import { RestApiClient } from '@docyrus/api-client';

/** Duck-typed cookie object (compatible with Next.js `cookies()` from `next/headers`) */
interface ReadonlyCookieStore {
    get(name: string): {
        name: string;
        value: string;
    } | undefined;
}
/** Duck-typed cookie object with write access (compatible with `NextRequest.cookies`) */
interface CookieStore extends ReadonlyCookieStore {
    set(name: string, value: string, options?: CookieSetOptions): void;
    delete(name: string): void;
}
interface CookieSetOptions {
    path?: string;
    maxAge?: number;
    httpOnly?: boolean;
    secure?: boolean;
    sameSite?: 'lax' | 'strict' | 'none';
}
/** Duck-typed Next.js middleware request (compatible with `NextRequest`) */
interface MiddlewareRequest {
    cookies: ReadonlyCookieStore;
    nextUrl: {
        pathname: string;
    };
    url: string;
}
/** Configuration for server-side client creation */
interface ServerClientConfig {
    /** API base URL. Defaults to `https://alpha-api.docyrus.com` */
    apiUrl?: string;
    /** Cookie key for the access token. Default: `'docyrus-token'` */
    cookieKey?: string;
}
/** Auth session information available on the server */
interface AuthSession {
    /** The raw access token (null if not present) */
    accessToken: string | null;
    /** Whether the user is authenticated (cookie present → token not expired) */
    isAuthenticated: boolean;
}
/** Configuration for the pre-built auth middleware */
interface AuthMiddlewareConfig {
    /**
     * Route patterns that require authentication (supports `(.*)` glob).
     * When omitted, all routes **except** `publicRoutes` are protected.
     */
    protectedRoutes?: string[];
    /**
     * Route patterns that are always accessible without auth.
     * Default: `['/login', '/auth/callback']`
     */
    publicRoutes?: string[];
    /** Path to redirect unauthenticated users to. Default: `'/login'` */
    loginPath?: string;
    /** Path to redirect authenticated users when they visit loginPath. Default: `'/'` */
    afterLoginPath?: string;
    /** Cookie key for the access token. Default: `'docyrus-token'` */
    cookieKey?: string;
}

/**
 * Create an authenticated `RestApiClient` for use in Next.js
 * Server Components, Server Actions, and Route Handlers.
 *
 * Reads the access token from cookies. The client cannot refresh tokens —
 * that is handled client-side by `DocyrusAuthProvider`.
 *
 * @example Server Component
 * ```ts
 * import { cookies } from 'next/headers';
 * import { createServerClient } from '@docyrus/signin/nextjs';
 *
 * export default async function Page() {
 *   const client = createServerClient(await cookies());
 *   const { data: user } = await client.get('/v1/users/me');
 *   return <div>{user.name}</div>;
 * }
 * ```
 *
 * @example Server Action
 * ```ts
 * 'use server';
 * import { cookies } from 'next/headers';
 * import { createServerClient } from '@docyrus/signin/nextjs';
 *
 * export async function getUser() {
 *   const client = createServerClient(await cookies());
 *   return client.get('/v1/users/me');
 * }
 * ```
 */
declare function createServerClient(cookieStore: ReadonlyCookieStore, config?: ServerClientConfig): RestApiClient;

/**
 * Read the current auth session from cookies.
 *
 * Because the SSR cookie is written with `max-age` matching the token
 * lifetime, the browser automatically removes it once the token expires.
 * If the cookie is present the token is considered valid.
 *
 * Works in Server Components, Server Actions, Route Handlers, and Middleware.
 *
 * @example
 * ```ts
 * import { cookies } from 'next/headers';
 * import { getSession } from '@docyrus/signin/nextjs';
 * import { redirect } from 'next/navigation';
 *
 * export default async function Page() {
 *   const session = getSession(await cookies());
 *   if (!session.isAuthenticated) redirect('/login');
 *   // ...
 * }
 * ```
 */
declare function getSession(cookieStore: ReadonlyCookieStore, cookieKey?: string): AuthSession;

/**
 * Read the auth session from middleware request cookies.
 *
 * Use this when you need full control over your middleware logic.
 *
 * @example
 * ```ts
 * import { NextResponse, type NextRequest } from 'next/server';
 * import { getMiddlewareSession } from '@docyrus/signin/nextjs';
 *
 * export function middleware(request: NextRequest) {
 *   const session = getMiddlewareSession(request);
 *   if (!session.isAuthenticated && request.nextUrl.pathname.startsWith('/dashboard')) {
 *     return NextResponse.redirect(new URL('/login', request.url));
 *   }
 *   return NextResponse.next();
 * }
 * ```
 */
declare function getMiddlewareSession(request: MiddlewareRequest, cookieKey?: string): AuthSession;
/**
 * Create an authenticated `RestApiClient` for use in Next.js middleware.
 *
 * @example
 * ```ts
 * import { type NextRequest } from 'next/server';
 * import { createMiddlewareClient } from '@docyrus/signin/nextjs';
 *
 * export function middleware(request: NextRequest) {
 *   const client = createMiddlewareClient(request);
 *   // use client for API calls if needed
 * }
 * ```
 */
declare function createMiddlewareClient(request: MiddlewareRequest, config?: ServerClientConfig): RestApiClient;
/**
 * Pre-built auth middleware for route protection.
 *
 * Uses standard `Response.redirect()` for redirects and returns `undefined`
 * for pass-through (Next.js treats this as "continue to next middleware/page").
 *
 * @example
 * ```ts
 * // middleware.ts
 * import { authMiddleware } from '@docyrus/signin/nextjs';
 *
 * export default authMiddleware({
 *   publicRoutes: ['/login', '/callback'],
 *   loginPath: '/login',
 * });
 *
 * export const config = {
 *   matcher: ['/((?!_next/static|_next/image|favicon.ico|.*\\..*).*)'],
 * };
 * ```
 */
declare function authMiddleware(config?: AuthMiddlewareConfig): (request: MiddlewareRequest) => Response | undefined;

export { type AuthMiddlewareConfig, type AuthSession, type CookieStore, type MiddlewareRequest, type ReadonlyCookieStore, type ServerClientConfig, authMiddleware, createMiddlewareClient, createServerClient, getMiddlewareSession, getSession };