// SPDX-License-Identifier: Apache-2.0
// Copyright Authors of Cilium

package auth

import (
	"errors"

	"github.com/cilium/cilium/api/v1/models"
	"github.com/cilium/cilium/pkg/auth/certs"
	policyTypes "github.com/cilium/cilium/pkg/policy/types"
)

func newAlwaysFailAuthHandler() authHandlerResult {
	return authHandlerResult{
		AuthHandler: &alwaysFailAuthHandler{},
	}
}

// alwaysFailAuthHandler implements an authHandler for auth type always-fail to deny every request.
type alwaysFailAuthHandler struct {
}

func (r *alwaysFailAuthHandler) authenticate(authReq *authRequest) (*authResponse, error) {
	return nil, errors.New("authenticating failed by the always-fail auth handler")
}

func (r *alwaysFailAuthHandler) authType() policyTypes.AuthType {
	return policyTypes.AuthTypeAlwaysFail
}

func (r *alwaysFailAuthHandler) subscribeToRotatedIdentities() <-chan certs.CertificateRotationEvent {
	return nil
}

func (r *alwaysFailAuthHandler) certProviderStatus() *models.Status {
	return nil // reporting no status as we have no cert provider
}
