/**
 * Agentic QE v3 - MCP Security: OAuth 2.1 Provider
 * OAuth 2.1 + PKCE implementation for enterprise authentication (ADR-012)
 *
 * Features:
 * - OAuth 2.1 compliant (requires PKCE for all clients)
 * - Authorization Code Flow with PKCE
 * - Token management with refresh tokens
 * - Scope-based authorization
 * - Token introspection and revocation
 */
/**
 * OAuth 2.1 Grant Types (subset of OAuth 2.0)
 */
export type OAuth21GrantType = 'authorization_code' | 'refresh_token' | 'client_credentials';
/**
 * Token types
 */
export type TokenType = 'access_token' | 'refresh_token';
/**
 * PKCE code challenge method
 */
export type PKCEMethod = 'S256' | 'plain';
/**
 * OAuth client configuration
 */
export interface OAuth21Client {
    clientId: string;
    clientSecret?: string;
    redirectUris: string[];
    allowedScopes: string[];
    allowedGrantTypes: OAuth21GrantType[];
    confidential: boolean;
    requirePKCE: boolean;
    accessTokenTTL: number;
    refreshTokenTTL: number;
    metadata?: Record<string, unknown>;
}
/**
 * Authorization request parameters
 */
export interface AuthorizationRequest {
    clientId: string;
    redirectUri: string;
    responseType: 'code';
    scope: string;
    state: string;
    codeChallenge: string;
    codeChallengeMethod: PKCEMethod;
    nonce?: string;
}
/**
 * Authorization code stored data
 */
export interface AuthorizationCode {
    code: string;
    clientId: string;
    redirectUri: string;
    scope: string;
    userId: string;
    codeChallenge: string;
    codeChallengeMethod: PKCEMethod;
    expiresAt: number;
    nonce?: string;
}
/**
 * Token request parameters
 */
export interface TokenRequest {
    grantType: OAuth21GrantType;
    clientId: string;
    clientSecret?: string;
    code?: string;
    redirectUri?: string;
    codeVerifier?: string;
    refreshToken?: string;
    scope?: string;
}
/**
 * Token response
 */
export interface TokenResponse {
    accessToken: string;
    tokenType: 'Bearer';
    expiresIn: number;
    refreshToken?: string;
    scope: string;
}
/**
 * Token data stored
 */
export interface TokenData {
    token: string;
    tokenHash: string;
    type: TokenType;
    clientId: string;
    userId?: string;
    scope: string;
    expiresAt: number;
    issuedAt: number;
    refreshTokenHash?: string;
}
/**
 * Token introspection response
 */
export interface TokenIntrospection {
    active: boolean;
    scope?: string;
    clientId?: string;
    username?: string;
    tokenType?: string;
    exp?: number;
    iat?: number;
    sub?: string;
}
/**
 * OAuth error response
 */
export interface OAuthError {
    error: OAuthErrorCode;
    errorDescription?: string;
    errorUri?: string;
}
/**
 * OAuth error codes
 */
export type OAuthErrorCode = 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'unauthorized_client' | 'unsupported_grant_type' | 'invalid_scope' | 'server_error' | 'access_denied';
/**
 * Provider configuration
 */
export interface OAuth21ProviderConfig {
    issuer: string;
    authorizationEndpoint: string;
    tokenEndpoint: string;
    introspectionEndpoint?: string;
    revocationEndpoint?: string;
    defaultAccessTokenTTL: number;
    defaultRefreshTokenTTL: number;
    requirePKCE: boolean;
    allowedScopes: string[];
}
/**
 * OAuth 2.1 Provider with PKCE support
 */
export declare class OAuth21Provider {
    private readonly config;
    private readonly clients;
    private readonly authorizationCodes;
    private readonly tokens;
    private readonly revokedTokens;
    private cleanupTimer;
    constructor(config: OAuth21ProviderConfig);
    /**
     * Register a new client
     */
    registerClient(client: OAuth21Client): void;
    /**
     * Get client by ID
     */
    getClient(clientId: string): OAuth21Client | undefined;
    /**
     * Remove a client
     */
    removeClient(clientId: string): boolean;
    /**
     * Validate authorization request and create authorization code
     */
    authorize(request: AuthorizationRequest, userId: string): {
        code: string;
        state: string;
    };
    /**
     * Exchange authorization code or refresh token for tokens
     */
    token(request: TokenRequest): TokenResponse;
    private handleAuthorizationCodeGrant;
    private handleRefreshTokenGrant;
    private handleClientCredentialsGrant;
    /**
     * Introspect a token
     */
    introspect(token: string): TokenIntrospection;
    /**
     * Validate an access token
     */
    validateAccessToken(token: string): {
        valid: true;
        data: TokenData;
    } | {
        valid: false;
        error: string;
    };
    /**
     * Revoke a token
     */
    revoke(token: string, tokenType?: TokenType): boolean;
    /**
     * Revoke all tokens for a user
     */
    revokeAllUserTokens(userId: string): number;
    /**
     * Generate a PKCE code verifier
     */
    generateCodeVerifier(): string;
    /**
     * Generate a PKCE code challenge from verifier
     */
    generateCodeChallenge(verifier: string, method?: PKCEMethod): string;
    private computeCodeChallenge;
    /**
     * Dispose the provider
     */
    dispose(): void;
    private generateTokens;
    private generateToken;
    private hashToken;
    private timingSafeCompare;
    private createError;
    private startCleanup;
}
/**
 * Create a new OAuth 2.1 provider
 */
export declare function createOAuth21Provider(config?: Partial<OAuth21ProviderConfig>): OAuth21Provider;
/**
 * Get the default OAuth 2.1 provider instance
 */
export declare function getOAuth21Provider(): OAuth21Provider;
//# sourceMappingURL=oauth21-provider.d.ts.map