import { $Fetch } from 'ofetch';
import { IAuthSessionResponse, ICmsUser, IIdpLinkCallbackResponse, ILoginPayload, IMeResponse, IUsersQuery } from './auth.type';
export type { IIdpLinkCallbackResponse, ILinkedIdentity, IMeResponse } from './auth.type';
export interface IAuthServiceOptions {
    /** The CMS `$Fetch` instance (one of `sdk.apis`). */
    api: $Fetch;
    /**
     * Optional `$Fetch` for token-lifecycle flows (login/logout/token). The
     * Nuxt module points this at `/api/cms/*` server routes so those flows set
     * the httpOnly cookie atomically and return the token in the body. When
     * omitted, token-lifecycle flows call the backend directly via `api` (token
     * captured by the `createApi` `onResponse` hook).
     */
    routeApi?: $Fetch;
    /** Lazy flag — when true, the service returns fake data. */
    mock: () => boolean;
}
/** Session response possibly augmented with `token` (when served via a route). */
export type IAuthRouteResponse = IAuthSessionResponse & {
    token?: string;
};
/** Response of the OAuth token (refresh) endpoint. */
export interface ITokenResponse {
    /** New access token (present when served via the Nuxt proxy). */
    token?: string;
    accessToken?: string;
    refreshToken?: string;
    [key: string]: unknown;
}
/** Response of `POST /api/v1/auth/oauth/cbs/start` ("Login with CBS" init). */
export interface ICbsStartResponse {
    /** CBS `/oauth/authorize` URL (carries the PKCE challenge) the browser navigates to. */
    authorizeUrl: string;
    /** Opaque handle echoed back to `/cbs-callback`; pairs the flow with the server-side PKCE/state. */
    stateKey: string;
    /** Same as `authorizeUrl` (kept for client-API symmetry). */
    redirectTarget: string;
}
/**
 * Registered IdP SSO provider names (api_references §2). Only providers the
 * engine has credentials for are active — others 404 on the login init.
 */
export type AuthIdpProvider = 'microsoft' | (string & {});
/** Response of the IdP SSO login init (`GET /api/auth/{provider}/login`). */
export interface IIdpLoginStartResponse {
    /** Provider authorize URL (e.g. `login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize`) — the browser navigates here. */
    authorizationUrl: string;
    /** One-use state bound to the flow (TTL 600s); echo it back on the callback. */
    state: string;
}
/**
 * Response of the IdP SSO callback (`GET /api/auth/{provider}/callback`).
 * The access token is a JWT resolved via JWKS — usable as a normal Bearer
 * credential for every protected API.
 */
export interface IIdpCallbackResponse extends IAuthSessionResponse {
    /** CMS user id behind the IdP identity. */
    userId?: number;
    /** True when the callback created a new CMS user. */
    isNewUser?: boolean;
    /** Provider name (e.g. `microsoft`). */
    provider?: string;
    /** Access token mirror (present when served via the Nuxt proxy). */
    token?: string;
    accessToken?: string;
    refreshToken?: string;
    /** Access-token lifetime in seconds. */
    expiresIn?: number;
}
/** Response of `GET /api/auth/users` — list envelope (paginated or bare array). */
export interface IUsersResponse {
    items: ICmsUser[];
    total?: number;
    page?: number;
    perPage?: number;
}
export interface IAuthService {
    login(payload: ILoginPayload, userAgent?: string): Promise<IAuthRouteResponse>;
    logout(): Promise<unknown>;
    /** Exchange the refresh token for a new access token (`POST /api/oauth/token`). */
    token(): Promise<ITokenResponse>;
    /**
     * User registry (`GET /api/auth/users`) — the CMS auth users. Accepts
     * pagination + free-text search; normalizes bare-array responses into
     * `{ items }`.
     */
    users(query?: IUsersQuery): Promise<IUsersResponse>;
    /** Initialise a "Login with CBS" attempt (`POST /api/v1/auth/oauth/cbs/start`). */
    cbsStart(): Promise<ICbsStartResponse>;
    /** Complete a "Login with CBS" attempt (`POST /api/v1/auth/oauth/cbs/callback`). */
    cbsCallback(code: string, state: string, stateKey: string): Promise<IAuthRouteResponse>;
    /**
     * Initialise an IdP SSO login (`GET /api/auth/{provider}/login`). Returns the
     * provider authorize URL + one-use state; navigate the browser there.
     */
    idpLogin(provider: AuthIdpProvider, redirectUri: string): Promise<IIdpLoginStartResponse>;
    /**
     * Complete an IdP SSO login (`GET /api/auth/{provider}/callback`). Exchanges
     * `{code, state, redirectUri}` for a CMS JWT + refresh token; when served via
     * the Nuxt proxy the httpOnly cookies are already set and `token` mirrors the
     * access token.
     */
    idpCallback(provider: AuthIdpProvider, code: string, state: string, redirectUri: string): Promise<IIdpCallbackResponse>;
    /** Link the signed-in user to the provider (`POST /api/auth/{provider}/link`). */
    idpLink(provider: AuthIdpProvider): Promise<unknown>;
    /** Unlink the provider from the signed-in user (`DELETE /api/auth/{provider}/unlink`). */
    idpUnlink(provider: AuthIdpProvider): Promise<unknown>;
    /**
     * Initialise a "link existing account" flow for an arbitrary IdP provider
     * (e.g. `github`). Mirrors `idpLogin` but hits the engine's link-start
     * endpoint, which is distinct from the SSO login start: the user is
     * already authenticated and the round-trip only links an external
     * identity to the current CMS user (PIP-006).
     */
    idpLinkStart(provider: string): Promise<IIdpLoginStartResponse>;
    /**
     * Complete the link flow for an arbitrary IdP provider. The provider
     * rides as a body param (POST) — mirrors `idpLink` (PIP-006).
     */
    idpLinkCallback(provider: string, code: string, state: string): Promise<IIdpLinkCallbackResponse>;
    /**
     * Current session profile (`GET /api/auth/me`) — flat user record plus
     * `linkedIdentities[]`. Used by the portal to render the Connected
     * Accounts panel and to refresh state after a link/unlink round-trip.
     */
    me(): Promise<IMeResponse>;
}
/**
 * Auth domain service. Mirrors the CMS backend auth surface, which exposes
 * exactly three endpoints:
 *
 *   POST   /api/auth/login    → login   (confirmed — real backend)
 *   POST   /api/auth/logout   → logout  (confirmed — real backend, POST)
 *   POST   /api/oauth/token   → token   (confirmed — OAuth, grant_type=refresh_token)
 *
 * The access token is NOT returned in the login body — it travels in the
 * response header and is auto-captured by the `createApi` `onResponse` hook
 * into `TokenManager`. Callers therefore only deal with session domain data.
 * The `token()` method (refresh) returns the new access token in the body
 * (`{ token }`) so the caller can mirror it in memory.
 *
 * When a `routeApi` (Nuxt module) is configured, all three flows route through
 * the app-origin proxies (`/api/cms/login`, `/api/cms/logout`, `/api/cms/refresh`)
 * so the httpOnly cookies are set/cleared/rotated atomically.
 */
export declare function createAuthService(opts: IAuthServiceOptions): IAuthService;
//# sourceMappingURL=index.d.ts.map