boundary, which turns hostile UDP into a dropped datagram
/// rather than a failure.
///
/// Every variant here is instead something wrong on *this* side, where the
/// server could not do its job for a request it had already accepted.
#[derive(Debug, Error, PartialEq, Eq)]
pub enum ServerError {
    /// The operating system's random source failed, so no session token could
    /// be drawn.
    #[error("the operating system random source failed: {reason}")]
    RandomSource { reason: String },
    /// No unique non-zero token was found within the retry budget.
    ///
    /// Each attempt drew a fresh value and rejected it as zero or as a
    /// collision with a live session. With a working random source this is
    /// vanishingly unlikely; it exists so token allocation cannot spin forever
    /// on a degenerate source.
    #[error("no unique non-zero session token after {attempts} attempts")]
    TokenExhausted { attempts: u32 },
    /// A reply the server itself constructed could not be encoded.
    ///
    /// The `ProtoError` here always describes server-generated bytes, never
    /// anything a peer sent.
    #[error("could not encode a server-generated reply: {source}")]
    ReplyEncoding {
        #[source]
        source: ProtoError,
    },
}